I never received any responses on this so I thought I'd rephrase the question before I spend more time on this...
Does nmap work for anyone when scanning hosts on the Internet using 3.7's kernel pppoe? Thanks, Danny Melameth, Daniel D. wrote: > Anyone else experiencing issues when scanning a host on the Internet > and using pppoe? It's as if nmap never sees the packets, but tcpdump > clearly shows packets being received. I'm running 3.7 -release and > nmap works fine when scanning on all the other interfaces. This > issue is reproducible with pf enabled and disabled. Thoughts > appreciated... > > $ sudo nmap -v -P0 -O 208.139.x.x > > Starting nmap 3.81 ( http://www.insecure.org/nmap/ ) at 2005-07-15 > 17:38 MDT > Initiating SYN Stealth Scan against 208.139.x.x [1663 ports] at 17:38 > SYN Stealth Scan Timing: About 8.78% done; ETC: 17:43 (0:05:14 > remaining) > The SYN Stealth Scan took 337.75s to scan 1663 total ports. > Warning: OS detection will be MUCH less reliable because we did not > find at least 1 open and 1 closed TCP port > Host 208.139.x.x appears to be up ... good. > All 1663 scanned ports on 208.139.x.x are: filtered > Too many fingerprints match this host to give specific OS details > TCP/IP fingerprint: > SInfo(V=3.81%P=i386-unknown-openbsd3.7%D=7/15%Tm=42D84A53%O=-1%C=-1) > T5(Resp=N) > T6(Resp=N) > T7(Resp=N) > PU(Resp=N) > > Nmap finished: 1 IP address (1 host up) scanned in 375.502 seconds > Raw packets sent: 3344 (134KB) | Rcvd: 0 (0B) > > $ sudo tcpdump -ni pppoe0 src host 208.139.x.x > tcpdump: listening on pppoe0, link-type PPP_ETHER > 17:38:05.191581 208.139.x.x.22 > 216.160.x.x.50360: S > 2447336077:2447336077(0) ack 1845698994 win 16384 <mss 1460> (DF) > 17:38:07.222825 208.139.x.x.22 > 216.160.x.x.50361: S > 4087438315:4087438315(0) ack 1845633457 win 16384 <mss 1460> (DF) > 17:38:08.212759 208.139.x.x.80 > 216.160.x.x.50360: S > 3547667142:3547667142(0) ack 1845698994 win 16384 <mss 1460> (DF) > 17:38:09.231993 208.139.x.x.80 > 216.160.x.x.50361: S > 2807575700:2807575700(0) ack 1845633457 win 16384 <mss 1460> (DF)
