On Wed, Aug 27, 2003 at 01:10:14PM -0500, Cox, Michael wrote: > Has anyone ever seen a portscan w/ NMAP through Nessus start looping? That > is, it will scan ports 1 to 65535 and then start over at 65535 and work its > way back down to 1.
These are probably retransmissions. If Nmap gets no responses to its SYN packets (often because of a firewall is filtering the ports), Nmap must retransmit the probes to insure they weren't dropped due to some temporary network error. You must also be using -r, as Nmap randomizes the port order by default. Cheers, Fyodor http://www.insecure.org/
