Login or Register to Ask a Question and Join Our Community

Sponsored Content
Full Discussion: Help with NMAP
Special Forums Cybersecurity Help with NMAP Post 302788453 by renoir611 on Monday 1st of April 2013 10:30:58 PM
Old 04-01-2013
Help with NMAP
I'm seeing a persistent address showing up on my firewall router logs. The address is 10.98.115.9:67, and is broadcasting to 255.255.255.255. I know that this would typically signal a BOOTP service, such as a bootp server announcing itself on the network. But I can't isolate which machine it is. I have only one machine running, then turn off the standalone wireless router and the switch, but it continues to show up. I ran nmap against it, and it automatically included another, completely different, IP in the scan. It's got me baffled. Here's the output:

Code:
Ximian1 FC30-3DA9 # nmap -v -unprivilege - Pn 10.98.115.9

Starting Nmap 6.00 at 2013-04-01 18:03 PDT
Invalid target host specification: -
Initiating Ping Scan at 18:03
Scanning 2 hosts [2 ports/host]
Completed Ping Scan at 18:03, 2.35s elapsed (2 total hosts)
Initiating Parallel DNS resolution of 2 hosts. at 18:03
Completed Parallel DNS resolution of 2 hosts. at 18:03, 0.04s elapsed
Nmap scan report for 10.98.115.9 [host down]
Initiating Connect Scan at 18:03
Scanning Pn (80.68.93.100) [1000 ports]
Discovered open port 587/tcp on 80.68.93.100
Discovered open port 25/tcp on 80.68.93.100
Discovered open port 110/tcp on 80.68.93.100
Discovered open port 22/tcp on 80.68.93.100
Discovered open port 995/tcp on 80.68.93.100
Discovered open port 53/tcp on 80.68.93.100
Discovered open port 21/tcp on 80.68.93.100
Discovered open port 80/tcp on 80.68.93.100
Completed Connect Scan at 18:04, 16.47s elapsed (1000 total ports)
Nmap scan report for Pn (80.68.93.100)
Host is up (0.17s latency).
rDNS record for 80.68.93.100: tedside.pitcairn.net.pn
Not shown: 988 closed ports
PORT    STATE    SERVICE
21/tcp  open     ftp
22/tcp  open     ssh
25/tcp  open     smtp
53/tcp  open     domain
80/tcp  open     http
110/tcp open     pop3
135/tcp filtered msrpc
139/tcp filtered netbios-ssn
445/tcp filtered microsoft-ds
587/tcp open     submission
593/tcp filtered http-rpc-epmap
995/tcp open     pop3s

Read data files from: /usr/bin/../share/nmap
Nmap done: 2 IP addresses (1 host up) scanned in 18.90 seconds

Can anyone shed light on this behavior?

PS. it's not a one-off thing, I ran it several times and every time it did the same.
 

10 More Discussions You Might Find Interesting

1. Cybersecurity

Nmap

I am pretty new at running nmap ,and i have some doubt about some o/ps the nmap shows I tried to scan my own system for UDP open ports I see that if i use one UDP port say 13 It shows that its in open state , etc But if i scan for the whole UDP ports in the nmap-services . I gives te... (2 Replies)
Discussion started by: DPAI
2 Replies

2. UNIX for Dummies Questions & Answers

nmap results

Hi, Whenever I tried to run nmap on my linux (red hat 6.2) boxes i got these outputs: 4444/tcp filtered krb524 6666/tcp filtered irc-serv 6699/tcp filtered napster 8888/tcp filtered sun-answerbook Can anybody please... (10 Replies)
Discussion started by: necro
10 Replies

3. Shell Programming and Scripting

Nmap PHP FE

Hi everyone! I've temporarily come out of hibernation (and will be gone for about two weeks after this post too) to ask for input on a small PHP script I have just completed. The script aims to be a remote front-end for Nmap - now for the safety of this post, I ask that any replies refrain from... (6 Replies)
Discussion started by: Karma
6 Replies

4. AIX

nmap on aix 5.2

I'm trying to compile nmap 4.11 on an aix 5.2 machine and get the following error when attempting the 'make' command; make "Makefile", line 1: make: 1254-055 Dependency line needs colon or double colon operator. "Makefile", line 14: make: 1254-055 Dependency line needs colon or double colon... (2 Replies)
Discussion started by: zuessh
2 Replies

5. Red Hat

To change of port name in nmap

Hi, Is it possible to change the nmap port name: For eg: 21/tcp open ftp 53/tcp open domain 80/tcp open http 111/tcp open rpcbind 836/tcp open unknown 843/tcp open unknown 953/tcp open rndc I need to change the port number 836 unknown to the name of the... (4 Replies)
Discussion started by: gsiva
4 Replies

6. Shell Programming and Scripting

FTP/nmap/.netrc

So... I'm trying to script and FTP Backup of some files from openVMS Alpha machine to a Unixware 7 machine. I decided to use .netrc to do all the FTP actions however when I send the nmap command. It pretty much gets ignored while even other things such "ascii", "case" etc.. get respected... (0 Replies)
Discussion started by: thesubmitter
0 Replies

7. Solaris

Nmap error

I 'm getting following error when i run nmap for an ip .. what could be the reason for it ? #nmap 10.22.67.18 Starting Nmap 4.68 ( Nmap - Free Security Scanner For Network Exploration & Security Audits. ) at 2009-07-06 19:07 UTC Warning: Unable to open interface e1000g3301000 -- skipping it.... (2 Replies)
Discussion started by: fugitive
2 Replies

8. Linux

nmap binaries for linux

Hi , I am exploring the nmap utility for Linux. I know that, nmap binaries are specific to the platforms e.g. nmap binaries will be diferent for Windows , AIX , Solaris and Linux platforms. Can anyone tell me , will the nmap binaries be different for different flavours of Linux such as... (1 Reply)
Discussion started by: jatin56
1 Replies

9. Shell Programming and Scripting

How to scan IP range using nmap?

Scripting language : Bash Shell Script I have to create function in which read IP addresses one by one from one file (ip.txt) and scan these IP using nmap. (4 Replies)
Discussion started by: sk151993
4 Replies

10. Homework & Coursework Questions

How to scan IP range using nmap?

Scripting language : Bash Shell Script 1. problem statement I have to create function in which read IP addresses one by one from one file (iplist.txt) and scan these IP using nmap. This scan IP's output is saved in output.txt file and parse output.txt to save only open ports with particular IP... (3 Replies)
Discussion started by: sk151993
3 Replies

LEARN ABOUT LINUX

netmasks

netmasks(4)                                                        File Formats                                                        netmasks(4)

NAME

       netmasks - network mask database

SYNOPSIS

       /etc/inet/netmasks

       /etc/netmasks

DESCRIPTION

       The  netmasks file contains network masks used to implement IP subnetting. It supports both standard subnetting as specified in RFC-950 and
       variable length subnetting as specified in RFC-1519. When using standard subnetting there should be a single line for each network that  is
       subnetted in this file with the network number, any number of SPACE or TAB characters, and the network mask to use on that network. Network
       numbers and masks may be specified in the conventional IP `.' (dot) notation (like IP host addresses, but with zeroes for the  host  part).
       For example,

                               128.32.0.0    255.255.255.0

       can be used to specify that the Class B network 128.32.0.0 should have eight bits of subnet field and eight bits of host field, in addition
       to the standard sixteen bits in the network field.

       When using variable length subnetting, the format is identical. However, there should be a line for each subnet with the  first field being
       the  subnet  and the second field being the netmask that applies to that subnet. The users of the database, such as ifconfig(1M), perform a
       lookup to find the longest possible matching mask. It is possible to combine the  RFC-950 and  RFC-1519 form of subnet masks  in  the  net-
       masks file. For example,

                               128.32.0.0     255.255.255.0
                               128.32.27.0    255.255.255.240
                               128.32.27.16   255.255.255.240
                               128.32.27.32   255.255.255.240
                               128.32.27.48   255.255.255.240
                               128.32.27.64   255.255.255.240
                               128.32.27.80   255.255.255.240
                               128.32.27.96   255.255.255.240
                               128.32.27.112  255.255.255.240
                               128.32.27.128  255.255.255.240
                               128.32.27.144  255.255.255.240
                               128.32.27.160  255.255.255.240
                               128.32.27.176  255.255.255.240
                               128.32.27.192  255.255.255.240
                               128.32.27.208  255.255.255.240
                               128.32.27.224  255.255.255.240
                               128.32.27.240  255.255.255.240
                               128.32.64.0    255.255.255.192

       can  be  used  to  specify  different  netmasks  in different parts of the 128.32.0.0 Class B network number. Addresses 128.32.27.0 through
       128.32.27.255 have a subnet mask with 28 bits in the combined network and subnet fields  (often referred to as the subnet field) and 4 bits
       in  the  host  field.   Furthermore,  addresses  128.32.64.0  through  128.32.64.63  have a 26 bits in the subnet field. Finally, all other
       addresses in the range 128.32.0.0 through 128.32.255.255 have a 24 bit subnet field.

       Invalid entries are ignored.

SEE ALSO

       ifconfig(1M), inet(7P)

       Postel, Jon, and Mogul, Jeff, Internet Standard Subnetting Procedure, RFC 950, Network Information Center, SRI International,  Menlo  Park,
       Calif., August 1985.

       V.  Fuller,  T.  Li,  J. Yu, K. Varadhan, Classless Inter-Domain  Routing (CIDR): an Address Assignment and Aggregation Strategy, RFC 1519,
       Network Information Center, SRI International, Menlo Park, Calif., September 1993.

       T. Pummill, B. Manning, Variable Length Subnet Table For IPv4, RFC 1878, Network Information Center, SRI International, Menlo Park, Calif.,
       December 1995.

NOTES

       /etc/inet/netmasks is the official SVr4 name of the netmasks file.  The symbolic link /etc/netmasks exists for BSD compatibility.

SunOS 5.10                                                          7 Jan 1997                                                         netmasks(4)
All times are GMT -4. The time now is 08:55 PM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy