Login or Register to Ask a Question and Join Our Community

Sponsored Content
Full Discussion: Help with NMAP
Special Forums Cybersecurity Help with NMAP Post 302788453 by renoir611 on Monday 1st of April 2013 10:30:58 PM
Old 04-01-2013
Help with NMAP
I'm seeing a persistent address showing up on my firewall router logs. The address is 10.98.115.9:67, and is broadcasting to 255.255.255.255. I know that this would typically signal a BOOTP service, such as a bootp server announcing itself on the network. But I can't isolate which machine it is. I have only one machine running, then turn off the standalone wireless router and the switch, but it continues to show up. I ran nmap against it, and it automatically included another, completely different, IP in the scan. It's got me baffled. Here's the output:

Code:
Ximian1 FC30-3DA9 # nmap -v -unprivilege - Pn 10.98.115.9

Starting Nmap 6.00 at 2013-04-01 18:03 PDT
Invalid target host specification: -
Initiating Ping Scan at 18:03
Scanning 2 hosts [2 ports/host]
Completed Ping Scan at 18:03, 2.35s elapsed (2 total hosts)
Initiating Parallel DNS resolution of 2 hosts. at 18:03
Completed Parallel DNS resolution of 2 hosts. at 18:03, 0.04s elapsed
Nmap scan report for 10.98.115.9 [host down]
Initiating Connect Scan at 18:03
Scanning Pn (80.68.93.100) [1000 ports]
Discovered open port 587/tcp on 80.68.93.100
Discovered open port 25/tcp on 80.68.93.100
Discovered open port 110/tcp on 80.68.93.100
Discovered open port 22/tcp on 80.68.93.100
Discovered open port 995/tcp on 80.68.93.100
Discovered open port 53/tcp on 80.68.93.100
Discovered open port 21/tcp on 80.68.93.100
Discovered open port 80/tcp on 80.68.93.100
Completed Connect Scan at 18:04, 16.47s elapsed (1000 total ports)
Nmap scan report for Pn (80.68.93.100)
Host is up (0.17s latency).
rDNS record for 80.68.93.100: tedside.pitcairn.net.pn
Not shown: 988 closed ports
PORT    STATE    SERVICE
21/tcp  open     ftp
22/tcp  open     ssh
25/tcp  open     smtp
53/tcp  open     domain
80/tcp  open     http
110/tcp open     pop3
135/tcp filtered msrpc
139/tcp filtered netbios-ssn
445/tcp filtered microsoft-ds
587/tcp open     submission
593/tcp filtered http-rpc-epmap
995/tcp open     pop3s

Read data files from: /usr/bin/../share/nmap
Nmap done: 2 IP addresses (1 host up) scanned in 18.90 seconds

Can anyone shed light on this behavior?

PS. it's not a one-off thing, I ran it several times and every time it did the same.
 

10 More Discussions You Might Find Interesting

1. Cybersecurity

Nmap

I am pretty new at running nmap ,and i have some doubt about some o/ps the nmap shows I tried to scan my own system for UDP open ports I see that if i use one UDP port say 13 It shows that its in open state , etc But if i scan for the whole UDP ports in the nmap-services . I gives te... (2 Replies)
Discussion started by: DPAI
2 Replies

2. UNIX for Dummies Questions & Answers

nmap results

Hi, Whenever I tried to run nmap on my linux (red hat 6.2) boxes i got these outputs: 4444/tcp filtered krb524 6666/tcp filtered irc-serv 6699/tcp filtered napster 8888/tcp filtered sun-answerbook Can anybody please... (10 Replies)
Discussion started by: necro
10 Replies

3. Shell Programming and Scripting

Nmap PHP FE

Hi everyone! I've temporarily come out of hibernation (and will be gone for about two weeks after this post too) to ask for input on a small PHP script I have just completed. The script aims to be a remote front-end for Nmap - now for the safety of this post, I ask that any replies refrain from... (6 Replies)
Discussion started by: Karma
6 Replies

4. AIX

nmap on aix 5.2

I'm trying to compile nmap 4.11 on an aix 5.2 machine and get the following error when attempting the 'make' command; make "Makefile", line 1: make: 1254-055 Dependency line needs colon or double colon operator. "Makefile", line 14: make: 1254-055 Dependency line needs colon or double colon... (2 Replies)
Discussion started by: zuessh
2 Replies

5. Red Hat

To change of port name in nmap

Hi, Is it possible to change the nmap port name: For eg: 21/tcp open ftp 53/tcp open domain 80/tcp open http 111/tcp open rpcbind 836/tcp open unknown 843/tcp open unknown 953/tcp open rndc I need to change the port number 836 unknown to the name of the... (4 Replies)
Discussion started by: gsiva
4 Replies

6. Shell Programming and Scripting

FTP/nmap/.netrc

So... I'm trying to script and FTP Backup of some files from openVMS Alpha machine to a Unixware 7 machine. I decided to use .netrc to do all the FTP actions however when I send the nmap command. It pretty much gets ignored while even other things such "ascii", "case" etc.. get respected... (0 Replies)
Discussion started by: thesubmitter
0 Replies

7. Solaris

Nmap error

I 'm getting following error when i run nmap for an ip .. what could be the reason for it ? #nmap 10.22.67.18 Starting Nmap 4.68 ( Nmap - Free Security Scanner For Network Exploration & Security Audits. ) at 2009-07-06 19:07 UTC Warning: Unable to open interface e1000g3301000 -- skipping it.... (2 Replies)
Discussion started by: fugitive
2 Replies

8. Linux

nmap binaries for linux

Hi , I am exploring the nmap utility for Linux. I know that, nmap binaries are specific to the platforms e.g. nmap binaries will be diferent for Windows , AIX , Solaris and Linux platforms. Can anyone tell me , will the nmap binaries be different for different flavours of Linux such as... (1 Reply)
Discussion started by: jatin56
1 Replies

9. Shell Programming and Scripting

How to scan IP range using nmap?

Scripting language : Bash Shell Script I have to create function in which read IP addresses one by one from one file (ip.txt) and scan these IP using nmap. (4 Replies)
Discussion started by: sk151993
4 Replies

10. Homework & Coursework Questions

How to scan IP range using nmap?

Scripting language : Bash Shell Script 1. problem statement I have to create function in which read IP addresses one by one from one file (iplist.txt) and scan these IP using nmap. This scan IP's output is saved in output.txt file and parse output.txt to save only open ports with particular IP... (3 Replies)
Discussion started by: sk151993
3 Replies

LEARN ABOUT SUSE

tcp-environ

tcp-environ(5)							File Formats Manual						    tcp-environ(5)

NAME

       tcp-environ - TCP-related environment variables

DESCRIPTION

       The  following environment variables describe a TCP connection.	They are set up by tcp-env, tcpclient, and tcpserver.  Note that TCPLOCAL-
       HOST, TCPREMOTEHOST, and TCPREMOTEINFO can contain arbitrary characters.

       PROTO
	    The string TCP.

       TCPLOCALHOST
	    The domain name of the local host, with uppercase letters converted to lowercase.  If there is no currently available domain name  for
	    the local IP address, TCPLOCALHOST is not set.

       TCPLOCALIP
	    The IP address of the local host, in dotted-decimal form.

       TCPLOCALPORT
	    The local TCP port number, in decimal.

       TCPREMOTEHOST
	    The domain name of the remote host, with uppercase letters converted to lowercase.	If there is no currently available domain name for
	    the remote IP address, TCPREMOTEHOST is not set.

       TCPREMOTEINFO
	    A connection-specific string, perhaps a username, supplied by the remote host via 931/1413/IDENT/TAP.  If the remote host did not sup-
	    ply connection information, TCPREMOTEINFO is not set.

       TCPREMOTEIP
	    The IP address of the remote host.

       TCPREMOTEPORT
	    The remote TCP port number.

SEE ALSO

       tcpclient(1), tcpserver(1), tcp-env(1), tcp(4)

																    tcp-environ(5)
All times are GMT -4. The time now is 07:01 AM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy