Nmap
為什麼 nmap 發送兩個數據包以測試單個埠
我使用 sudo 以 root 權限執行 nmap,所以我假設它可以完全訪問創建原始套接字。當我使用該命令時,Wireshark 顯示用於測試單個埠的兩個數據包
sudo nmap 192.168.110.153 -p21
這是正常的行為嗎?為什麼?
sudo nmap 192.168.110.153 -p21 --packet-trace Starting Nmap 6.40 ( http://nmap.org ) at 2015-05-19 19:18 BST SENT (0.0447s) ARP who-has 192.168.110.153 tell 192.168.110.155 RCVD (0.0450s) ARP reply 192.168.110.153 is-at 00:0C:29:F4:05:E0 NSOCK INFO [0.2450s] nsi_new2(): nsi_new (IOD #1) NSOCK INFO [0.2450s] nsock_connect_udp(): UDP connection requested to 127.0.1.1:53 (IOD #1) EID 8 NSOCK INFO [0.2460s] nsock_read(): Read request from IOD #1 [127.0.1.1:53] (timeout: -1ms) EID 18 NSOCK INFO [0.2460s] nsock_trace_handler_callback(): Callback: CONNECT SUCCESS for EID 8 [127.0.1.1:53] NSOCK INFO [0.2460s] nsock_trace_handler_callback(): Callback: WRITE SUCCESS for EID 27 [127.0.1.1:53] NSOCK INFO [0.2740s] nsock_trace_handler_callback(): Callback: READ SUCCESS for EID 18 [127.0.1.1:53] (46 bytes): *%...........153.110.168.192.in-addr.arpa..... NSOCK INFO [0.2740s] nsock_read(): Read request from IOD #1 [127.0.1.1:53] (timeout: -1ms) EID 34 NSOCK INFO [0.2740s] nsi_delete(): nsi_delete (IOD #1) NSOCK INFO [0.2740s] msevent_cancel(): msevent_cancel on event #34 (type READ) SENT (0.2751s) TCP 192.168.110.155:45170 > 192.168.110.153:21 S ttl=39 id=28633 iplen=44 seq=3053138125 win=1024 <mss 1460> SENT (0.3754s) TCP 192.168.110.155:45171 > 192.168.110.153:21 S ttl=46 id=8796 iplen=44 seq=3053072588 win=1024 <mss 1460> RCVD (0.2759s) TCP 192.168.110.153:21 > 192.168.110.155:45170 RA ttl=64 id=14442 iplen=40 seq=0 win=0 RCVD (0.3756s) TCP 192.168.110.153:21 > 192.168.110.155:45171 RA ttl=64 id=14443 iplen=40 seq=0 win=0 Nmap scan report for 192.168.110.153 Host is up (0.00047s latency). PORT STATE SERVICE 21/tcp closed ftp MAC Address: 00:0C:29:F4:05:E0 (VMware) Nmap done: 1 IP address (1 host up) scanned in 0.50 seconds
libpcap
在將數據包傳遞給 Nmap 之前排隊數據包似乎存在問題。注意 Wireshark 和 Nmap 在數據包排序上的區別;即使時間戳相同,列印行的順序顯示數據包是在發送第二個 SYN 數據包*之後傳送到 Nmap 的。*我們最近在與數據包環/TPACKET 介面相關的較新 Linux 核心上遇到了 libpcap 1.5.3(可能還有 1.6 分支,尚未測試)的問題,在數據包到達時沒有傳送數據包。的輸出是nmap --version
什麼?根本問題是 Linux 中的一個錯誤,該錯誤已經修復但未向後移植。我們通過將 libpcap 升級到版本 1.7.3 解決了這個問題,該版本有一些變通方法。