Adding a new ping type: IPProto Ping. It's used with '-PO'. I've changed references to -P0 (zero) to -PN throughout the source code and refguide.xml

NmapOps.cc

@@ -202,7 +202,7 @@ void NmapOps::Initialize() {
   reference_FPs = NULL;
   magic_port = 33000 + (get_random_uint() % 31000);
   magic_port_set = 0;
-  num_ping_synprobes = num_ping_ackprobes = num_ping_udpprobes = 0;
+  num_ping_synprobes = num_ping_ackprobes = num_ping_udpprobes = num_ping_protoprobes = 0;
   timing_level = 3;
   max_parallelism = 0;
   min_parallelism = 0;
@@ -332,11 +332,11 @@ void NmapOps::ValidateOptions() {
   }
 
   if (pingtype != PINGTYPE_NONE && spoofsource) {
-    error("WARNING:  If -S is being used to fake your source address, you may also have to use -e <interface> and -P0 .  If you are using it to specify your real source address, you can ignore this warning.");
+    error("WARNING:  If -S is being used to fake your source address, you may also have to use -e <interface> and -PN .  If you are using it to specify your real source address, you can ignore this warning.");
   }
 
   if (pingtype != PINGTYPE_NONE && idlescan) {
-    error("WARNING: Many people use -P0 w/Idlescan to prevent pings from their true IP.  On the other hand, timing info Nmap gains from pings can allow for faster, more reliable scans.");
+    error("WARNING: Many people use -PN w/Idlescan to prevent pings from their true IP.  On the other hand, timing info Nmap gains from pings can allow for faster, more reliable scans.");
     sleep(2); /* Give ppl a chance for ^C :) */
   }
 
@@ -352,13 +352,16 @@ void NmapOps::ValidateOptions() {
    fatal("Sorry, UDP Ping (-PU) only works if you are root (because we need to read raw responses off the wire) and only for IPv4 (cause fyodor is too lazy right now to add IPv6 support and nobody has sent a patch)");
  }
 
+ if ((pingtype & PINGTYPE_PROTO) && (!isr00t || af() != AF_INET)) {
+   fatal("Sorry, IPProto Ping (-PO) only works if you are root (because we need to read raw responses off the wire) and only for IPv4");
+ }
 
  if (ipprotscan + (TCPScan() || UDPScan()) + listscan + pingscan > 1) {
    fatal("Sorry, the IPProtoscan, Listscan, and Pingscan (-sO, -sL, -sP) must currently be used alone rather than combined with other scan types.");
  }
 
  if ((pingscan && pingtype == PINGTYPE_NONE)) {
-    fatal("-P0 (skip ping) is incompatable with -sP (ping scan).  If you only want to enumerate hosts, try list scan (-sL)");
+    fatal("-PN (skip ping) is incompatable with -sP (ping scan).  If you only want to enumerate hosts, try list scan (-sL)");
   }
 
  if (pingscan && (TCPScan() || UDPScan() || ipprotscan || listscan)) {
@@ -413,7 +416,7 @@ void NmapOps::ValidateOptions() {
   }
   
   if (bouncescan && pingtype != PINGTYPE_NONE) 
-    log_write(LOG_STDOUT, "Hint: if your bounce scan target hosts aren't reachable from here, remember to use -P0 so we don't try and ping them prior to the scan\n");
+    log_write(LOG_STDOUT, "Hint: if your bounce scan target hosts aren't reachable from here, remember to use -PN so we don't try and ping them prior to the scan\n");
   
   if (ackscan+bouncescan+connectscan+finscan+idlescan+maimonscan+nullscan+synscan+windowscan+xmasscan > 1)
     fatal("You specified more than one type of TCP scan.  Please choose only one of -sA, -b, -sT, -sF, -sI, -sM, -sN, -sS, -sW, and -sX");

NmapOps.h

@@ -196,6 +196,8 @@ class NmapOps {
   u16 ping_ackprobes[MAX_PROBE_PORTS];
   int num_ping_udpprobes;
   u16 ping_udpprobes[MAX_PROBE_PORTS];
+  int num_ping_protoprobes;
+  u16 ping_protoprobes[MAX_PROBE_PORTS];
   /* Scan timing/politeness issues */
   int timing_level; // 0-5, corresponding to Paranoid, Sneaky, Polite, Normal, Aggressive, Insane
   int max_parallelism; // 0 means it has not been set

docs/refguide.xml

@@ -291,7 +291,7 @@ you would expect.</para>
     the simple ICMP echo request packets associated with the
     ubiquitous <application>ping</application> tool. Users can skip
     the ping step entirely with a list scan (<option>-sL</option>) or
-    by disabling ping (<option>-P0</option>), or engage the network
+    by disabling ping (<option>-PN</option>), or engage the network
     with arbitrary combinations of multi-port TCP SYN/ACK, UDP, and
     ICMP probes. The goal of these probes is to solicit responses
     which demonstrate that an IP address is actually active (is being
@@ -331,7 +331,7 @@ you would expect.</para>
     probes (<option>-PU</option>).  Read about the
     <option>-sP</option> option to learn how to perform
     <emphasis>only</emphasis> host discovery, or use
-    <option>-P0</option> to skip host discovery and port scan all
+    <option>-PN</option> to skip host discovery and port scan all
     target hosts.  The following options control host
     discovery:</para>
 
@@ -363,7 +363,7 @@ you would expect.</para>
           scanning, OS detection, or ping scanning cannot be combined
           with this.  If you wish to disable ping scanning while still
           performing such higher level functionality, read up on the
-          <option>-P0</option> option.</para>
+          <option>-PN</option> option.</para>
         </listitem>
       </varlistentry>
 
@@ -398,7 +398,7 @@ you would expect.</para>
            <option>--send-ip</option> was specified.
            The <option>-sP</option> option can be combined with any of the
            discovery probe types (the <option>-P*</option> options,
-           excluding <option>-P0</option>) for greater flexibility.
+           excluding <option>-PN</option>) for greater flexibility.
            If any of those probe type and port number options are
            used, the default probes (ACK and echo request) are
            overridden.  When strict firewalls are in place between the
@@ -413,8 +413,8 @@ you would expect.</para>
 
       <varlistentry>
         <term>
-          <option>-P0</option> (No ping)
+          <option>-PN</option> (No ping)
-          <indexterm><primary>-P0</primary></indexterm>
+          <indexterm><primary>-PN</primary></indexterm>
         </term>
         <listitem>
           <para>This option skips the Nmap discovery stage altogether.
@@ -422,12 +422,12 @@ you would expect.</para>
           for heavier scanning.  By default, Nmap only performs heavy
           probing such as port scans, version detection, or OS
           detection against hosts that are found to be up.  Disabling
-          host discovery with <option>-P0</option> causes Nmap to
+          host discovery with <option>-PN</option> causes Nmap to
           attempt the requested scanning functions against
           <emphasis>every</emphasis> target IP address specified.  So
           if a class B sized target address space (/16) is specified
           on the command line, all 65,536 IP addresses are scanned.
-          That second option character in <option>-P0</option> is a
+          That second option character in <option>-PN</option> is a
           zero and not the letter O.  Proper host discovery is skipped
           as with the list scan, but instead of stopping and printing
           the target list, Nmap continues to perform requested
@@ -643,6 +643,37 @@ you would expect.</para>
         </listitem>
       </varlistentry>
 
+      <varlistentry>
+        <term>
+        <option>-PO [protolist]</option> (IP Protocol Ping)
+          <indexterm><primary>-PO</primary></indexterm>
+          <indexterm><primary>IP Protocol ping</primary></indexterm>
+        </term>
+        <listitem>
+
+          <para>Another host discovery option is the IPProto ping,
+          which sends IP packets with the specified protocol numbers
+          in the Protocol field of the IP headers.  The protocol list
+          takes the same format as with the port lists in the
+          previously discussed TCP and UDP host discovery options.  If
+          no protocols are specified, the default is to send multiple
+          IP packets for ICMP (protocol 1), IGMP (protocol 2), TCP
+          (protocol 6) and UDP (protocol 17).  The default protocols
+          can be configured at compile-time by changing
+          DEFAULT_PROTO_PROBE_PORTS in <filename>nmap.h</filename>.
+          Note that for the ICMP, IGMP, TCP and UDP protocols, the
+          packets are sent with the additional headers while other
+          protocols are sent with no additional data beyond the IP
+          header (unless the <option>--data-length</option> option is
+          specified).</para>
+
+          <para>This host discovery method looks for responses in the
+          same protocol as the probes, or ICMP Protocol Unreachable
+          messages which signify the specified IP protocol isn't
+          supported on the host (which gives away that it's up).</para>
+
+        </listitem>
+      </varlistentry>
       <varlistentry>
         <term>
         <option>-PR</option> (ARP Ping)
@@ -1809,7 +1840,7 @@ way.</para>
           open and one closed TCP port are found. Set this option
           and Nmap will not even try OS detection against hosts
           that do not meet this criteria. This can save substantial
-          time, particularly on <option>-P0</option> scans against many hosts. It
+          time, particularly on <option>-PN</option> scans against many hosts. It
           only matters when OS detection is requested with <option>-O</option> or <option>-A</option>.</para>
         </listitem>
       </varlistentry>
@@ -2180,7 +2211,7 @@ unresponsive hosts.</para>
 Specifying a lower <option>--max-rtt-timeout</option> and
 <option>--initial-rtt-timeout</option> than the defaults can cut scan
 times significantly.  This is particularly true for pingless
-(<option>-P0</option>) scans, and those against heavily filtered
+(<option>-PN</option>) scans, and those against heavily filtered
 networks.  Don't get too aggressive though.  The scan can end up
 taking longer if you specify such a low value that many probes are
 timing out and retransmitting while the response is in transit.</para>
@@ -2583,7 +2614,7 @@ lists the relevant options and describes what they do.</para>
           to make the targets think that <emphasis>someone
           else</emphasis> is scanning them. Imagine a company being
           repeatedly port scanned by a competitor!  The
-          <option>-e</option> option and <option>-P0</option> are
+          <option>-e</option> option and <option>-PN</option> are
           generally required for this sort of usage.  Note that you
           usually won't receive reply packets back (they will be
           addressed to the IP you are spoofing), so Nmap won't produce
@@ -3650,17 +3681,17 @@ overwhelming requests.  Specify <option>--open</option> to only see
     what application is running.</para>
 
     <para>
-    <command>nmap -v -iR 100000 -P0 -p 80</command>
+    <command>nmap -v -iR 100000 -PN -p 80</command>
     </para>
 
     <para>Asks Nmap to choose 100,000 hosts at random and scan them
     for web servers (port 80).  Host enumeration is disabled with
-    <option>-P0</option> since first sending a couple probes to
+    <option>-PN</option> since first sending a couple probes to
     determine whether a host is up is wasteful when you are only
     probing one port on each target host anyway.</para>
 
     <para>
-      <command>nmap -P0 -p80 -oX logs/pb-port80scan.xml -oG
+      <command>nmap -PN -p80 -oX logs/pb-port80scan.xml -oG
       logs/pb-port80scan.gnmap 216.163.128.20/20</command>
     </para>
     <para>This scans 4096 IPs for any webservers (without pinging

nmap.cc

@@ -224,9 +224,10 @@ printf("%s %s ( %s )\n"
        "HOST DISCOVERY:\n"
        "  -sL: List Scan - simply list targets to scan\n"
        "  -sP: Ping Scan - go no further than determining if host is online\n"
-       "  -P0: Treat all hosts as online -- skip host discovery\n"
+       "  -PN: Treat all hosts as online -- skip host discovery\n"
        "  -PS/PA/PU [portlist]: TCP SYN/ACK or UDP discovery to given ports\n"
        "  -PE/PP/PM: ICMP echo, timestamp, and netmask request discovery probes\n"
+       "  -PO [protocol list]: IP Protocol Ping\n"
        "  -n/-R: Never do DNS resolution/Always resolve [default: sometimes]\n"
        "  --dns-servers <serv1[,serv2],...>: Specify custom DNS servers\n"
        "  --system-dns: Use OS's DNS resolver\n"
@@ -317,7 +318,7 @@ printf("%s %s ( %s )\n"
        "EXAMPLES:\n"
        "  nmap -v -A scanme.nmap.org\n"
        "  nmap -v -sP 192.168.0.0/16 10.0.0.0/8\n"
-       "  nmap -v -iR 10000 -P0 -p 80\n"
+       "  nmap -v -iR 10000 -PN -p 80\n"
        "SEE THE MAN PAGE FOR MANY MORE OPTIONS, DESCRIPTIONS, AND EXAMPLES\n", NMAP_NAME, NMAP_VERSION, NMAP_URL);
   exit(rc);
 }
@@ -1081,9 +1082,20 @@ int nmap_main(int argc, char *argv[]) {
 	  o.ping_ackprobes[0] = DEFAULT_TCP_PROBE_PORT;
 	}
       } else if (*optarg == 'O') {
-	fatal("-PO (the letter O)? No such option. Perhaps you meant to disable pings with -P0 (Zero).");
+	o.pingtype |= PINGTYPE_PROTO;
+	if (isdigit((int) *(optarg+1))) {
+	  o.num_ping_protoprobes = numberlist2array(optarg+1, o.ping_protoprobes, sizeof(o.ping_protoprobes), &proberr);
+	  if (o.num_ping_protoprobes < 0) {
+	    fatal("Bogus argument to -PO: %s", proberr);
+	  }
+	}
+	if (o.num_ping_protoprobes == 0) {
+	  u16 probes[] = DEFAULT_PROTO_PROBE_PORTS;
+	  o.num_ping_protoprobes = sizeof probes / sizeof *probes;
+	  memcpy(o.ping_protoprobes, probes, sizeof probes);
+	}
       } else { 
-	fatal("Illegal Argument to -P, use -P0, -PI, -PB, -PE, -PM, -PP, -PA, -PU, -PT, or -PT80 (or whatever number you want for the TCP probe destination port)"); 
+	fatal("Illegal Argument to -P, use -PN, -PO, -PI, -PB, -PE, -PM, -PP, -PA, -PU, -PT, or -PT80 (or whatever number you want for the TCP probe destination port)"); 
       }
       break;
     case 'p': 

nmap.h

@@ -287,6 +287,8 @@ void *realloc();
 				      to 113 */
 #define DEFAULT_UDP_PROBE_PORT 31338 /* The port UDP probes (esp. "ping" probes) go to if unspecified
 				     by user */
+#define DEFAULT_PROTO_PROBE_PORTS { 1, 2, 6, 17 } /* The IPProto ping probes to use if unspecified
+						     by user */
 
 #define MAX_DECOYS 128 /* How many decoys are allowed? */
 
@@ -351,6 +353,7 @@ void *realloc();
 #define PINGTYPE_CONNECTTCP 256
 #define PINGTYPE_UDP  512
 #define PINGTYPE_ARP 1024
+#define PINGTYPE_PROTO 2048
 
 #define DEFAULT_PING_TYPES PINGTYPE_TCP|PINGTYPE_TCP_USE_ACK|PINGTYPE_ICMP_PING
 

output.cc

@@ -1796,7 +1796,7 @@ void printfinaloutput() {
     error("WARNING: No targets were specified, so 0 hosts scanned.");
   if (o.numhosts_scanned == 1 && o.numhosts_up == 0 && !o.listscan && 
       o.pingtype != PINGTYPE_NONE)
-    log_write(LOG_STDOUT, "Note: Host seems down. If it is really up, but blocking our ping probes, try -P0\n");
+    log_write(LOG_STDOUT, "Note: Host seems down. If it is really up, but blocking our ping probes, try -PN\n");
   else if (o.numhosts_up > 0) {
     if (o.osscan && o.servicescan)
       log_write(LOG_PLAIN, "OS and Service detection performed. Please report any incorrect results at http://insecure.org/nmap/submit/ .\n");

scan_engine.cc

@@ -424,6 +424,9 @@ public:
   /* The index of the next UDP port in o.ping_udpprobes to probe during ping
      scan. */
   int next_udpportpingidx;
+  /* The index of the next IP protocol in o.ping_protoprobes to probe during ping
+     scan. */
+  int next_protoportpingidx;
   /* Whether we have sent an ICMP echo request. */
   bool sent_icmp_ping;
   /* Whether we have sent an ICMP address mask request. */
@@ -968,6 +971,7 @@ HostScanStats::HostScanStats(Target *t, UltraScanInfo *UltraSI) {
   next_ackportpingidx = 0;
   next_synportpingidx = 0;
   next_udpportpingidx = 0;
+  next_protoportpingidx = 0;
   sent_icmp_ping = false;
   sent_icmp_mask = false;
   sent_icmp_ts = false;
@@ -1220,7 +1224,7 @@ UltraScanInfo::~UltraScanInfo() {
 bool UltraScanInfo::isRawScan() {
   return scantype != CONNECT_SCAN
     && (tcp_scan || udp_scan || prot_scan || ping_scan_arp
-      || (ping_scan && (ptech.rawicmpscan || ptech.rawtcpscan || ptech.rawudpscan)));
+      || (ping_scan && (ptech.rawicmpscan || ptech.rawtcpscan || ptech.rawudpscan || ptech.rawprotoscan)));
 }
 
  /* A circular buffer of the incompleteHosts.  nextIncompleteHost() gives
@@ -1325,6 +1329,8 @@ void UltraScanInfo::Init(vector<Target *> &Targets, struct scan_lists *pts, styp
       else
         ptech.connecttcpscan = 1;
     }
+    if (o.pingtype & PINGTYPE_PROTO)
+      ptech.rawprotoscan = 1;
     if (o.pingtype & PINGTYPE_CONNECTTCP)
       ptech.connecttcpscan = 1;
     break;
@@ -1417,6 +1423,8 @@ unsigned int UltraScanInfo::numProbesPerHost()
       if (o.pingtype & PINGTYPE_ICMP_TS)
         numprobes++;
     }
+    if (ptech.rawprotoscan)
+      numprobes += o.num_ping_protoprobes;
     if (ptech.connecttcpscan)
       numprobes += o.num_ping_synprobes;
   } else assert(0); /* TODO: RPC scan */
@@ -1722,6 +1730,11 @@ static int get_next_target_probe(UltraScanInfo *USI, HostScanStats *hss,
         return 0;
       }
     }
+    if (USI->ptech.rawprotoscan) {
+      pspec->type = PS_PROTO;
+      pspec->proto = o.ping_protoprobes[hss->next_protoportpingidx++];
+      return 0;
+    }
     if (USI->ptech.connecttcpscan && hss->next_synportpingidx < o.num_ping_synprobes) {
       pspec->type = PS_CONNECTTCP;
       pspec->proto = IPPROTO_TCP;
@@ -1771,6 +1784,8 @@ int HostScanStats::freshPortsLeft() {
       if ((o.pingtype & PINGTYPE_ICMP_TS) && !sent_icmp_ts)
         num_probes++;
     }
+    if (USI->ptech.rawprotoscan)
+      num_probes += o.num_ping_protoprobes - next_protoportpingidx;
     if (USI->ptech.connecttcpscan && next_synportpingidx < o.num_ping_synprobes)
       num_probes += o.num_ping_synprobes - next_synportpingidx;
     return num_probes;
@@ -2910,7 +2925,7 @@ static void retransmitProbe(UltraScanInfo *USI, HostScanStats *hss,
 			    UltraProbe *probe) {
   UltraProbe *newProbe = NULL;
   if (probe->type == UltraProbe::UP_IP) {
-    if (USI->prot_scan)
+    if (USI->prot_scan || USI->ptech.rawprotoscan)
       newProbe = sendIPScanProbe(USI, hss, probe->pspec(), 
 				 probe->tryno + 1, 0);
     else if (probe->protocol() == IPPROTO_TCP) {
@@ -3856,6 +3871,34 @@ static int get_ping_pcap_result(UltraScanInfo *USI, struct timeval *stime) {
     if (ip->ip_hl < 5)
       continue;
 
+    if (USI->ptech.rawprotoscan) {
+      memset(&sin, 0, sizeof(sin));
+      sin.sin_addr.s_addr = ip->ip_src.s_addr;
+      sin.sin_family = AF_INET;
+      hss = USI->findHost((struct sockaddr_storage *) &sin);
+      if (hss) {
+	setTargetMACIfAvailable(hss->target, &linkhdr, ip, 0);
+	probeI = hss->probes_outstanding.end();
+	listsz = hss->num_probes_outstanding();
+	goodone = false;
+	for(probenum = 0; probenum < listsz && !goodone; probenum++) {
+	  probeI--;
+	  probe = *probeI;
+	    
+	  if (probe->protocol() == ip->ip_p) {
+	    /* if this is our probe we sent to localhost, then it doesn't count! */
+	    if (ip->ip_src.s_addr == ip->ip_dst.s_addr &&
+		probe->ipid() == ntohs(ip->ip_id))
+	      continue;
+
+	    newstate = HOST_UP;
+	    current_reason = ER_PROTORESPONSE;
+	    goodone = true;
+          }
+        }
+      }
+    }
+
     /* First check if it is ICMP, TCP, or UDP */
     if (ip->ip_p == IPPROTO_ICMP) {
       /* if it is our response */
@@ -3931,13 +3974,15 @@ static int get_ping_pcap_result(UltraScanInfo *USI, struct timeval *stime) {
         }
 
         struct ip *ip2 = (struct ip *) ((char *) ip + ip->ip_hl * 4 + 8);
-        if (bytes < ip->ip_hl * 4 + 8U + ip2->ip_hl * 4 + 8U) {
+
+	/* IPProto Scan (generally) sends bare IP headers, so no extra payload */
+        if (bytes < ip->ip_hl * 4 + 8U + ip2->ip_hl * 4 + 8U && !USI->ptech.rawprotoscan) {
           if (o.debugging)
             error("ICMP (embedded) type %d code %d packet is only %d bytes\n", ping->type, ping->code, bytes);
           continue;
         }
 
-        if (ip2->ip_p == IPPROTO_ICMP) {
+        if (ip2->ip_p == IPPROTO_ICMP && !USI->ptech.rawprotoscan) {
           /* The response was based on a ping packet we sent */
           if (!USI->ptech.rawicmpscan) {
             if (o.debugging)
@@ -3976,7 +4021,7 @@ static int get_ping_pcap_result(UltraScanInfo *USI, struct timeval *stime) {
           /* Did we fail to find a probe? */
           if (probenum >= listsz)
             continue;
-        } else if (ip2->ip_p == IPPROTO_TCP) {
+        } else if (ip2->ip_p == IPPROTO_TCP && !USI->ptech.rawprotoscan) {
           /* The response was based our TCP probe */
           if (!USI->ptech.rawtcpscan) {
             if (o.debugging)
@@ -4031,7 +4076,7 @@ static int get_ping_pcap_result(UltraScanInfo *USI, struct timeval *stime) {
           /* Did we fail to find a probe? */
           if (probenum >= listsz)
             continue;
-        } else if (ip2->ip_p == IPPROTO_UDP) {
+        } else if (ip2->ip_p == IPPROTO_UDP && !USI->ptech.rawprotoscan) {
           /* The response was based our UDP probe */
           if (!USI->ptech.rawudpscan) {
             if (o.debugging)
@@ -4083,7 +4128,40 @@ static int get_ping_pcap_result(UltraScanInfo *USI, struct timeval *stime) {
           /* Did we fail to find a probe? */
           if (probenum >= listsz)
             continue;
-        } else {
+        } else if (USI->ptech.rawprotoscan) {
+          memset(&sin, 0, sizeof(sin));
+          sin.sin_addr.s_addr = ip2->ip_dst.s_addr;
+          sin.sin_family = AF_INET;
+          hss = USI->findHost((struct sockaddr_storage *) &sin);
+          if (!hss) continue; // Not referring to a host that interests us
+          setTargetMACIfAvailable(hss->target, &linkhdr, ip, 0);
+          probeI = hss->probes_outstanding.end();
+          listsz = hss->num_probes_outstanding();
+
+          /* Find the probe that provoked this response. */
+          for (probenum = 0; probenum < listsz; probenum++) {
+            probeI--;
+            probe = *probeI;
+            goodseq = false;
+
+            if (o.af() != AF_INET || probe->protocol() != ip2->ip_p)
+              continue;
+
+            if (!allow_ipid_match(probe->ipid(), ntohs(ip2->ip_id)))
+              continue;
+
+            /* Ensure the connection info matches. */
+            if (hss->target->v4sourceip()->s_addr != ip->ip_dst.s_addr)
+              continue;
+
+            /* If we made it this far, we found it. We don't yet know if it's
+               going to change a host state (goodone) or not. */
+            break;
+	  }
+          /* Did we fail to find a probe? */
+          if (probenum >= listsz)
+            continue;
+	} else {
           if (o.debugging)
             error("Got ICMP response to a packet which was not TCP, UDP, or ICMP");
           continue;
@@ -4119,7 +4197,7 @@ static int get_ping_pcap_result(UltraScanInfo *USI, struct timeval *stime) {
           log_write(LOG_STDOUT, "Got ICMP message type %d code %d\n", ping->type, ping->code);
         }
       }
-    } else if (ip->ip_p == IPPROTO_TCP) {
+    } else if (ip->ip_p == IPPROTO_TCP && !USI->ptech.rawprotoscan) {
       if (!USI->ptech.rawtcpscan) {
         continue;
       }
@@ -4202,7 +4280,7 @@ static int get_ping_pcap_result(UltraScanInfo *USI, struct timeval *stime) {
         if (o.debugging)
           log_write(LOG_STDOUT, "We got a TCP ping packet back from %s port %hi (trynum = %d)\n", inet_ntoa(ip->ip_src), ntohs(tcp->th_sport), trynum);
       }
-    } else if (ip->ip_p == IPPROTO_UDP) {
+    } else if (ip->ip_p == IPPROTO_UDP && !USI->ptech.rawprotoscan) {
       if (!USI->ptech.rawudpscan) {
         continue;
       }
@@ -4253,7 +4331,7 @@ static int get_ping_pcap_result(UltraScanInfo *USI, struct timeval *stime) {
         if (o.debugging)
           log_write(LOG_STDOUT, "In response to UDP-ping, we got UDP packet back from %s port %hi (trynum = %d)\n", inet_ntoa(ip->ip_src), htons(udp->uh_sport), trynum);
       }
-    } else if (o.debugging) {
+    } else if (!USI->ptech.rawprotoscan && o.debugging) {
       error("Found whacked packet protocol %d in %s.", ip->ip_p, __func__);
     }
   } while (!goodone && !timedout);
@@ -4349,7 +4427,7 @@ static void begin_sniffer(UltraScanInfo *USI, vector<Target *> &Targets) {
     if (len < 0 || len >= (int) sizeof(pcap_filter))
       fatal("ran out of space in pcap filter");
     filterlen = len;
-  } else if (USI->prot_scan) {
+  } else if (USI->prot_scan || (USI->ping_scan && USI->ptech.rawprotoscan)) {
     if (doIndividual)
       len = Snprintf(pcap_filter, sizeof(pcap_filter), 
 		     "dst host %s and (icmp or (%s))", 

targets.cc

@@ -503,7 +503,7 @@ do {
 	 3) We are doing a raw-mode portscan or osscan OR
 	 4) We are on windows and doing ICMP ping */
       if (o.isr00t && o.af() == AF_INET && 
-	  ((pingtype & (PINGTYPE_TCP|PINGTYPE_UDP|PINGTYPE_ARP)) || o.RawScan()
+	  ((pingtype & (PINGTYPE_TCP|PINGTYPE_UDP|PINGTYPE_PROTO|PINGTYPE_ARP)) || o.RawScan()
 #ifdef WIN32
 	   || (pingtype & (PINGTYPE_ICMP_PING|PINGTYPE_ICMP_MASK|PINGTYPE_ICMP_TS))
 #endif // WIN32

targets.h

@@ -158,7 +158,8 @@ struct pingtech {
   unsigned int rawicmpscan: 1,
     connecttcpscan: 1,
     rawtcpscan: 1,
-    rawudpscan: 1;
+    rawudpscan: 1,
+    rawprotoscan: 1;
 };
 
 

tcpip.cc

@@ -949,7 +949,7 @@ fatal("Call to pcap_open_live(%s, %d, %d, %d) failed three times. Reported error
           "LINUX: If you are getting Socket type not supported, try modprobe af_packet or recompile your kernel with SOCK_PACKET enabled.\n"
           "*BSD:  If you are getting device not configured, you need to recompile your kernel with Berkeley Packet Filter support.  If you are getting No such file or directory, try creating the device (eg cd /dev; MAKEDEV <device>; or use mknod).\n"
           "*WINDOWS:  Nmap only supports ethernet interfaces on Windows for most operations because Microsoft disabled raw sockets as of Windows XP SP2.  Depending on the reason for this error, it is possible that the --unprivileged command-line argument will help.\n"
-          "SOLARIS:  If you are trying to scan localhost and getting '/dev/lo0: No such file or directory', complain to Sun.  I don't think Solaris can support advanced localhost scans.  You can probably use \"-P0 -sT localhost\" though.\n\n", pcapdev, snaplen, promisc, to_ms, err0r);
+          "SOLARIS:  If you are trying to scan localhost and getting '/dev/lo0: No such file or directory', complain to Sun.  I don't think Solaris can support advanced localhost scans.  You can probably use \"-PN -sT localhost\" though.\n\n", pcapdev, snaplen, promisc, to_ms, err0r);
       } else {
 	error("pcap_open_live(%s, %d, %d, %d) FAILED. Reported error: %s.  Will wait %d seconds then retry.", pcapdev, snaplen, promisc, to_ms, err0r, (int) pow(5.0, failed));	
       }