From 24e30769e89858dbf25a9f82da716d1f0488199f Mon Sep 17 00:00:00 2001 From: kris Date: Sat, 20 Jan 2007 22:15:49 +0000 Subject: [PATCH] Merging my UDP localhost patch. It fixes the UDP scan on localhost picking up it's own port. It also fixes the TCP one so that it doesn't print a message (with -d) about receiving a response with unexpected flags (like getting a SYN for a SYN scan because it's our port). The problem was that the IP ID wasn't ntohs()'d while checking for this, so we still saw our port on UDP. I simply copied this to the TCP part to avoid the message. --- scan_engine.cc | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/scan_engine.cc b/scan_engine.cc index c0f574f9f..22b3839a2 100644 --- a/scan_engine.cc +++ b/scan_engine.cc @@ -2957,6 +2957,13 @@ static bool get_pcap_result(UltraScanInfo *USI, struct timeval *stime) { } else if (USI->scantype == ACK_SCAN) { newstate = PORT_UNFILTERED; } else newstate = PORT_CLOSED; + } else if (probe->dport() == probe->sport() && + ip->ip_src.s_addr == ip->ip_dst.s_addr && + probe->ipid() == ntohs(ip->ip_id)) { + /* Sometimes we get false results when scanning localhost with + -p- because we scan localhost with src port = dst port and + see our outgoing packet and think it is a response. */ + continue; } else { if (o.debugging) error("Received scan response with unexpected TCP flags: %d\n", tcp->th_flags); @@ -3120,7 +3127,7 @@ static bool get_pcap_result(UltraScanInfo *USI, struct timeval *stime) { see our outgoing packet and think it is a response. */ if (probe->dport() == probe->sport() && ip->ip_src.s_addr == ip->ip_dst.s_addr && - probe->ipid() == ip->ip_id) + probe->ipid() == ntohs(ip->ip_id)) continue; /* We saw the packet we ourselves sent */ newstate = PORT_OPEN;