diff --git a/docs/refguide.xml b/docs/refguide.xml index 483e8775b..b99aa9fc4 100644 --- a/docs/refguide.xml +++ b/docs/refguide.xml @@ -3181,11 +3181,14 @@ allowed any incoming UDP packets with the source port 53 (DNS) or 67 Nmap offers the and options (they are equivalent) to exploit these weaknesses. Simply provide a port number and Nmap will send packets -from that port where possible. Nmap must use different port numbers -for certain OS detection tests to work properly, and DNS requests -ignore the flag because Nmap relies on system -libraries to handle those. Most TCP scans, including SYN scan, -support the option completely, as does UDP scan. +from that port where possible. Most scanning operations that use raw sockets, +including SYN and UDP scans, support the option completely. The option notably +doesn't have an effect for any operations that use normal operating system +sockets, including DNS requests, TCP connect +scan,connect scan version detection, +and script scanning. Setting the source port also doesn't work for OS detection, +because Nmap must use different port numbers for certain OS detection tests to +work properly.