diff --git a/NmapOps.cc b/NmapOps.cc index 78412ac49..9201dc9b4 100644 --- a/NmapOps.cc +++ b/NmapOps.cc @@ -256,9 +256,10 @@ void NmapOps::Initialize() { override_excludeports = 0; version_intensity = 7; pingtype = PINGTYPE_UNKNOWN; - listscan = pingscan = allowall = ackscan = bouncescan = connectscan = 0; + listscan = allowall = ackscan = bouncescan = connectscan = 0; rpcscan = nullscan = xmasscan = fragscan = synscan = windowscan = 0; - maimonscan = idlescan = finscan = udpscan = ipprotscan = noresolve = 0; + maimonscan = idlescan = finscan = udpscan = ipprotscan; + noportscan = noresolve = 0; sctpinitscan = 0; sctpcookieechoscan = 0; append_output = 0; @@ -344,7 +345,7 @@ void NmapOps::ValidateOptions() { /* Insure that at least one scantype is selected */ - if (TCPScan() + UDPScan() + SCTPScan() + ipprotscan + listscan + pingscan == 0) { + if (!noportscan && !(TCPScan() || UDPScan() || SCTPScan() || ipprotscan)) { if (isr00t && af() == AF_INET) synscan++; else connectscan++; @@ -380,16 +381,16 @@ void NmapOps::ValidateOptions() { fatal("Sorry, IPProto Ping (-PO) only works if you are root (because we need to read raw responses off the wire) and only for IPv4"); } - if (ipprotscan + (TCPScan() || UDPScan() || SCTPScan()) + listscan + pingscan > 1) { - fatal("Sorry, the IPProtoscan, Listscan, and Pingscan (-sO, -sL, -sP) must currently be used alone rather than combined with other scan types."); + if (ipprotscan && (TCPScan() || UDPScan() || SCTPScan())) { + fatal("Sorry, the IPProtoscan (-sO) must currently be used alone rather than combined with other scan types."); } - if ((pingscan && pingtype == PINGTYPE_NONE)) { + if ((noportscan && pingtype == PINGTYPE_NONE && !listscan)) { fatal("-PN (skip ping) is incompatable with -sP (ping scan). If you only want to enumerate hosts, try list scan (-sL)"); } - if (pingscan && (TCPScan() || UDPScan() || SCTPScan() || ipprotscan || listscan)) { - fatal("Ping scan is not valid with any other scan types (the other ones all include a ping scan"); + if (noportscan && (TCPScan() || UDPScan() || SCTPScan() || ipprotscan)) { + fatal("-sL and -sP (skip port scan) are not valid with any other scan types"); } if (af() == AF_INET6 && (pingtype & (PINGTYPE_ICMP_PING|PINGTYPE_ICMP_MASK|PINGTYPE_ICMP_TS))) { @@ -453,8 +454,8 @@ void NmapOps::ValidateOptions() { } #endif - if (osscan && pingscan) { - fatal("WARNING: OS Scan is unreliable with a ping scan. You need to use a scan type along with it, such as -sS, -sT, -sF, etc instead of -sP"); + if (osscan && noportscan) { + fatal("WARNING: OS Scan is unreliable without a port scan. You need to use a scan type along with it, such as -sS, -sT, -sF, etc instead of -sP"); } if (osscan && ipprotscan) { @@ -467,7 +468,7 @@ void NmapOps::ValidateOptions() { servicescan = 0; } - if (servicescan && pingscan) + if (servicescan && noportscan) servicescan = 0; if (defeat_rst_ratelimit && !synscan) { diff --git a/NmapOps.h b/NmapOps.h index db7170ebe..decbf7f12 100644 --- a/NmapOps.h +++ b/NmapOps.h @@ -280,7 +280,6 @@ class NmapOps { int servicescan; int pingtype; int listscan; - int pingscan; int allowall; int fragscan; /* 0 or MTU (without IPv4 header size) */ int ackscan; @@ -299,6 +298,7 @@ class NmapOps { int windowscan; int xmasscan; int noresolve; + int noportscan; int append_output; /* Append to any output files rather than overwrite */ FILE *logfd[LOG_NUM_FILES]; FILE *nmap_stdout; /* Nmap standard output */ diff --git a/nmap.cc b/nmap.cc index ac03433eb..532a282e6 100644 --- a/nmap.cc +++ b/nmap.cc @@ -1256,11 +1256,11 @@ int nmap_main(int argc, char *argv[]) { case 'C': o.script = 1; break; #endif case 'F': o.finscan = 1; break; - case 'L': o.listscan = 1; o.pingtype = PINGTYPE_NONE; break; + case 'L': o.listscan = 1; o.noportscan = 1; o.pingtype = PINGTYPE_NONE; break; case 'M': o.maimonscan = 1; break; case 'N': o.nullscan = 1; break; case 'O': o.ipprotscan = 1; break; - case 'P': o.pingscan = 1; break; + case 'P': o.noportscan = 1; break; case 'R': o.rpcscan = 1; break; case 'S': o.synscan = 1; break; case 'T': o.connectscan = 1; break; @@ -1422,8 +1422,8 @@ int nmap_main(int argc, char *argv[]) { } - if ((o.pingscan || o.listscan) && (portlist || o.fastscan)) - fatal("You cannot use -F (fast scan) or -p (explicit port selection) with PING scan or LIST scan"); + if ((o.noportscan) && (portlist || o.fastscan)) + fatal("You cannot use -F (fast scan) or -p (explicit port selection) when not doing a port scan"); if (portlist && o.fastscan) fatal("You cannot use -F (fast scan) with -p (explicit port selection) but see --top-ports and --port-ratio to fast scan a range of ports"); @@ -1431,7 +1431,7 @@ int nmap_main(int argc, char *argv[]) { if (o.ipprotscan) { if (portlist) getpts(portlist, &ports); else getpts((char *) (o.fastscan ? "[P:0-]" : "0-"), &ports); // Default protocols to scan - } else if (!o.pingscan && !o.listscan) { + } else if (!o.noportscan) { gettoppts(o.topportlevel, portlist, &ports); } @@ -1727,7 +1727,7 @@ int nmap_main(int argc, char *argv[]) { if (currenths->flags & HOST_UP && !o.listscan) o.numhosts_up++; - if ((o.pingscan && !o.traceroute + if ((o.noportscan && !o.traceroute #ifndef NOLUA && !o.script #endif @@ -1807,7 +1807,7 @@ int nmap_main(int argc, char *argv[]) { o.decoys[o.decoyturn] = Targets[0]->v4source(); /* ping scan traceroutes */ - if(o.traceroute && o.pingscan) { + if(o.traceroute && o.noportscan) { /* Assume that all targets in a group use the same device */ troute = new Traceroute(Targets[0]->deviceName(), Targets[0]->ifType(), &ports); troute->trace(Targets); diff --git a/output.cc b/output.cc index 9d36bd60c..bd77e41f8 100644 --- a/output.cc +++ b/output.cc @@ -540,7 +540,7 @@ void printportoutput(Target *currenths, PortList *plist) { vector saved_servicefps; - if (o.pingscan) + if (o.noportscan) return; log_write(LOG_XML, ""); @@ -1372,7 +1372,7 @@ void write_host_status(Target *currenths, int resolve_all) { currenths->weird_responses); log_write(LOG_MACHINE,"Host: %s (%s)\tStatus: Smurf (%d responses)\n", currenths->targetipstr(), currenths->HostName(), currenths->weird_responses); - if (o.pingscan) + if (o.noportscan) log_write(LOG_PLAIN,"Host %s seems to be a subnet broadcast address (returned %d extra pings).%s\n", currenths->NameIP(hostname, sizeof(hostname)), currenths->weird_responses, (currenths->flags & HOST_UP)? " Note -- the actual IP also responded." : ""); else { @@ -1389,7 +1389,7 @@ void write_host_status(Target *currenths, int resolve_all) { write_xml_initial_hostinfo(currenths, (currenths->flags & HOST_UP)? "up" : "down"); - if (o.pingscan || o.verbose) { + if (o.noportscan || o.verbose) { if (currenths->flags & HOST_UP) { log_write(LOG_PLAIN, "Host %s is up", currenths->NameIP(hostname, sizeof(hostname))); if (o.reason)