eth_get_pcap_devname as a wrapper.
In addition to the hardware address check, add a check of the textual interface
descriptions in order better to distinguish interfaces. It appears to me that
the pcap description (pdev->description) is the same as what is returned by a
call to PacketRequest with an OID of OID_GEN_FRIENDLY_NAME, so that's what I'm
comparing. That differs from OID_GEN_VENDOR_NAME, which is what you get in
ifrow.bDescr from GetIfTable.
We've found that simply comparing hardware addresses is not enough when using
Windows "teamed" (link-aggregated) interfaces. In a simple example, two NICs
are teamed together, leading to three interfaces visible to libdnet: the two
physical NICs and the virtual teamed interface. All three of these have the
same MAC address. What was happening was the eth0 interface was being assigned
to one of the physical NICs, packets were sent over it, but the replies were
not necessarily coming back to the same physical NIC.
report. It looks like this.
$ ./nmap google.com -sn
Starting Nmap 5.30BETA1 ( http://nmap.org ) at 2010-05-10 23:57 MDT
Nmap scan report for google.com (66.102.7.99)
Host is up (0.073s latency).
Other addresses for google.com (not scanned): 66.102.7.104
rDNS record for 66.102.7.99: lax04s01-in-f99.1e100.net
This replaces the line
Hostname google.com resolves to 2 IPs. Only scanned 66.102.7.99
- Twisted web server (OS X 10.6.3 Server)
- Apple Filing Protocol (OS X 10.6.3 Server in VMware Fusion)
- Apple Mac OS X Password Server (OS X 10.6.3 Server)
- XAVi XG6546p Wireless Gateway
- Sun GlassFish Communications Server
- Comdasys, SIParator and Glassfish SIP services
Miller reported that an EPROTO was causing Nmap to exit after sending
the Sqlping probe during service scan. The error message was
"Unexpected error in NSE_TYPE_READ callback. Error code: 71 (Protocol
error)". We suspect this was caused by a forged ICMP packet sent by an
active firewall.
$PROGRAMFILES64/WinPcap. Set $INSTDIR to $PROGRAMFILES/WinPcap or
$PROGRAMFILES64/WinPcap depending, but don't modify it if it already has a
value (from /D= on the command line). These changes make /D= work to install a
few files into an alternate directory.
completed." due to two issues. One is that we already have a
different line printed in verbose mode which looks like "Completed NSE
at 14:31, 0.27s elapsed". The other problem is that this was being
printed in non-verbose mode when you specified an argument like
"--script ssl-cert". We intentionally bump the verbose mode of
scripts when they are specified individually like that so they can
report more script results, but I don't think we need the NSE
infrastructure itself to become more verbose.
PROBESTATE_EXCLUDED, and PROBESTATE_INCOMPLETE to 3, not 2. We're
looking up the service name in the same way as when no service detection
is done, so the confidence should be the same.
I think you can make a case that the confidence should be lower if
service detection is done but doesn't find a match. But this matches the
behavior of Nmap 4.76, using a confidence of 3 for
PROBESTATE_FINISHED_NOMATCH.
match, not only for PROBESTATE_EXCLUDED. Otherwise a serviceDeductions
gets allocated but its name doesn't get set. Later, when a
serviceDeductions is present with no name, XML output doesn't print the
service element.
