May 2017
Intermediate to advanced
416 pages
21h 33m
English
Every time Nmap scans a private address, an ARP request needs to be made inevitably because we need the targets destination before sending any probes. Since the ARP replies reveal that a host is online, no further testing actually needs to be done after this step. This is the reason why Nmap automatically uses this technique every time you perform a ping scan in a private LAN network, no matter what arguments were passed:
# nmap -sn -PS --packet-trace 192.168.1.254 SENT (0.0609s) ARP who-has 192.168.1.254 tell 192.168.1.102 RCVD (0.0628s) ARP reply 192.168.1.254 is-at 5C:4C:A9:F2:DC:7C NSOCK (0.1370s) UDP connection requested to 192.168.1.254:53 (IOD #1) EID 8 NSOCK (0.1370s) Read request from IOD #1 [192.168.1.254:53] ...
Read now
Unlock full access