Nmap Announce mailing list archives

ACK/th_win portscanning


From: Lamont Granquist <lamontg () raven genome washington edu>
Date: Fri, 10 Sep 1999 19:16:58 -0700


Here's a patch to NMAP 2.3 BETA3 which impliments -sA which is similar in
function to a SYN scan, only it sends out packets with only the ACK bit
set and instead of looking for SYN|ACK or RST to differentiate between
open/closed ports it looks for th_win being either set (0xf000 or 0x8000)
or clear (0x0000).  It works against Digital Unix targets, and (i think)
IRIX 5.3.  It should report filtered ports correctly, unlike FIN scans.
I don't think it works against Solaris, HP-UX, Linux or IRIX>5.3 targets.
It is therefore of limited use, but what the hell...

begin 664 ackscan-patch.gz
M'XL("`ZZV3<``W!A=&-H,@#56OM3V]B2_MG\%1VVDK&Q36SS"(8A.RR!.]0F
MAN)1,[.S4RY9.L;:R)*N)$-\!_9OWZ_[G"/)QB9`,G=W4RFLQWGTN[_NHV:S
M2==!-'""?IHE$S>;)"I='_UWY3CQZ4+%U&Y1>V=W"_]QT>UV5^KU^J(9,Q.Z
MNZWN[N:&GO#33]1L;W<;VU3GGW?TTT\K1.2'&7T9.VGJ.N&>?3!,G.N9!^DT
MU/=U?>^XGV?>CQU_'(6S:_BS]Q,OUO="R$X+%-3;.VU#R+V,6Z%L&BM/#2F.
MDHS6^&_@I]G>2M.^4.%D3'_2Q6^]_L7A0:]!QR?VZM=/!Q?F\NK#F;DZ/.WU
MC@XOS5WOZN-'<WE^=FBN/AV<?#K5B]`]I;P3&/WN&QX<_OO3MH88_D6%GC^D
MMVM_^WCZ;P=8X?+\ZO#RZOSHHO\SK;W%D"8L)AP[\;H[;R2;[W8[[PHCT8,6
MV,5F81>=K0VV"_[1ZJBX3JKHA[,?=HFB]=@/Q1QHG]I[-$B4\WDO'W.NQR2Q
MNW3(A1YBC*@\I`*=U\VH`SW*F-;"A2[U$#<*0^5F2X==\3#<$0WC!+8WK$;K
M+`9XBA=-L@:M_G)PWCOI_0W#FND5^2F%T2WKD&1-B'88)71Y>,;*UL\F6+B9
M'O]GN%K3)MS986'5.SN;1F8K4!?UL,ZM(G>DW,^4C11%<>9'(:5.Z&=341U&
MG80IW!7O';A21H%RTHRB4,E6;`1,4JH",*D\GM2$,51?S7+^Y@WAB7$K<V=%
MK.^,"YJ[PD?Y`3\))T%0&F##@+D=1)/05:4'U@QJ].=*_44$6=W^Y>31G)G4
MZSH.@>AH_48E@RA5-5))$B75U5Y$F1LW0'B#H/:3PT]GA2+26+G^T%=>@[#]
M9(Q-Z`;*#`*'9Y'9I%J3*>MT)79RQEM-HPG!,(-@2EX4_I#1+=:D+)+@)H17
MG="C_YJDQ:M4*;IELQA%:9:2`RN9Q+5U-CJZUW;7Y>!=WVBUC-TQ4T,8D!6%
MK&Z$,'0R)ZBN_@9*^*UF9DH\7)MUM7E<8Z;5ESCP73\#K=KN$+,]_\;W)DZ@
M5\30N-:@P22#LV0TB+*1IHI4`)[+5/#F33+3]NE:9?Q&;JNY2=S-*`AW-NG<
MY99Q5[:*N[+*[PKKN"LLHY%;7TTRU1("C!7>_=-(@>9HQ1A?'DO+FF*];K3;
MHM=VQZ9$.^E5/FY6J,A.SB1XB5SGA#.WT(OD@W!;J;#7/4],^;09:8D\.@(1
M-CKMDIW#S>%T_3B)!JK/],)XYYZ`I9V6)%$=-6=%7IT-67=WQ=;ZQ@8LN;$1
M2FY*`0KW5(I/\CH/3W)7,%[+P^4S*;'!\B\DJX@09QS79)PDPPPQ+O`]NO6S
M$3GAE.#M*M$#."PB&DARDZ=(7(A408"0X0833Y%#L5UNU9J_J'2C(RK=V,CA
MIX47$FOWZ0Q)^?*WLZ,^<J]$;)[:M(%[AN\9B<P*8:D,!+X^7&JYI)^Z+NE_
M,THT`IX)PHGZ^T2EG-2=0I@(^+X[DG<^0#PEK59&`"XW?J"N58K$@RS!R<2+
M1#4CYX:Q@QJO:S0B8A+Y`K_M0+Y;F_BQ+C.?*4OR?E42>.^T=U031I9AII_Q
M=-?DM83THH8))T$4*5(6YSHD/G?D#`*%8B(:$^Q$-?!PK,8#F`PRG0"JLQ:E
M$0,FG2"S9"K,BODPARR&2(:SN?%FAF7KVV47JI>T5R^Y27U6D?6RYNIEI;ZG
MMHFR)97E`(#&D<9LH4`UD6`T%)2H4S^=,9!C\!<!7F`0DBF/Q*!F>MG`GPO^
M<\Q_/O&?7[5JFVF/>:HOYL@:Y_?BKOY/Y*Z9'LRP6$Z$**L\Y4;3%(2U3$`L
M6:JX4DD6M3Q/;G<:71CY]@9^9O)DD9<6Q]>5)J<:?E'"J-4G2A5ERL+)SU:/
M9#Q)>8O5M+]/K1K^E<SP&&R-59@YNI3@4:[H"2H8*/8D$ZE1I$I]BL)2MM0E
MJJ!:+D1+\7M5(Z3OM0%JVV6[4*X=W\,6)<!>UJZ.E0:0G^0#A8+;*/F<ZOW-
M%(M=T\L:K:^ODW\=1@G'#%UMV1)M2Q)-?6O#EFA"B#M)$**R4=I\/PQ@+_2&
M?CZ]N.Q?G7%IQJ251MSZ*O'ZB,HQ%*C2M;<88*+]PY)#4M77]IC;($4P=57?
MC]?3ON-YB9C5,Q+^'&A8G*!JQO&_$VTO0B9/)U2+ETE%5N&D$CIC51U/^8=;
M)K\RN;V#3T<?CWHU<6R4^J^J)@L)HN59@VEI'CN42=+6Z`^=D+.IS5P\ZA71
M)5+0)&5;:E[0C^-I_^1,>%=I^IXMO*GH1R1"E0P=I#^NV,3:1TDTN1Z]E^RD
MP<[6YI88W^9V`7;NM97P'YC:L7_-70!D5UWR!7[XN1DX4^1'3]WX6+Z:[U2S
M*;/J*P)_K0;%<8R_*G-KTB$P(GNU5E*@609J>USIU<=1XXSB'@>?,]80:9W*
M#G[,4NR`(M$*/:"R06\6F5Z-40H"8FZ^__<8G`&1WXG;64N-)H$GT&\X9S*&
M?VD<(,TR2(I!"$R:AT0A#)JS_-B_'@%2@EQ_P`'5-!L8;L'*JUS39R,`?_SG
M0LKA00X-_.MKV"(_"=2X!@APHIL:W)7`7`%IV#ENM88:GPD;C`@<SA1O\^:9
MQ&[VIZ'S6?GQ^P8/#V6M,7<_!`MJNX:J$E-7:.;$>X5:A1)CDFK&9UP0TPLH
MS)YU`0%,8J%),(;TW:36T)#C=W.139+P#T2,1:HP*018>AM>O+55>''Q1^<U
M8Q(U%G"?KXH0V]!E=B-O'^NT:R;F)O/(1-LU-LP]P(B/3B[WHA&7:!'UQMQK
ME$YBE2Q;R3:]369M=[N26O%;".;X0_\_CLY/JV_<U%\?>FG_-O$SI0E_\$Y]
M<56<:2BO2>&==1FXGXN+7:O\W';.:[:2>\ZD^>>Y:+6WI2F\_4O_UO=@K/O4
MWFH)Y=+=FGL7R5T:L:>E>Z:Z[;0Z$O'Q^RZ721'QI>WKLV,FE#BWI&>;T+V,
M%:1#RJO6)2/`574A6WIRGDRKV#7U0+W>N7IPW#_I'0&Y7YQBQOG!+PTZ.3L[
M/[T\Y1O,_A&X/,^:L8E%ANP,^0Y1`2$C+!F.=4%F]A=EZU6$FQ\DWDS"01"9
MOKA9!YD6/HP"T,:D6P<R,O)\9^3Y[EVCW<H;!GE8/&*T"$@XCOU`P!\D&[M.
MC"@9(#KLTNL44:$AS_I(\T"7U=BK61I9)O(J59F>@;>(RT,W\M0<]Q8G.RC)
M/1UN,QUMG[1?4^P+`M*I:9\N?^Y#@3H6+%>^?OW(3+;-)8-@!;HS4+1GRWO,
M1`:+N:R!--N%&G.;986QM8IJVJUWHIIVNV.J,".G);T#7L5'=0$M@7H:.<&P
M&<5(`6FFG``^)6G"N780C#+(D:JOTYH(4Z.ZYGL-_OQ09?TPBYRJ?<[0+5?I
MUUE]!J%<^LYV]Q<1^$3Z=&F@"318?#&U15"J/YE2S/E6^DH4_?D,&2&T?KMD
M*(?&YH1#'PO#NG9V['ED11OX[R8S857U)?MC/4[439&_J2F#^%111]U*Y5Z.
M`?4&37/U@F3SPIF/9)Q*!3DEG(S_/E&)K](^1)MF3NA!JLWF7DZUU4BE`E]T
M`^Z\<-AQ8J`RJ,?)$$D].:WD?IL@.NNCR$,BQ4[+GO:;-7,98C0HD+,Q\PJ*
MR?RQBH:>,ZV^R0<"7&:_STW[0Q]NUXK)?(:Z3X]/VONJ%A"-K/[*8G]!\BN9
M`014%<2WW]HSD/!'*O6@S,-ZO::%37,-I9I^2`*S^^G8"8(^O_N'3JK(&CFT
ME!\(YTW9SAN8"$US<^NA'!E-7/NN/KVH0X>P!UJC#5S/C6T4#WAP&#6*L&^/
MI3M=H_9N2>UOURI2.V4J9;_E;RJ`J8N;0F][@I4K`H<6FZ>UE\=LI5581[/R
M-5V+GE^N8V-_SU1Q85ES6OXK-$S+5/P4A6YL=KFKW]G8VC9M?1N@S?<&\AD!
M()2<"[#X2W5@JK$5<CC'B+R/90LB$CT[0:(<;PJ^$F[Q>D;I,(J6P2Z/@91F
M!4+HHPCB-MDDR%(3X34K$%.*^N$-,)HN)H(H^CR)<>V51&83T`OM`!;T[30T
M\E!MX<22%)WGA2)5:KRK^Z6Z>+V-$ETA.P,NQ0O)8S6CJ_R81'EY;XI0.@-T
MN,$DY5;L5%<(8@>;&QH.;VYVRN7%P^\:M,J69>]+V`:RM&Y;00[T.O`@!&SJ
MI7D_Z[6G"[]UP6"+]?&OM(KK5=I]!&YA3`E&\=A52`]+4C6(PFO$($20JD0*
M3MY0FL24AG9<?>YM3..OXB>W(@*QN'G`T/\"PZ3KMF&BE&Q5R[]>T1#]/3>)
M3)6TLZ6A^,YV\2'23>1[-.\1^C-!?4JG+]=R)]'WO+T?#B-:$Z^Q.<^^YH>@
M&#%EC=UI;I*DD35Q,7/0HK_[6YMQ."Z-^!D<;Q*F_G6(<HH%@R7S6,#X^%L6
M:.@/Z0IW9C]=L?3Z,:UQ=T?6'DR1!$V<[;:W&^T.)-GM;#0Z[3)B,N<2Y\I5
M_@TVY!K&]-G\<1SH3IC$>K8T.?"42/]ZY)."HR,@<WM81VIYXZ?V!*TTL>I*
MHV]@SDQAM\I)`A_1!-5VZ-6X'#(X(%2WO$YC'B'D<,RL:HJYBL6_$EXS-\;X
M4=\V2JNZJ+S392/2*JSZP3-)M1J\87.V`SFP/SV_[)^>'?5THM>;Y%%S?B,L
M=GYQ^>A:AQ]/+XX^Y.G@*TC10,1OY,KBS,5\Z;?W98J>RN*RA2V36E7WE?+:
M]X^Q7@2K/V?I*9-RZX</WB]EKCSDWI8;7YFZ0$=S=-\S*BNU'GQ0YL?]F'FP
M32;^SLYB,=\=XQW9&"6W:S4HU1TY":[@M'5*_7\`;>9CXIHQ=C_NE.>:F78J
M#\3D3<`M0\4HP/V.A5?=;DL^FFBU++Q"N:#;/1]4H.1$-#(?)+-S2PM(]WDX
M6O_N_U&S#@:68=4/C_$?^W1D_@S-N,7#T[.98XG2=SSB!-^TYZP>YX[WGD$&
M"\%6XOND(S;+J+H6!X6TBBXC$J75(-<F9FK->(7C>3)YZ5Q=832T25[UCD_.
MCWXY^/CQZ`,7'?;KZ+E/Z+N[K<YN>VONZ^A%7\UOE;^.WI$,NU7N1CR2_LP;
MJXW(_:R3JIOZS.__[^2\]YUSLTG$+`\CL)?+1'];\7R)R*P'["QG8>5_`)W>
&9'2O,0``
`
end
-- 
Lamont Granquist                       lamontg () genome washington edu
Dept. of Molecular Biotechnology       (206)616-5735  fax: (206)685-7344
Box 352145 / University of Washington / Seattle, WA 98195
PGP pubkey: finger lamontg () raven genome washington edu | pgp -fka



Current thread: