Re: [PATCH]: Ignore VMWare Fusion interfaces on MACOSX

["Kurt Grutzmacher" <grutz () jingojango net>]

The patch in svn works great. The latest Parallels supports BPF well
with OSX while VMWare Fusion does not.


On 8/29/07, Daniel Johnson <daniel () daniel-johnson org> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
>
> On Aug 29, 2007, at 4:08 AM, Fyodor wrote:
>
> > On Sat, Aug 25, 2007 at 02:55:07AM -0500, Kurt Grutzmacher wrote:
> > > I'm not sure there's a way to separate bad interfaces from good ones
> > > without disrupting functionality of aborting on bad interfaces. Since
> > > getinterfaces() runs through every known interface displaying a
> > > message
> > > would be annoying and users attempting to nmap on interfaces that are
> > > invalid will just get no results.
> >
> > I'm OK with not aborting on bad interfaces, as long as we at least
> > give a warning about them.  Maybe (as is common with the vmware
> > interface case), someone is actually trying to scan on another
> > interface, so the broken one need not be so much of a problem.  If you
> > get a chance, please try the patch below.  I've committed it to SVN,
> > though I'm kinda wary of comitting even tiny patches which I can't
> > actually test (no Mac OS box yet).
>
> I've had exactly this same issue, except that I'm using Parallels
> instead of VMWare. In my case, Parallels creates two interfaces, en2
> and en3, in addition to the system's en0, en1 and fw0 for a total of
> five interfaces. The problem is that Mac OS X only has 4 bpf devices
> and there is no way to create more. So when nmap tries to open the
> fifth interface, in my case fw0, it fails. I think your patch is the
> best option; this way at least the first 4 interfaces will be used
> and the rest ignored.
>
> Incidentally, nmap mysteriously started working again on my system. I
> _think_ it's because I installed the latest beta of Parallels which
> must be handling networking differently. So it may be possible that
> VMWare will eventually fix it as well. Unfortunately, this means I
> can no longer test the patch. :)
>
> Daniel
>
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.6 (Darwin)
> Comment: http://homepage.mac.com/danielj7/publickey.txt
>
> iD8DBQFG1i7c4sDFGYouOqARAg6BAJ9ARByEghNMGSuMpwWEoRVdp7UP5wCeIP3U
> c71xqKKW0Nh7GkM/pXOePtY=
> =UM6s
> -----END PGP SIGNATURE-----

_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://SecLists.Org