Re: nmap doesn't pick the interface that is up

[David Fifield <david () bamsoftware com>]

On Fri, Oct 17, 2008 at 11:40:00PM +0100, Robin Wood wrote:
> I have eth0 with IP address 192.168.0.2 on my wired network. I have an
> AP that I thought had an IP address on its wireless interface in the
> 192.168.0.0 subnet so I took down eth0 and brought wlan0 up with ip
> address 192.168.0.22 and then tried to port scan the subnet with the
> command nmap -sP 192.168.0.0/24 but got this message:
>
> eth0 192.168.0.2 but down
>
> Starting Nmap 4.76 ( http://nmap.org ) at 2008-10-17 23:04 BST
> pcap_open_live(eth0, 100, 0, 200) FAILED. Reported error: bind:
> Network is down.  Will wait 5 seconds then retry.
>
> As wlan0 was up on the subnet I would have expected nmap to use it
> before trying eth0. As soon as I changed the IP address of eth0,
> leaving it down, nmap successfully scanned on the wireless network.
>
> Is this a bug? If not, it is definitely unexpected behaviour.

What operating system is this? Please send the output of
        nmap --iflist
in both situations: with eth0 on the same subnet but down, and with eth0
in a different subnet (still down).

Maybe the routing table was confused, or else Nmap read it incorrectly.
--iflist will show that.

If the problem persists, a workaround is to specify the interface to use
with the -e option.

David Fifield

_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://SecLists.Org