Nmap Development mailing list archives
Re: bug report
From: Brandon Enright <bmenrigh () ucsd edu>
Date: Sun, 26 Jul 2009 20:49:00 +0000
On Sun, 26 Jul 2009 21:45:09 +0100 or thereabouts "Rob Nicholls" <robert () everythingeverything co uk> wrote:
Is it listing a different MAC address for every IP that's up, or is it the same IP no matter what? I think I've seen that behaviour once before with a wireless access point that appeared to return its own MAC address for every local IP address (even, as you've seen, when the host doesn't exist). You can add --reason to the command line to see why Nmap thinks the host is up, but if it's an IP on your subnet then it basically has to be an "arp-response", which means that something on your network is returning an ARP response to you and claiming to be that IP. For reference, I couldn't reproduce your issue with Nmap 5.00 on my copy of Windows XP SP3 (the service pack shouldn't make a difference). Rob
The behavior you're describing is called proxy-arp. People generally turn it on when they don't want to have to be bothered with configuring the right subnet mask for machines. Brandon _______________________________________________ Sent through the nmap-dev mailing list http://cgi.insecure.org/mailman/listinfo/nmap-dev Archived at http://SecLists.Org
Current thread:
- Bug Report Namenlos (Jul 24)
- Re: Bug Report jah (Jul 25)
- RE: Bug Report Rob Nicholls (Jul 26)
- <Possible follow-ups>
- bug report Ibrahim (Jul 26)
- RE: bug report Rob Nicholls (Jul 26)
- Re: bug report Brandon Enright (Jul 26)
- RE: bug report Rob Nicholls (Jul 26)
- RE: bug report Rob Nicholls (Jul 26)