Re: NMAP v5 on Solaris 9 x86 can't open/find interface

[David Fifield <david () bamsoftware com>]

On Fri, Feb 26, 2010 at 12:25:13PM -0700, David Fifield wrote:
> On Mon, Jul 27, 2009 at 08:46:15PM -0600, Joseph S. Dietz, Jr. wrote:
> > root> ./nmap --iflist
> > Starting Nmap 4.20 ( http://insecure.org ) at 2009-07-27 20:32 MDT
> > getinterfaces: Failed to open ethernet interface (e1000g0).
> > A possible cause on BSD operating systems is running out of BPF devices
> > (see http://seclists.org/lists/nmap-dev/2006/Jan-Mar/0014.html).
> > QUITTING!
> >
> > root> ./nmap --iflist
> > Starting Nmap 4.62 ( http://nmap.org ) at 2009-07-27 20:34 MDT
> > Warning: Unable to open interface e1000g0 -- skipping it.
> > Warning: Unable to open interface e1000g0 -- skipping it.
> > ************************INTERFACES************************
> > DEV (SHORT) IP/MASK     TYPE     UP MAC
> > lo0 (lo0)   127.0.0.1/8 loopback up
> > WARNING: Unable to find appropriate interface for system route to A.B.C.122
> > WARNING: Unable to find appropriate interface for system route to A.B.C.121
> > WARNING: Unable to find appropriate interface for system route to A.B.C.126
> > **************************ROUTES**************************
> > DST/MASK     DEV GATEWAY
> > 127.0.0.1/32 lo0 127.0.0.1
> >
> > root> ./nmap --iflist
> > Starting Nmap 5.00 ( http://nmap.org ) at 2009-07-27 20:37 MDT
> > Warning: Unable to open interface e1000g0 -- skipping it.
> > Warning: Unable to open interface e1000g0 -- skipping it.
> > ************************INTERFACES************************
> > DEV (SHORT) IP/MASK     TYPE     UP MAC
> > lo0 (lo0)   127.0.0.1/8 loopback up
> > WARNING: Unable to find appropriate interface for system route to A.B.C.122
> > WARNING: Unable to find appropriate interface for system route to A.B.C.121
> > WARNING: Unable to find appropriate interface for system route to A.B.C.126
> > **************************ROUTES**************************
> > DST/MASK     DEV GATEWAY
> > 127.0.0.1/32 lo0 127.0.0.1
> >
> > ifconfig -a
> > lo0: flags=1000849<UP,LOOPBACK,RUNNING,MULTICAST,IPv4> mtu 8232 index 2
> >    inet 127.0.0.1 netmask ff000000
> > e1000g0: flags=1000843<UP,BROADCAST,RUNNING,MULTICAST,IPv4> mtu 1500 index 3
> >    inet A.B.C.122 netmask fffffff8 broadcast A.B.C.127
> >    ether 0:c:f1:cf:9a:b6
> > e1000g0:1: flags=1000843<UP,BROADCAST,RUNNING,MULTICAST,IPv4> mtu 1500  
> > index 3
> >    inet A.B.C.121 netmask fffffff8 broadcast A.B.C.127
>
> I might (finally) have an explanation for you here. The eth_open
> function used on Solaris, is, I believe, in libdnet-stripped/src/eth-dlpi.c.
> It has this code:
>
>         snprintf(dev, sizeof(dev), "/dev/%s", device);
>         if ((p = strpbrk(dev, "0123456789")) == NULL) {
>                 errno = EINVAL;
>                 return (eth_close(e));
>         }
>         ppa = atoi(p);
>         *p = '\0';
>
> It's looking for digits in the device string and then parsing the number
> it finds there. My guess is it's looking for the "0" in "eth0" for
> example. But your device--e1000g0--happens to have digits before the
> final 0. I think this is confusing the code when it later tries to use
> 1000 in place of 0.

I tried a patch to fix this, and Joe told me that it worked for him, so
I've committed it. The patch changes to code to look at the last digit
sequence, not the first.

I has just occurred to me that this might fail in case the device name
has an alias qualifier on the end, like e1000g0:1. I don't know enough
about this libdnet code to know if such an interface name is possible at
this place in the code.

David Fifield
_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://seclists.org/nmap-dev/