nmap crashing embedded-system in strange way

Question

I'm trying to find out what nmap-commands crash an embedded-system. In the process I can see behaviour that I don't understand:

On the system port 80 is open and 79 is closed.

1. nmap -p 79-80 -T5 -A -> system crashes
2. nmap -p 80 -T5 -A -> no crash and normal response

It doesn't matter which closed ports I add or remove from the range around the open port 80. As soon as I scan any port other than 80, the system crashes.

I'd be happy to hear some ideas why this could happen or some way to find out.

EDIT: The reason for this seems to be the timing-option -T5.

nmap -p 79-80 -T5 -A -> 79/tcp closed finger 80/tcp open http? 81/tcp closed

nmap -p 80 -T5 -A -> 80/tcp filtered http

nmap -p 80 -A -> 80/tcp open http? -> also crashes as expected!

Answer 1

if I am not mistaken, my theory... with the -A nmap is actually doing OS detection probes as well, one of the ways it identifies is through timing of probes sent to one open and one closed port. among a host of other things.

with a single port specified, I would bet that though typically this would be performed it is bypassed because you have specified only one port.

with any range of ports Id est 79-80, the feature would be utilized.

That is why it probably seems timing related as well, because of nmap choosing to do the best with what it was given based on request, because you certainly would not want it to say "Hey since you asked me to ID an OS, but only one port, I will probe another arbitrarily to honor the request"

http://nmap.org/book/man-os-detection.html

Answer 2

It would happen because the start and end ports might be excluded by the nmap. You are giving the range 79-80 so when it exclude the start and end ports then there is no port to scan and you are explicitly mentioned the port option, which causes the crash. Give a try to

nmap -p 79-81 -T5 -A