4

This weekend, I set up pfSense on a spare box that I had sitting in the garage. It seems cool and powerful, but I haven't messed with it much yet.

Was doing some basic nmap scanning from work against my home public IP, and the nmap scan is apparently saying I'm running DD-WRT? My only other router (wireless) is sitting behind the pfSense box and it is running stock firmware, not DD-WRT. Can anyone help to explain this output? Perhaps it's just an erroneous guess as the output suggests it may not be accurate? Thank you.

root@kali:~# nmap -O my public IP

Starting Nmap 6.47 ( http://nmap.org ) at 2015-11-02 11:03 EST
Nmap scan report for my public IP
Host is up (0.015s latency).
Not shown: 998 filtered ports
PORT     STATE  SERVICE
6668/tcp closed irc
6669/tcp closed irc
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Linux 2.4.X|3.X
OS CPE: cpe:/o:linux:linux_kernel:2.4 cpe:/o:linux:linux_kernel:3
OS details: DD-WRT v24-sp2 (Linux 2.4.37), Linux 3.2

OS detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 50.44 seconds
Improve this question
6
  • FWIW: I have a stock EA3500 and EA6500. Both have the latest firmware, and I'm reasonably confident in their integrity. The 3500 shows up as DD-WRT v24 SP1. The 6500 comes back as Linux 2.6.22 (embedded, ARM). Both results claim 100% accuracy, though the scan on the 3500 had a warning that OS Detection didn't resolve on the first try. It's probably a safe bet that DD-WRT is just sufficiently similar to stock firmware that Nmap sometimes can't tell the difference.
    – Iszi
    Commented Nov 2, 2015 at 18:59
  • You mention this is at home. What are you using for your modem? DSL, Cable, etc? I'd expect the OS fingerprinting to identify the modem, not what's behind the modem.
    – Steve Sether
    Commented Nov 2, 2015 at 19:00
  • For reference, Nmap against my routers was executed with the following options: nmap -sV -p - -O -v --version-all and there is one hop (the EA6500) between me and the router that's showing up as DD-WRT.
    – Iszi
    Commented Nov 2, 2015 at 19:00
  • That's a great point, @Iszi. Also Steve, I would agree that the OS detection would probably be the main point of egress, or the modem.
    – shift_tab
    Commented Nov 2, 2015 at 19:31
  • @SteveSether That's a big, huge, "it depends" based upon his network configuration. For all intents and purposes, a modem should be fairly transparent to Nmap. Even a full-blown "home gateway" device (integrated modem, router, sometimes Wireless AP and other stuff) could be configured in such a way that Nmap would return an ID for a system behind it (e.g. "DMZ Host") rather than the gateway itself.
    – Iszi
    Commented Nov 2, 2015 at 20:07

1 Answer 1

Reset to default
5

The answer is in your question :

Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port

Nmap literally guesses which OS is on the machine. Didn't work out this time.

Improve this answer
5
  • And there's also a note where to report to improve detection.
    – domen
    Commented Nov 2, 2015 at 16:30
  • 1
    Understood, and I read that. Needed some confirmation from some folks who may be much better versed with nmap than myself. Thanks guys.
    – shift_tab
    Commented Nov 2, 2015 at 16:40
  • Our pleasure !!
    – Nate
    Commented Nov 2, 2015 at 16:43
  • @FrancoisRenaud-Philippon The answer here is probably correct for this case. But what if we put on our tinfoil hats and ask "How can I tell that my router hasn't actually been hacked, and had a DD-WRT derivative put on that just has a stock-looking UI?".
    – Iszi
    Commented Nov 2, 2015 at 18:06
  • ^^^ This is a great way to look at it.
    – shift_tab
    Commented Nov 2, 2015 at 18:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .