4

This weekend, I set up pfSense on a spare box that I had sitting in the garage. It seems cool and powerful, but I haven't messed with it much yet.

Was doing some basic nmap scanning from work against my home public IP, and the nmap scan is apparently saying I'm running DD-WRT? My only other router (wireless) is sitting behind the pfSense box and it is running stock firmware, not DD-WRT. Can anyone help to explain this output? Perhaps it's just an erroneous guess as the output suggests it may not be accurate? Thank you.

root@kali:~# nmap -O my public IP

Starting Nmap 6.47 ( http://nmap.org ) at 2015-11-02 11:03 EST
Nmap scan report for my public IP
Host is up (0.015s latency).
Not shown: 998 filtered ports
PORT     STATE  SERVICE
6668/tcp closed irc
6669/tcp closed irc
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Linux 2.4.X|3.X
OS CPE: cpe:/o:linux:linux_kernel:2.4 cpe:/o:linux:linux_kernel:3
OS details: DD-WRT v24-sp2 (Linux 2.4.37), Linux 3.2

OS detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 50.44 seconds
  • FWIW: I have a stock EA3500 and EA6500. Both have the latest firmware, and I'm reasonably confident in their integrity. The 3500 shows up as DD-WRT v24 SP1. The 6500 comes back as Linux 2.6.22 (embedded, ARM). Both results claim 100% accuracy, though the scan on the 3500 had a warning that OS Detection didn't resolve on the first try. It's probably a safe bet that DD-WRT is just sufficiently similar to stock firmware that Nmap sometimes can't tell the difference. – Iszi Nov 2 '15 at 18:59
  • You mention this is at home. What are you using for your modem? DSL, Cable, etc? I'd expect the OS fingerprinting to identify the modem, not what's behind the modem. – Steve Sether Nov 2 '15 at 19:00
  • For reference, Nmap against my routers was executed with the following options: nmap -sV -p - -O -v --version-all and there is one hop (the EA6500) between me and the router that's showing up as DD-WRT. – Iszi Nov 2 '15 at 19:00
  • That's a great point, @Iszi. Also Steve, I would agree that the OS detection would probably be the main point of egress, or the modem. – shift_tab Nov 2 '15 at 19:31
  • @SteveSether That's a big, huge, "it depends" based upon his network configuration. For all intents and purposes, a modem should be fairly transparent to Nmap. Even a full-blown "home gateway" device (integrated modem, router, sometimes Wireless AP and other stuff) could be configured in such a way that Nmap would return an ID for a system behind it (e.g. "DMZ Host") rather than the gateway itself. – Iszi Nov 2 '15 at 20:07
5

The answer is in your question :

Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port 

Nmap literally guesses which OS is on the machine. Didn't work out this time.

  • And there's also a note where to report to improve detection. – domen Nov 2 '15 at 16:30
  • 1
    Understood, and I read that. Needed some confirmation from some folks who may be much better versed with nmap than myself. Thanks guys. – shift_tab Nov 2 '15 at 16:40
  • Our pleasure !! – Nate Nov 2 '15 at 16:43
  • @FrancoisRenaud-Philippon The answer here is probably correct for this case. But what if we put on our tinfoil hats and ask "How can I tell that my router hasn't actually been hacked, and had a DD-WRT derivative put on that just has a stock-looking UI?". – Iszi Nov 2 '15 at 18:06
  • ^^^ This is a great way to look at it. – shift_tab Nov 2 '15 at 18:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.