7

I figured this would be the most relevant place to ask this question. I'm using a Kali VM to run some network scans. The results are different depending on whether my network interface is bridged or NATed.

Running this scan nmap -sn 192.168.1.0/24 in NAT reports all 256 IPs as online hosts. The same scan in bridged reports the correct number of 5 online hosts. Note that this is from a freshly downloaded VM with no changes done on it.

Why the difference? I'm guessing there must be some issue with ICMPs or ARPs coming through? Could this be a config issue on my host (fresh LTS Ubuntu 14.04)?

I would be interested in understanding the reason and also any fixes. I'd like to have accurate host discovery without having to bridge every time.

EDIT: I am using VirtualBox 4.3.36.

4
  • 1
    Please mention what hypervisor you are using (VirtualBox, VMware Player, QEMU, etc.). Most likely this is how NAT on your hypervisor is designed. I always have problems with virtual NAT and Nmap. Mar 7, 2016 at 14:11
  • @bonsaiviking Editing my question. I'm glad to know I'm not the only one, although I don't remember having this problem in the past, likely with a different version of VirtualBox.
    – Juicy
    Mar 7, 2016 at 14:33
  • 2
    When seeking to scan beyond the VM environment, I'd prefer to run the scanner in Bridged mode regardless. Always put as little infrastructure (virtual or otherwise) between the scanner and its targets as possible for the thorough and accurate results. As for troubleshooting your problem, a little more information might still be useful: (1) What are the IP ranges of your networks, (VirtualBox internal network and target network) and how are they connected? (2) Have you tried monitoring the scan with Wireshark or the --packet-trace option? (3) Have you tried different ping techniques?
    – Iszi
    Aug 15, 2016 at 20:47
  • In NAT mode, nmap can't do ARP scanning, as they are separate networks at Ethernet level. If target host is fully firewalled, ARP scan is only way to detect.
    – paj28
    Aug 14, 2019 at 19:56

3 Answers 3

2

VirtualBox sets the NAT up with its own IP address range and set of rules like the NAT in your router. So to get to the internet you are actually going through two NAT interfaces.

VirtualBox's NAT network treats all 256 IP addresses as online hosts because of the internal VirtualBox NAT configuration. Bridged mode bridges you directly with your NIC using your host's configuration which is why those results are more accurate.

1

If you use VirtualBox, make sure to use a bridged network. When nmap tries to perform a TCP ACK scan, the NAT network adapter sends back RST datagrams and this causes nmap to believe the host is up and ports are filtered.

For example:

$ sudo nmap -sS --packet-trace 192.0.2.0 2>/dev/null | grep -i rcvd
RCVD (0.0398s) TCP 192.0.2.0:80 > 10.0.2.15:52846 R ttl=255 id=4588 iplen=40  seq=260833868 win=0
RCVD (1.4197s) TCP 192.0.2.0:80 > 10.0.2.15:53113 R ttl=255 id=4591 iplen=40  seq=3391347957 win=0
RCVD (2.7068s) TCP 192.0.2.0:80 > 10.0.2.15:53114 R ttl=255 id=4592 iplen=40  seq=3374571509 win=0
RCVD (3.4268s) TCP 192.0.2.0:113 > 10.0.2.15:53102 RA ttl=255 id=4593 iplen=40  seq=0 win=0
RCVD (3.5424s) TCP 192.0.2.0:113 > 10.0.2.15:53103 RA ttl=255 id=4594 iplen=40  seq=0 win=0
RCVD (4.0559s) TCP 192.0.2.0:80 > 10.0.2.15:53115 R ttl=255 id=4595 iplen=40  seq=3357794037 win=0

Alternatively, disable the TCP ACK and ICMP scans with the --unprivileged option.

1
  • You need to set a static IP most of the cases too.. Feb 9 at 16:31
0

I had the same problem and I could understood it with Wireshark. If you analize your network trafic with Wireshark when you are doing Nmap scans, you can see that when you are doing the scan with NAT the TTL value is 128, if you host machine is Windows, or 64, on Linux (depending the version).

This is because when vmWare receive the packet, recreate it and TTL value is reinitilized and this generate confusion on Nmap scan.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .