1

I'm performing a scan on a remote host and playing around with the -f flag for nmap when I noticed something I hadn't expected. In amongst the other data, when I type nmap -v -O <hostname> I get a listing of open ports and OS details:

PORT    STATE   SERVICE
22/tcp  closed  ssh
80/tcp  open    http
443/tcp open    https
Device type: general purpose
Running: QEMU
OS CPE: cpe:/a:qemu:qemu
OS details: QEMU user mode network gateway
TCP Sequence Prediction: Difficulty=17 (Good luck!)
IP ID Sequence Generation: Incremental

However, when I scan the same how with nmap -v -f -O <hostname>, I get:

All 1000 scanned port on <host> <ip> are filtered
Too many fingerprints match this host to give specific OS details

Can anyone explain why fragmented packets act differently in regard to the information received? Is the remote host likely set up to block fragmented packets, maybe?

  • please read the nmap manual on the -f option – schroeder Jul 10 '17 at 14:31
  • I'm getting -f; --mtu <val>: fragment packets (optionally w/given MTU). But I guess you mean on their website? – Peter David Carter Jul 10 '17 at 14:33
  • yes, the manual, not the help text – schroeder Jul 10 '17 at 14:34
  • Another case of RTFM. – Digital fire Jul 10 '17 at 17:42
1

Found this in the nmap documentation at: https://nmap.org/book/man-port-scanning-basics.html

IP fragmentation is a complex system and implementations are riddled with bugs and inconsistencies. Possible tests could examine how overlapping fragments are assembled or time the defragmentation timeouts. These tests are avoided for Nmap because many firewalls and other inline devices defragment traffic at gateways. Thus Nmap may end up fingerprinting the firewall rather than the true destination host. In addition, fragments are difficult to send on some operating systems. Linux 2.6 kernels have a tendency to queue the fragments you are trying to send and assemble them itself before transmission.

So it seems that the process of fragmentation may be causing problems with the lookup. I would still appreciate any answers that explain this in more depth, though, if that is within the scope of the site.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.