0

I did a Nmap scan with this command:

nmap -sn -n --scan-delay 1s <ip range> -oG -

In Ubuntu 16.04, with Nmap 7.01, I'm getting different results from each scan.

In MacOS X 10.13.3, with Nmap 7.60, the result is the same every time.

The results that I am getting are a list of IP addresses. I use awk in my command to obtain this list of IPs, but that is not the problem and for that reason, I didn't write this part of the command in this post.

The scan is a internal network scan via VPN. In the case of Ubuntu, this conection is realized via Ethernet and MacOS is stablishing the conexión via 3G and, in other tryings, Wifi, in the same network where the Ethernet is connected.

The Ubuntu machine is a virtual machine, VmWare NAT, installed on Windows 10.

Extra Test

I tested with Kali Linux 2018 and Nmap 7.60, creating no-sudo user and using it, and happened the same.

Why is it happening?

Improve this question
5
  • 1
    There is so much more inforamtion you will need to provide. Are they both connected in the same manner (wireless or physical) are they connected to the same switch (ACLs in place?), do they have the same IP scheme AKA are they on the same subnet (ACLs in place?) etc etc. Look at the network configuration on each of them and see if there is any differences that would limit one device and not the other.
    – Nick W.
    Mar 14, 2018 at 12:18
  • What hypervisor are you using for the Ubuntu VM? Are you using bridged networking or NAT? For example, VirtualBox's NAT solution causes problems for Nmap scans.
    – bonsaiviking
    Mar 15, 2018 at 2:25
  • 'different results' whothewhatnow? Different ports found open? Ports found closed versus filtered? Fangs? And how to the Ubuntu results compare to the MacOS results? Versions of nmap found on both?
    – gowenfawr
    Mar 15, 2018 at 5:51
  • The post has been udpated
    – Iratzar Carrasson Bores
    Mar 19, 2018 at 11:55
  • Could it be that NAT network of vmWare is crafting the packets? Because I am receiving packets with the TTL 128.
    – Iratzar Carrasson Bores
    Mar 20, 2018 at 12:16

1 Answer 1

Reset to default
1

The reason of this problem is the NAT network. Analysing the network with Wireshark, I saw that the TTL number was 128. This is because in the NAT network recive the packets and recreate them. This cause problems on Nmap analysis. So, the solution is use a Bridge connection on vmWare or use Nmap on native OS.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .