Since nmap is a well-known security tools, I guess this is the right section.

I've been reading about nmap techniques here as part of my network security syllabus ...

I've performed 2 scans ... one to port 1337 which is closed while the other port 4444 is open.

When I try nmap mtu scan and capture the packet with Wireshark, I don't see the mtu size (32) that I set in nmap.

user@linux:~$ sudo nmap --mtu 32 -p 1337

Nmap scan report for
Host is up (0.0023s latency).
1337/tcp closed waste
MAC Address: AA:AA:AA:AA:AA:12 (Unknown)

Nmap done: 1 IP address (1 host up) scanned in 13.13 seconds

The only value that I see is Total Length: 44

  1. Any idea why I did not see mtu size 32 in Wireshark?

  2. Is this the right place to check mtu size in Wireshark (IPv4 > Total Length)?

enter image description here


If your idea is to fragment the packets I think you need to use the -f parameter according their help

       -f (fragment packets); --mtu (using the specified MTU) .
       The -f option causes the requested scan (including ping scans) to use tiny fragmented IP packets. The idea is to split up the TCP header over several packets to
       make it harder for packet filters, intrusion detection systems, and other annoyances to detect what you are doing. Be careful with this! Some programs have
       trouble handling these tiny packets. The old-school sniffer named Sniffit segmentation faulted immediately upon receiving the first fragment. Specify this option
       once, and Nmap splits the packets into eight bytes or less after the IP header. So a 20-byte TCP header would be split into three packets. Two with eight bytes of
       the TCP header, and one with the final four. Of course each fragment also has an IP header. Specify -f again to use 16 bytes per fragment (reducing the number of
       fragments)..  Or you can specify your own offset size with the --mtu option. Don't also specify -f if you use --mtu. The offset must be a multiple of eight. While
       fragmented packets won't get by packet filters and firewalls that queue all IP fragments, such as the CONFIG_IP_ALWAYS_DEFRAG option in the Linux kernel, some
       networks can't afford the performance hit this causes and thus leave it disabled. Others can't enable this because fragments may take different routes into their
       networks. Some source systems defragment outgoing packets in the kernel. Linux with the iptables.  connection tracking module is one such example. Do a scan while
       a sniffer such as Wireshark.  is running to ensure that sent packets are fragmented. If your host OS is causing problems, try the --send-eth.  option to bypass
       the IP layer and send raw ethernet frames.

       Fragmentation is only supported for Nmap's raw packet features, which includes TCP and UDP port scans (except connect scan and FTP bounce scan) and OS detection.
       Features such as version detection and the Nmap Scripting Engine generally don't support fragmentation because they rely on your host's TCP stack to communicate
       with target services.

On the other hand, is very helpful to upload the pcap file, notice that you put a filter that may hide the fragmented packets

  • Thanks @camp0. I did not want to use -f. I just want to try mtu scan and inspect the packet in Wireshark. The other packets are not related with this question. – Sabrina Apr 10 '18 at 7:43
  • Sabrina, could you please explain what you mean by "mtu scan"? The page of port scanning techniques in nmap does not mention such a scan method. nmap.org/book/man-port-scanning-techniques.html – Daniel Yuste Aroca May 10 '18 at 21:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.