0

I'm a security newbie trying to scan a VPN in the range 10.0.0.0 - 10.0.15.254 using nmap on Kali Linux.

The routing table:

route -n

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         10.0.2.2        0.0.0.0         UG    100    0        0 eth0
10.0.0.0        192.168.0.1     255.255.255.0   UG    1      0        0 tun0
10.0.0.0        192.168.0.1     255.255.252.0   UG    0      0        0 tun0
10.0.2.0        192.168.0.1     255.255.255.0   UG    1      0        0 tun0
10.0.2.0        0.0.0.0         255.255.255.0   U     100    0        0 eth0
10.0.4.0        192.168.0.1     255.255.252.0   UG    0      0        0 tun0
192.168.0.0     0.0.0.0         255.255.255.0   U     0      0        0 tun0

I tried to scan the entire private network range at once but this caused nmap to quit after a period of time.

I then tried scanning blocks of 256 IP addresses at a time, beginning with

nmap -sS 10.0.0.0/24

Scans in the range 10.0.0.0 - 10.0.4.255 complete quickly, but scans in the range 10.0.5.0 - 10.0.15.254 are exponentially slower and usually do not complete.

Is there something about the routing of the network that is affecting this? Is there something I'm completely missing?

4
  • Try --min-rate ; --max-rate , this way it won't freeze.
    – tungsten
    Sep 11, 2019 at 13:40
  • Impossible to tell given the information provided. 10.0.4.0/24 and 10.0.5.0/24 are routed the same (via 10.0.4.0/22) so whatever is happening, happens after the packets leave your system.
    – gowenfawr
    Sep 11, 2019 at 13:41
  • This is a N question
    – tungsten
    Sep 11, 2019 at 13:50
  • 1
    See also this question; if the slow networks show 'Filtered' rather than 'Closed' then you're getting a lot more retransmits and timeouts on that network, which might explain it.
    – gowenfawr
    Sep 11, 2019 at 14:23

1 Answer 1

1

This route:

10.0.4.0        192.168.0.1     255.255.252.0   UG    0      0        0 tun0

With .252.0, you've got a range between 10.0.4.1 and 10.0.7.255 So when you hit IP's in 10.0.8.1, you'll start using your default route 0.0.0.0 which is a different gateway.

Check me to be sure, but based on that bitmask, I think that's what you're seeing.

http://www.ip-tools.net/ipcalc

Might double-check me though.

Not the answer you're looking for? Browse other questions tagged or ask your own question.