0

I'm a security newbie trying to scan a VPN in the range 10.0.0.0 - 10.0.15.254 using nmap on Kali Linux.

The routing table:

route -n

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         10.0.2.2        0.0.0.0         UG    100    0        0 eth0
10.0.0.0        192.168.0.1     255.255.255.0   UG    1      0        0 tun0
10.0.0.0        192.168.0.1     255.255.252.0   UG    0      0        0 tun0
10.0.2.0        192.168.0.1     255.255.255.0   UG    1      0        0 tun0
10.0.2.0        0.0.0.0         255.255.255.0   U     100    0        0 eth0
10.0.4.0        192.168.0.1     255.255.252.0   UG    0      0        0 tun0
192.168.0.0     0.0.0.0         255.255.255.0   U     0      0        0 tun0

I tried to scan the entire private network range at once but this caused nmap to quit after a period of time.

I then tried scanning blocks of 256 IP addresses at a time, beginning with 

nmap -sS 10.0.0.0/24

Scans in the range 10.0.0.0 - 10.0.4.255 complete quickly, but scans in the range 10.0.5.0 - 10.0.15.254 are exponentially slower and usually do not complete.

Is there something about the routing of the network that is affecting this? Is there something I'm completely missing?

Improve this question
4
  • Try --min-rate ; --max-rate , this way it won't freeze.
    – tungsten
    Sep 11, 2019 at 13:40
  • Impossible to tell given the information provided. 10.0.4.0/24 and 10.0.5.0/24 are routed the same (via 10.0.4.0/22) so whatever is happening, happens after the packets leave your system.
    – gowenfawr
    Sep 11, 2019 at 13:41
  • This is a N question
    – tungsten
    Sep 11, 2019 at 13:50
  • 1
    See also this question; if the slow networks show 'Filtered' rather than 'Closed' then you're getting a lot more retransmits and timeouts on that network, which might explain it.
    – gowenfawr
    Sep 11, 2019 at 14:23

1 Answer 1

Reset to default
1

This route:

10.0.4.0        192.168.0.1     255.255.252.0   UG    0      0        0 tun0

With .252.0, you've got a range between 10.0.4.1 and 10.0.7.255 So when you hit IP's in 10.0.8.1, you'll start using your default route 0.0.0.0 which is a different gateway.

Check me to be sure, but based on that bitmask, I think that's what you're seeing.

http://www.ip-tools.net/ipcalc

Might double-check me though.

Improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.