Everyone might have heard about Ripple20 vulnerability which has impacted millions of IoT devices. I know that using Nessus or Qualys, it is possible to identify this vulnerability.

Is it possible to discover Ripple20 using tools such as Nmap or Wireshark?

  • Nmap, only if there is a script for it. I leave that to your googling skills. Wireshark just listens to traffic. I'm not sure how that can be used to discover this vulnerability. It will see the packets used to exploit the vulnerability, but not the vulnerability itself. Nmap and Wireshark are not vulnerability management tools.
    – schroeder
    Jul 1, 2020 at 15:27

1 Answer 1


Ripple20 is a group of vulnerabilities (19 of them), each one with its own considerations.

To identify the vulnerabilities you need some response from the devices, which can be obtained from a scanner like nmap, but since Wireshark is a passive tool, it may not help by itself to identify the vulnerable devices.

More information of each one of the 19 vulns can be obtained from the company that disclosed the vulns.

  • Nmap can't just detect the vulns, but needs a script to test for the vulns. There would need to be an NSE script for it.
    – schroeder
    Jul 1, 2020 at 21:24
  • According to my understanding there are 2 possible ways to identify the vulnerability: 1) if you already know that the device is using Treck TCP/IP stack 2) If you can find it using network testing. Now, to identify it using testing we have to send some crafted request and check the device's response. The reason for using nmap and wireshark is that using Wireshark we can analyze the packet and using Nmap we can send request to the device. So, if anyone has any idea regarding what kind of packet to submit...then this might help in identifying Ripple20. Jul 2, 2020 at 17:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.