1

I can't identity my Linux Mint 17 machine on my home network. I use

nmap -O -v 192.168.2.28

However, I get the following output (below). I am just learning nmap, so I don't know what all of the output means. I don't have firewall up on Mint (well, not during testing). I checked ifconfig and my router's assigned dynamic IP: they are 192.168.2.28 (it is a funky router by Bell with fancy web GUI). I have Samba running, which is (I guess) port 445. I don't yet understand what netbios is, but I am reading about it. I know that OS detection works better when more ports are open, but maybe those 2 are too generic?

I am not sure, what else I need to provide for a better question. Update: Sorry, the questions is: why can't I detect OS correctly even though this is a fairly standard install?

I am happy to submit a report to Nmap about it not being able to detect the OS, but before that I want to make sure it's not me that's the problem. Thank you!

Starting Nmap 6.00 ( http://nmap.org ) at 2015-08-19 19:47 EDT
Initiating ARP Ping Scan at 19:47
Scanning 192.168.2.28 [1 port]
Completed ARP Ping Scan at 19:47, 0.10s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 19:47
Completed Parallel DNS resolution of 1 host. at 19:47, 0.01s elapsed
Initiating SYN Stealth Scan at 19:47
Scanning 192.168.2.28 [1000 ports]
Discovered open port 139/tcp on 192.168.2.28
Discovered open port 445/tcp on 192.168.2.28
Completed SYN Stealth Scan at 19:47, 0.60s elapsed (1000 total ports)
Initiating OS detection (try #1) against 192.168.2.28
Retrying OS detection (try #2) against 192.168.2.28
Retrying OS detection (try #3) against 192.168.2.28
Retrying OS detection (try #4) against 192.168.2.28
Retrying OS detection (try #5) against 192.168.2.28
Nmap scan report for 192.168.2.28
Host is up (0.011s latency).
Not shown: 998 closed ports
PORT    STATE SERVICE
139/tcp open  netbios-ssn
445/tcp open  microsoft-ds
MAC Address: 94:39:E5:BF:0D:3B (Hon Hai Precision Ind. Co.)
No exact OS matches for host (If you know what OS is running on it, see http://nmap.org/submit/ ).
TCP/IP fingerprint:
OS:SCAN(V=6.00%E=4%D=8/19%OT=139%CT=1%CU=34600%PV=Y%DS=1%DC=D%G=Y%M=9439E5%
OS:TM=55D515A5%P=armv7l-unknown-linux-gnueabi)SEQ(SP=107%GCD=1%ISR=103%TI=Z
OS:%CI=I%II=I%TS=8)OPS(O1=M5B4ST11NW7%O2=M5B4ST11NW7%O3=M5B4NNT11NW7%O4=M5B
OS:4ST11NW7%O5=M5B4ST11NW7%O6=M5B4ST11)WIN(W1=7120%W2=7120%W3=7120%W4=7120%
OS:W5=7120%W6=7120)ECN(R=Y%DF=Y%T=41%W=7210%O=M5B4NNSNW7%CC=Y%Q=)T1(R=Y%DF=
OS:Y%T=41%S=O%A=S+%F=AS%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=41%W=0%S=A%A=Z%
OS:F=R%O=%RD=0%Q=)T5(R=Y%DF=Y%T=41%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y
OS:%T=41%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=41%W=0%S=Z%A=S+%F=AR%O=%R
OS:D=0%Q=)U1(R=Y%DF=N%T=41%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)I
OS:E(R=Y%DFI=N%T=41%CD=S)

Uptime guess: 1.485 days (since Tue Aug 18 08:09:06 2015)
Network Distance: 1 hop
TCP Sequence Prediction: Difficulty=263 (Good luck!)
IP ID Sequence Generation: All zeros

Read data files from: /usr/bin/../share/nmap
OS detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 32.14 seconds
           Raw packets sent: 1111 (52.918KB) | Rcvd: 1078 (46.650KB)
  • 1
    "No exact OS matches for host (If you know what OS is running on it, see nmap.org/submit )." You're prolly doing it fine (as long as your scanning the right host). – KDEx Aug 20 '15 at 0:42
  • Thanks @Morgoroth. Yeah, I double checked that this is the right machine in the router and with ifconfig. So, it should be right (I don't have that many on my network :)). I will submit this to nmap eventually, but it throws me off that this is a standard Linux distro with standard services running, which should give Nmap info to ID it. – Serge Poele Aug 20 '15 at 1:09
  • I'm not clear about what your question is. – schroeder Aug 20 '15 at 3:59
  • 1
    you're running a really old version of nmap, so maybe it didn't have Mint's signature in 2012, and nmap uses a variety of factors to determine the OS, include packet signatures, which is likely being fiddled with by your Bell router – schroeder Aug 20 '15 at 4:04
1

As Morgoroth pointed out, nmap.org/submit is your friend in this case. However, you can also try

  • Using the --osscan-guess flag to more aggressively guess the OS (lower confidence interval)
  • Try a different type of scan (null, ack) using the -sN and -sA flags
  • Sometimes using the -A flag will give you something under "service info" that you can use to imply the OS.
  • However, be sure to use latest nmap version before submitting, since it is no good to submit signature already known in current signatures databases. – WhiteWinterWolf Aug 20 '15 at 8:43
  • Thanks Nic Barker and @WhiteWinterWolf. I can't upvote the answer yet, but accepted it. I will try the suggestions and then submit a report to Nmap. Cheers. – Serge Poele Aug 20 '15 at 12:35
  • 1
    Using -sN, -sA or other scan types will not help: OS detection uses only TCP and UDP probes, so you must use a scan type that can distinguish an open TCP port from a closed one. Usually -sSU is the best combination, but even with out -sU, Nmap will guess at a UDP port, hoping to hit an unused (closed) one. – bonsaiviking Aug 20 '15 at 20:08
  • @bonsaiviking thanks for the pointer, I wasn't fully aware of how OS scanning works. – Nic Barker Aug 20 '15 at 22:39
1

Nmap 6.00 was released in May 2012, so it cannot possibly have signatures for any Linux kernel later than 3.4. In the current database, your fingerprint matches exactly for "Linux 3.2 - 3.19". You can find the latest Nmap at https://nmap.org/download.html

  • Thank you! That makes perfect sense. So the problem is me in a sense that I am running an old nmap. I am running this on Raspberry Pi, which explains why it is old. I typically use Arch and Mint, so it did not occur to me to check the version. Thanks. I will update and try again. Sorry, I can't upvote and already accept the answer, however, I think this exactly answers why the problem is happening. – Serge Poele Aug 20 '15 at 13:16
  • For what it's worth, I wasn't able to get a unique fingerprint on Linux Mint either, using 6.47. – Nic Barker Aug 20 '15 at 22:40
  • @NicBarker Nmap 6.47 is a year old, too. We just put out a series of BETA releases that are actually quite stable. We'll be doing another fingerprint update before the next major release, too. Nmap-announce mailing list will keep you in the loop: nmap.org/mailman/listinfo/announce – bonsaiviking Aug 21 '15 at 12:05
  • @bonsaiviking Ah, I didn't realise. Appreciate the info, I'll definitely check out the beta and the mailing list. – Nic Barker Aug 22 '15 at 0:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.