Re: Random unprivileged TCP ports below 5000 kind-of open for a fraction of a second

From: Fyodor (fyodor@insecure.org)
Date: 12/24/02

  • Next message: alfaentomega: "Re: Random unprivileged TCP ports below 5000 kind-of open for a fraction of a second" 
    Date: Tue, 24 Dec 2002 11:18:16 -0800
From: Fyodor <fyodor@insecure.org>
To: alfaentomega <alfaentomega@yahoo.com>

    On Mon, Dec 23, 2002 at 09:33:59PM -0800, alfaentomega wrote:
    >
    > I found out that by default nmap doesn't scan every
    > port (before that I thought every port is scanned
    > without explicite -p), so I ran "nmap -p1- localhost"
    > and every time I saw something betwen 0 and 3 (usually
    > there were 2) ports which were reported by nmap as
    > open, but during the scan there was "Strange read
    > error from 127.0.0.1 (104): Operation now in progress"
    > for every one of them.

    This may be a problem with your Linux kernel. When Nmap (or many
    other applications, such as Telnet) does a connect() call, the OS is
    supposed to choose a good souce port to bind to for the connection.
    When you connect() to a ephemeral port (1024-4999 or so) on localhost,
    there is a chance that the system will decide to use as a source port
    the very port you are connecting to. In a bizarre twist, the
    application then ends up "connecting to itself"! I consider this to
    be a Linux kernel bug, but my reports to the linux-kernel list (and
    offers to fix the problem) have been unheeded. Here is my first
    posting (from 1999):

    http://marc.theaimsgroup.com/?l=linux-kernel&m=93598368005241&w=2

    So the short summary is that it is just a Linux bug which the
    developers argue is a feature that they don't intend to fix.
    I do have a workaround in place for Nmap versions released in the last
    two or three years -- what version of Nmap are you using and what are
    the exact command-line arguments?

    New versions of the Nmap Security Scanner can be found at
    http://www.insecure.org/nmap/

    Cheers,
    Fyodor

    ----------------------------------------------------------------------------
    This list is provided by the SecurityFocus ARIS analyzer service.
    For more information on this free incident handling, management
    and tracking system please see: http://aris.securityfocus.com

    Relevant Pages

    • Re: Random unprivileged TCP ports below 5000 kind-of open for a fraction of a second
      ... When Nmap (or many ... > other applications, such as Telnet) does a connectcall, the OS is ... > supposed to choose a good souce port to bind to for the connection. ... I saw a familiar "Connection reset by peer" every time the random port ...
      (Incidents)
    • Re: Yes, trying to hack a remote control
      ... I attempted a telnet into that port, and it asked for a username/pass, ... and then upload a modified firmware to the remote. ... The latest versions of nmap have a feature whereby you can run scans ...
      (Security-Basics)
    • Re: how nmap can know my firewalled servers ?
      ... UDP or ICMP protocol), it will mark the port as closed. ... descrition, how NMAP determins, if the UDP port is open or closed. ... Try Webroot's Spy Sweeper Enterprisefor 30 days for FREE with no ...
      (Security-Basics)
    • Re: FW: baby pen-test question
      ... I ALWAYS do an nmap sweep of varying degrees. ... As for testing a large network, I primarily base my efforts on the mission ... My first question is about port scanning. ... This list is provided by the SecurityFocus Security Intelligence Alert ...
      (Pen-Test)
    • Re: Help understanding NMAP results
      ... >to do with IT) but I have been playing with old computers and Linux in my ... and is set to default DROP any packets ... Went over to a friend's house, and ran an NMAP scan against myself ... You could listen on that port and see what traffic is passing when you ...
      (Security-Basics)