Reconciling nmap, fping output

Question

I am trying to understand the local network I am on. Public IP is 23.23.23.23, say. Output of some common commands:

charles@ely:~$ ip addr show
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:0c:29:26:de:1b brd ff:ff:ff:ff:ff:ff
    inet 192.168.118.216/24 brd 192.168.118.255 scope global eth0
    inet6 fe80::20c:29ff:fe26:de1b/64 scope link 
       valid_lft forever preferred_lft forever


charles@ely:~$ fping -g -a 192.168.118.0 192.168.118.254 2>/dev/null
192.168.118.2
192.168.118.216
192.168.118.1

charles@ely:~$ fping -g -a 23.23.23.0 23.23.23.154 2>/dev/null
23.23.23.1
23.23.23.9
23.23.23.10
23.23.23.33
23.23.23.34
23.23.23.81
23.23.23.82
23.23.23.85
23.23.23.98
23.23.23.99
23.23.23.105
23.23.23.106
23.23.23.109
23.23.23.110
23.23.23.113
23.23.23.121
23.23.23.123
23.23.23.124
23.23.23.129
23.23.23.130
23.23.23.145
23.23.23.153

And nmap:

charles@ely:~$ nmap -sP 23.23.23.0/24

Starting Nmap 5.21 ( http://nmap.org ) at 2014-01-11 10:04 EST
Nmap scan report for rrcs-23-23-23-34.nyc.noth.noth.com (23.23.23.34)
Host is up (0.20s latency).
Nmap scan report for rrcs-23-23-23-106.nyc.noth.noth.com (23.23.23.106)
Host is up (0.036s latency).
Nmap scan report for rrcs-23-23-23-121.nyc.noth.noth.com (23.23.23.121)
Host is up (0.0094s latency).
Nmap scan report for rrcs-23-23-23-124.nyc.noth.noth.com (23.23.23.124)
Host is up (0.0088s latency).
Nmap scan report for rrcs-23-23-23-130.nyc.noth.noth.com (23.23.23.130)
Host is up (0.034s latency).
Nmap scan report for rrcs-23-23-23-170.nyc.noth.noth.com (23.23.23.170)
Host is up (0.055s latency).
Nmap scan report for rrcs-23-23-23-210.nyc.noth.noth.com (23.23.23.210)
Host is up (0.034s latency).
Nmap scan report for rrcs-23-23-23-214.nyc.noth.noth.com (23.23.23.214)
Host is up (0.087s latency).
Nmap scan report for rrcs-23-23-23-218.nyc.noth.noth.com (23.23.23.218)
Host is up (0.029s latency).
Nmap done: 256 IP addresses (9 hosts up) scanned in 6.60 seconds

This is after doing a broadcast ping on the network.

I though that these would give similar results, but they're all over the place. A couple of questions -

1. Why does fping -g -a return different results for the external WAN address and the internal local LAN IP? Where is my device in the first case - my device is 192.168.1.216?
2. Why do fping and nmap return such different results against 23.23.23.23?

Thanks.

Answer 1

1) your pc belongs to a very small network, 192.168.118.0/24, which has only one extra pc besides the router and your pc.

2) As for question 1, when you scan your LAN, you are scanning only all pcs behind your router (3, like shown by the first instance of fping): in technical terms, you are scanning all private addresses in your LAN. With the other two scans, you have covered all public addresses in the range 216.224.142.0/24. In most SOHO (=Small Office and HOme) networks, there is generally only one connection to the Internet, shared by all pcs in the LAN.

This means that the three components uncovered by the first fping, 192.168.118.1, 192.168.118.2 and 192.168.118.216, are hidden behind only one of the 256 addresses in 216.224.142.0/24 (from the info you provided it is not possible to deduce which one). The other 255 addresses belong to someone else.

The answer to your first question is that the pcs 192.168.118.2 and 192.168.118.216 are not directly on the Internet, but are shielded from it by 192.168.118.1, the router. When your router receives, on the WAN side, a ping packet, it will not let it through to your pc and the other machine, but will reply (or not, depending on how it is set up) directly. So 192.168.118.2 and 192.168.118.216 will never see the ping packets that you have generated with fping/nmap 216.224.142.0/24.

3) As per your second question, the reason is that the two scans try to do different things. fping, as per its man page, only sends an honest ICMP echo request. nmap, instead (see its man page) does the following:

-sn (No port scan)

The default host discovery done with -sn consists of an ICMP echo request, TCP SYN to port 443, TCP ACK to port 80, and an ICMP timestamp request by default. When executed by an unprivileged user, only SYN packets are sent (using a connect call) to ports 80 and 443 on the target. When a privileged user tries to scan targets on a local ethernet network, ARP requests are used unless --send-ip was specified. The -sn option can be combined with any of the discovery probe types (the -P* options, excluding -Pn) for greater flexibility. If any of those probe type and port number options are used, the default probes are overridden. When strict firewalls are in place between the source host running Nmap and the target network, using those advanced techniques is recommended. Otherwise hosts could be missed when the firewall drops probes or their responses.

In previous releases of Nmap, -sn was known as -sP.

There you have your answer: When executed by an unprivileged user, only SYN packets are sent (using a connect call) to ports 80 and 443 on the target.

You executed the WAN side nmap scan as an unpriviledged user, thus you did not send ICMP echo packets. Hence the difference.