0

I tried to scan one of the routers in our office from a virtual machine connected to a different router.

When the virtual machine is connected to the Internet (directly?) Nmap gives up straight away

enter image description here

enter image description here

but when the virtual machine is connected using a NAT Nmap switches to SYN scan?

enter image description here

enter image description here

Improve this question

1 Answer 1

Reset to default
4

nmap performs scans only upon the online hosts it finds online from the host list given as input, In your case 2 nmap is able to find the host online by default probing method that is ICMP which was allowed by your router ACLs

in first case no scan is performed because Default probing method does not find any host up, because your non nated ip is not allowed in router ACL to perform ICMP requests

Improve this answer
7
  • Thank you for your answer, would you care to simplify it a little bit for me? I am not sure I completely understand it
    – Ulkoma
    Oct 19, 2016 at 12:17
  • before switching to port scan on a host , Nmap check whether the host is up . one of the way is to check ICMP . so it seems in your case that namp didnt find host up in case vm is directly attached to internet , so please check your router accesslists
    – Arjun sharma
    Oct 19, 2016 at 12:26
  • any idea why? the host is up
    – Ulkoma
    Oct 19, 2016 at 12:27
  • i already mention it that ICMP probes might be failing ... run nmap with switch --packet-trace
    – Arjun sharma
    Oct 19, 2016 at 12:28
  • 1
    The default set of host discovery ("ping") probes is more than just ICMP. It is "an ICMP echo request, a TCP SYN packet to port 443, a TCP ACK packet to port 80, and an ICMP timestamp request." (nmap.org/book/man-host-discovery.html)
    – bonsaiviking
    Oct 19, 2016 at 14:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .