I was wondering how nmap work against host if ip was shared by many hosts. The senario is like, for example, my home ip address is xxx.xxx.xxx.xxx and I use wireless router. On 3 different machines, public ip address is appeared as same. So if I run nmap against xxx.xxx.xxx.xxx, I'm not sure which machine will be scanned.

And what if I want to run nmap against particular machine under public ip if it has subnet? is it even possible?

I'd appreciate any advice. Thanks


I'm assuming what you're describing is a typical home NAT set-up, though you don't explicitly state this.

To add to what David Schwartz was saying, it really depends on what your router does with traffic.

Here are a few scenarios that might happen:

  • Nmap does a ping sweep: In this case the router would respond (or not respond) to the ICMP echo request and the traffic would never see the host.

  • Nmap does a port scan: If the router is not forwarding ports, it will most likely not allow the traffic through. But, if you are forwarding ports, the traffic will go to the proper device and that device will respond to the port scan depending on its configuration.

So, depending on the configuration of your router and the nmap scan type used, it could hit none or all of your NAT'd computers.

If you have a specific scenario in mind, please add more details about the router configuration and the specific NMAP scan you would be doing.

  • let's say router is forwarding ports, What I want to do is testing home network from outside of LAN. I'm still quite confused how to determine which machine will respond if it is under router, and how outsider can determine which machine to attack – REALFREE Nov 28 '11 at 9:24
  • @REALFREE Let's say you're forwarding port 80. When NMAP scans port 80, the router will see that traffic and know that it is supposed to forward port 80 to the proper devices. Whichever devices port 80 is forwarded to (most likely just 1 device) will respond to that. If a port is not forwarded, then the router will be the final point for the traffic, either not responding or responding that the port is not open. Let me know if this helps clarify. – Evan Nov 28 '11 at 22:57
  • @REALFREE The outsider may not know which device they are attacking. They will notice which devices have open ports and go after the devices which do have open ports. If they are attempting to target a specific device, they would have to know something about it (OS, applications running, etc.) to determine from the scan which device was which. – Evan Nov 28 '11 at 22:59

It will scan the view of your network that is presented the the rest of the Internet by your router.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.