I echo the sentiment about booting the live CD on a standalone
machine. VMWare sometimes acts unpredictably with network tools.
Also, If you can, get a tcpdump or ethereal capture of your port scan.
This will help determine what's going on. Ideally, you should do it
on the monitor port of the switch that your scanning machine is using,
or use a hub. Running the capture on the scanning machine directly
might yield decieving results (i.e. tcpdump may say that a packet was
sent when it may have never actually hit the wire).
On 9/25/06, Arturas Zalenekas <security@zalenekas.net> wrote:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Hi,
that with VM-Ware could be a problem. Try to boot from the Live-CD
directly and then do the scan. That is what you told. You could give
Sentoo a try. Its also a Live-CD based on Gentoo. They've build a lot of
security tools into (actualy almost everything that I know and use daily).
One more suggestion. Try to scan the FW from the internal network or
dial-in with VPN and scan internal interfaces and try to use the nmap
option -T in polite or other mode. If you have still any questions, feel
free to post.
Kind regards,
Arturas Zalenekas
Network Security Engineer and Analyst
> Hello,
>
> thanks for Your answer.
>
> So here are some more information:
>
> I'am trying to scan the firewall (Watchguard X700) of my company from home
> for securityreasons. So I know which ports are open, because I'am
> administering the firewall.
>
> I use the BackTrack 3.0 (remote-exploit.org) live linux cd. This is based
> on slackware. Kernel 2.6.156. with Nmap 4.03.
>
> On the Watchguard X700 all intrusion prevention features are disabled. So
> "Block SYN Flod Attacks" is also disabled. The firewall is not blocking me
> because I can do normal Connect() scans after a SYN-Scan and with the
> Connect() scan the open ports 80 and 443 are correctly found.
>
> Maybe VM-Ware (Windows) is the reason? I've run BackTrack in a vm (direckt
> access to nic) under Windows. What I will try this evening is to boot the
> notebook directly with the BackTrack-CD and connecting directly with my
> ISP. Then performing a SYN-Scan again. Maybe then I will get better
> results.
>
> I will then post my result here.
>
> ---------------------------------------------------------------------------
> This list is sponsored by: Norwich University
>
> EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE
> The NSA has designated Norwich University a center of Academic Excellence
> in Information Security. Our program offers unparalleled Infosec
> management
> education and the case study affords you unmatched consulting experience.
> Using interactive e-Learning technology, you can earn this esteemed
> degree,
> without disrupting your career or home life.
>
> http://www.msia.norwich.edu/secfocus
> ---------------------------------------------------------------------------
>
>
>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (GNU/Linux)
iD8DBQFFF4w1RNnenGjQKnsRAg9kAJ40iog5G+DhjAhMEVbxJCNdLix4KACeIkCw
OEDafJpTLK1oFW9lzB5AOs0=
=InXK
-----END PGP SIGNATURE-----
---------------------------------------------------------------------------
This list is sponsored by: Norwich University
EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE
The NSA has designated Norwich University a center of Academic Excellence
in Information Security. Our program offers unparalleled Infosec management
education and the case study affords you unmatched consulting experience.
Using interactive e-Learning technology, you can earn this esteemed degree,
without disrupting your career or home life.
http://www.msia.norwich.edu/secfocus
---------------------------------------------------------------------------
--
http://www.FocusHacks.com - The Ford Focus Modification Site!
http://www.focushacks.com/focushacks-gpg.txt - My GPG encryption key
---------------------------------------------------------------------------
This list is sponsored by: Norwich University
EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE
The NSA has designated Norwich University a center of Academic Excellence
in Information Security. Our program offers unparalleled Infosec management
education and the case study affords you unmatched consulting experience.
Using interactive e-Learning technology, you can earn this esteemed degree,
without disrupting your career or home life.
http://www.msia.norwich.edu/secfocus
---------------------------------------------------------------------------
