nmap / nmap/nmap

Update nping TCP sequence numbers for better response matching and avoid bogus ttl

Open
#360 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug Nping
Dominant language
C
Stars
13.6k
Forks
2.9k
No merged PRs in 30d

Description

This does not happen every time, but happens quite often. The below is for a host that I access over WAN. The min RTT below is unrealistic

$ sudo nping --tcp 82.129.131.170 -p 123 -c 10 --rate 10

Starting Nping 0.7.12 ( https://nmap.org/nping ) at 2016-04-09 16:54 EET
SENT (0.0057s) TCP 192.168.1.12:55679 > 82.129.131.170:123 S ttl=64 id=32010 iplen=40  seq=357387181 win=1480
RCVD (0.0784s) TCP 82.129.131.170:123 > 192.168.1.12:55679 SA ttl=51 id=0 iplen=44  seq=237315656 win=14600 <mss 1412>
SENT (0.1063s) TCP 192.168.1.12:55679 > 82.129.131.170:123 S ttl=64 id=32010 iplen=40  seq=357387181 win=1480
RCVD (0.1989s) TCP 82.129.131.170:123 > 192.168.1.12:55679 SA ttl=51 id=0 iplen=44  seq=238909168 win=14600 <mss 1412>
SENT (0.2068s) TCP 192.168.1.12:55679 > 82.129.131.170:123 S ttl=64 id=32010 iplen=40  seq=357387181 win=1480
SENT (0.3113s) TCP 192.168.1.12:55679 > 82.129.131.170:123 S ttl=64 id=32010 iplen=40  seq=357387181 win=1480
RCVD (0.3145s) TCP 82.129.131.170:123 > 192.168.1.12:55679 SA ttl=51 id=0 iplen=44  seq=240460782 win=14600 <mss 1412>
SENT (0.4158s) TCP 192.168.1.12:55679 > 82.129.131.170:123 S ttl=64 id=32010 iplen=40  seq=357387181 win=1480
SENT (0.5177s) TCP 192.168.1.12:55679 > 82.129.131.170:123 S ttl=64 id=32010 iplen=40  seq=357387181 win=1480
RCVD (0.5475s) TCP 82.129.131.170:123 > 192.168.1.12:55679 SA ttl=51 id=0 iplen=44  seq=240460782 win=14600 <mss 1412>
RCVD (0.5521s) TCP 82.129.131.170:123 > 192.168.1.12:55679 SA ttl=51 id=0 iplen=44  seq=243742136 win=14600 <mss 1412>
SENT (0.6191s) TCP 192.168.1.12:55679 > 82.129.131.170:123 S ttl=64 id=32010 iplen=40  seq=357387181 win=1480
RCVD (0.6194s) TCP 82.129.131.170:123 > 192.168.1.12:55679 SA ttl=51 id=0 iplen=44  seq=243742136 win=14600 <mss 1412>
RCVD (0.6631s) TCP 82.129.131.170:123 > 192.168.1.12:55679 SA ttl=51 id=0 iplen=44  seq=246898232 win=14600 <mss 1412>
SENT (0.7236s) TCP 192.168.1.12:55679 > 82.129.131.170:123 S ttl=64 id=32010 iplen=40  seq=357387181 win=1480
SENT (0.8280s) TCP 192.168.1.12:55679 > 82.129.131.170:123 S ttl=64 id=32010 iplen=40  seq=357387181 win=1480
RCVD (0.8741s) TCP 82.129.131.170:123 > 192.168.1.12:55679 SA ttl=51 id=0 iplen=44  seq=250192065 win=14600 <mss 1412>
SENT (0.9325s) TCP 192.168.1.12:55679 > 82.129.131.170:123 S ttl=64 id=32010 iplen=40  seq=357387181 win=1480

Max rtt: 92.479ms | Min rtt: 0.080ms | Avg rtt: 40.263ms
Raw packets sent: 10 (400B) | Rcvd: 8 (352B) | Lost: 2 (20.00%)
Nping done: 1 IP address pinged in 1.94 seconds

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the nping TCP send and receive behavior shown by the provided command and compare repeated SYN responses with the reported RTT and TTL values. Reproduce the WAN case, then verify that response matching uses appropriate sequence numbers and that the output no longer reports bogus values.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
cli, networking
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.