nmap / nmap/npcap

Nmap issue : Error compiling our pcap filter: expression rejects all packets

Open
#549 10 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
C
Stars
3.6k
Forks
592
PR merge metrics
No merged PRs in 30d

Description

Hi All,

We are getting below error with Nmap 7.91 while doing port scanning.

Issue :
Nmap port scan fails with Error compiling our pcap filter: expression rejects all packets

Description :
When we are running Nmap port scanning from Windows we get below error with details

nmap.exe" -oX - --privileged --min-rtt-timeout 500ms -sS -sU -T4 -PE -p T:513,5985,5986,3940,5988,902,135,5989,80,21,22,23,443,U:161 10.77.160.110 10.66.0.112 10.97.128.111 172.29.0.113 107.0.0.112 10.4.0.114 10.4.0.112 10.72.0.112 172.25.0.113 169.254.0.58 169.254.0.113 172.19.0.110

Error compiling our pcap filter: expression rejects all packets

We then ran same command for only two problematic IPS:

nmap.exe" -oX - --privileged --min-rtt-timeout 500ms -sS -sU -T4 -PE -p T:513,5985,5986,3940,5988,902,135,5989,80,21,22,23,443,U:161 169.254.0.58 169.254.0.113

Error compiling our pcap filter: expression rejects all packets

We again ran same command, excluding two problematic IPS: This time it works

nmap.exe" -oX - --privileged --min-rtt-timeout 500ms -sS -sU -T4 -PE -p T:513,5985,5986,3940,5988,902,135,5989,80,21,22,23,443,U:161 10.77.160.110 10.66.0.112 10.97.128.111 172.29.0.113 107.0.0.112 10.4.0.114 10.4.0.112 10.72.0.112 172.25.0.113 172.19.0.110

We then ran same commands by connecting to our corporate network (VPN) and all commands pass just fine. Please refer attached output.

*So we want to know why we get error for 169.x series of IPS? Is this known issue?
nmap_queries.txt
*

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reviewing the attached nmap_queries.txt and reproducing the Windows Nmap 7.91 commands, comparing scans that include 169.254.x.x addresses with those that do not. No source file or test is named; done means identifying why the pcap filter rejects all packets for those addresses and documenting or addressing the behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
networking
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.