Re: Why can't discover host in my LAN even though it responds over ARP?

On 08.07.2017 12:33, Rob Nicholls wrote:
> If the IPs are assigned to the same Linux host on different interfaces, it is possible that the host is responding to the ARP request received on what looks like the WiFi interface for the target IP and is replying from the second (primary? Ethernet?) interface with the value of its second IP on the same subnet. This is known as ARP flux. You may need to reconfigure your values for net.ipv4.conf.all.arp_ignore, net.ipv4.conf.all.arp_announce in /etc/sysctl.conf with different values (e.g. 1 and 2 respectively). Once Nmap sees an ARP response for the right target IP address it should think the host is up and continue with the scan.

Thanks Rob! I didn't know this was possible.

_______________________________________________
Sent through the dev mailing list
https://nmap.org/mailman/listinfo/dev
Archived at http://seclists.org/nmap-dev/

-----BEGIN PGP SIGNATURE-----

iQIcBAEBCAAGBQJZYiwlAAoJEGlViymZXJRvyEkP/0jz4WbLC4Ykzn0XrlRgg1S4
/FwTLEKbfMtDA/7aeAGv0m3t/6CVrbp8/bCpzZh1brfx+Ip+EsZYMACOntLEcytn
1f+rgXXp1a9//9W70UcA0YX5H31UxATS2WhcKwswUYLeVXnZh/imsvPJrohmvwUS
j5FEIm15UccPAwtpZvUGrVq8vwAmuycqbi9YFjqJC6WNjNAd7R9gK5jvCmWa1GKb
avHX7NTVH5umx9/6Eba6L/QBN8yA/GiiIGvZxBFeTXV0PL40f0SunRfNIZ7PWPPY
PKE8kh29H1KRb22E6d4ZTDHmeBj91EOqQMFc/4xpu+mfZa3+j/0lFbaa/2b7p1NM
LhvecMcv7TEQYfMYzJ0dXnMP3caSO2CQapS6H7r1F2q7B/V1KHtsXX2OBzJcT2b4
aHXoRea50sfXWcuWMDyFGHLT0NmbDyGuOFt3Q3ZgtpmyZi3kE5/VkGokknVwzTo7
N90sPbeRgw8dHsheQpUsoL9mdUN9xJACL4swfg7uO4uC3AyXbcDlMJWB4ev58hig
WW6FAvK1gEMiIoXbjwxAQpsE00Wpl8aqJlhq5BlFUn4fTVJAn8suE0lOFngUXs7x
bZ6H8MNn6BhE4SD1ZOkVjZ9Vs8GIiIqBsO6o/DRwUVE6+A5SmNrSmmVddiWbbahD
2w6xEkAIyiv4JVLlUuLJ
=64o8
-----END PGP SIGNATURE-----