Re: [nping] Bug/confusing functionality of --send-eth and missing IP route
ValdikSS via dev <[email protected]> Tue, 15 Oct 2019 22:12:27 +0300
| Newsgroups | gmane.comp.security.nmap.devel |
|---|---|
| Message-ID | <[email protected]> |
This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--===============8852162568453047336==
Content-Type: multipart/signed; micalg=pgp-sha256;
protocol="application/pgp-signature";
boundary="DYlq6MAwD0X2AlJATxGlDlvYkrvdgp4hY"
This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--DYlq6MAwD0X2AlJATxGlDlvYkrvdgp4hY
Content-Type: multipart/alternative;
boundary="------------2B18E4AB8E217F1E92DC805C"
--------------2B18E4AB8E217F1E92DC805C
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Sorry, there's a mistake in information section.
=E2=80=A6The following nping command with --send-eth option will NOT send=
ARP requests to destination from 172.16.0.0/16.=E2=80=A6
On 15.10.2019 22:07, ValdikSS wrote:
>
>
> Description
>
> nping 0.7.70, when used with --send-eth option, would not perform ARP r=
esolution and use ARP-resolved MAC address of destination IP if IP route =
to the destination IP/network is missing in system routing table AND defa=
ult route is present.
> The program's output text does not suggest that it does not perform ARP=
resolution and tries to send the packet via router, even in --debug mode=
=2E
>
>
> Information
>
> I have eth0-26042 network interface with 192.168.5.22/24 address only, =
and default route set:
> $ ip r
> default via 192.168.5.1 dev eth0-26042
> 192.168.5.0/24 dev eth0-26042 proto kernel scope link src 192.168.5.22
>
> This network has 172.16.0.0/16 in the same L2 segment, but there's no r=
oute to it.
>
> The following nping command with --send-eth option will send ARP reques=
ts and successfully resolve MAC address of destination from 172.16.0.0/16=
, but will not use it to send the packet at all.
>
> nping --send-eth --source-ip 172.16.0.100 --dest-ip 172.16.1.1 --udp -c=
1 --debug
>
> =E2=80=A6
>
> Determining target 172.16.1.1 MAC address or next hop MAC address...
> =C2=A0=C2=A0=C2=A0 > Checking system's ARP cache...
> =C2=A0=C2=A0=C2=A0 > No relevant entries found in system's ARP cache.
> =C2=A0=C2=A0=C2=A0 > Sending ARP request using spoofed IP 172.16.0.100.=
=2E.
> =C2=A0=C2=A0=C2=A0 > No ARP responses received.
> =C2=A0=C2=A0=C2=A0 > Sending ARP request using our real IP 192.168.5.22=
=2E..
> =C2=A0=C2=A0=C2=A0 > Success: 1 ARP response received [d8:58:d7:4b:4b:0=
f]
> +-----------------TARGET-----------------+
> Device Name:=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0 eth0-26042
> Device FullName:=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 eth0-26042
> Device Type:=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0 Ethernet
> Directly connected?:=C2=A0=C2=A0=C2=A0 no
> Address family:=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 AF_INET=
> Resolved Hostname:=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0
> Supplied Hostname:=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 (null)
> Target Address:=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 172.16.=
1.1
> Source Address:=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 192.168=
=2E5.22
> Spoofed Address:=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 172.16.0.100=
> Next Hop Address:=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 192.168.5.1
> *Target MAC Address:=C2=A0=C2=A0=C2=A0=C2=A0 00:00:00:00:00:00*
> Source MAC Address:=C2=A0=C2=A0=C2=A0=C2=A0 a0:a8:cd:7b:7b:96
> *Next Hop MAC Address:=C2=A0=C2=A0 d8:58:d7:4b:4b:0f*
>
> =E2=80=A6
>
> Despite what the text says "Determining target 172.16.1.1 MAC address o=
r next hop MAC address...", no ARP resolution of destination (172.16.1.1)=
is performed at all. nping sends only ARP requests to the router default=
route via (192.168.5.1).
> d8:58:d7:4b:4b:0f is 192.168.5.1 mac address.
>
> Please see the attached files with debug output.
>
>
> Expected result
>
> nping, when used with --send-eth, sends ARP request and use resolved MA=
C address to send RAW Ethernet packet in the same L2 segment.
>
>
> Actual result
>
> nping, with used with --send-eth, does not try to perform ARP resolutio=
n of the destination and switches to routing mode.
>
--------------2B18E4AB8E217F1E92DC805C
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: quoted-printable
<html>
<head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3DUTF=
-8">
</head>
<body>
<p>Sorry, there's a mistake in information section.</p>
<p>=E2=80=A6The following nping command with --send-eth option will N=
OT send
ARP requests to destination from 172.16.0.0/16.=E2=80=A6</p>
<p><br>
</p>
<div class=3D"moz-cite-prefix">On 15.10.2019 22:07, ValdikSS wrote:<b=
r>
</div>
<blockquote type=3D"cite"
cite=3D"mid:[email protected]">
<meta http-equiv=3D"content-type" content=3D"text/html; charset=3DU=
TF-8">
<h2>Description</h2>
<p>nping 0.7.70, when used with --send-eth option, would not
perform ARP resolution and use ARP-resolved MAC address of
destination IP if IP route to the destination IP/network is
missing in system routing table AND default route is present.<br>=
The program's output text does not suggest that it does not
perform ARP resolution and tries to send the packet via router,
even in --debug mode.<br>
</p>
<p><br>
</p>
<h2>Information</h2>
<p>I have eth0-26042 network interface with 192.168.5.22/24
address only, and default route set:<br>
<tt>$ ip r</tt><tt><br>
</tt><tt>default via 192.168.5.1 dev eth0-26042 </tt><tt><br>
</tt><tt>192.168.5.0/24 dev eth0-26042 proto kernel scope link
src 192.168.5.22</tt></p>
<p>This network has 172.16.0.0/16 in the same L2 segment, but
there's no route to it.<br>
</p>
<p>The following nping command with --send-eth option will send
ARP requests and successfully resolve MAC address of destination
from 172.16.0.0/16, but will not use it to send the packet at
all.</p>
<p><tt>nping --send-eth --source-ip 172.16.0.100 --dest-ip
172.16.1.1 --udp -c1 --debug</tt></p>
<p><tt>=E2=80=A6<br>
</tt></p>
<p><tt>Determining target 172.16.1.1 MAC address or next hop MAC
address...</tt><tt><br>
</tt><tt>=C2=A0=C2=A0=C2=A0 > Checking system's ARP cache...</=
tt><tt><br>
</tt><tt>=C2=A0=C2=A0=C2=A0 > No relevant entries found in sys=
tem's ARP
cache.</tt><tt><br>
</tt><tt>=C2=A0=C2=A0=C2=A0 > Sending ARP request using spoofe=
d IP
172.16.0.100...</tt><tt><br>
</tt><tt>=C2=A0=C2=A0=C2=A0 > No ARP responses received.</tt><=
tt><br>
</tt><tt>=C2=A0=C2=A0=C2=A0 > Sending ARP request using our re=
al IP
192.168.5.22...</tt><tt><br>
</tt><tt>=C2=A0=C2=A0=C2=A0 > Success: 1 ARP response received=
[d8:58:d7:4b:4b:0f]</tt><tt><br>
</tt><tt>+-----------------TARGET-----------------+</tt><tt><br>
</tt><tt>Device Name:=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0 eth0-26042</tt><tt><br>
</tt><tt>Device FullName:=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
eth0-26042</tt><tt><br>
</tt><tt>Device Type:=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0 Ethernet</tt><tt><br>
</tt><tt>Directly connected?:=C2=A0=C2=A0=C2=A0 no</tt><tt><br>
</tt><tt>Address family:=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0 AF_INET</tt><tt><br>
</tt><tt>Resolved Hostname:=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 </tt><t=
t><br>
</tt><tt>Supplied Hostname:=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 (null)<=
/tt><tt><br>
</tt><tt>Target Address:=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0 172.16.1.1</tt><tt><br>
</tt><tt>Source Address:=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0 192.168.5.22</tt><tt><br>
</tt><tt>Spoofed Address:=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
172.16.0.100</tt><tt><br>
</tt><tt>Next Hop Address:=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 19=
2.168.5.1</tt><tt><br>
</tt><b><tt>Target MAC Address:=C2=A0=C2=A0=C2=A0=C2=A0 00:00:00:=
00:00:00</tt></b><tt><br>
</tt><tt>Source MAC Address:=C2=A0=C2=A0=C2=A0=C2=A0 a0:a8:cd:7b:=
7b:96</tt><tt><br>
</tt><b><tt>Next Hop MAC Address:=C2=A0=C2=A0 d8:58:d7:4b:4b:0f</=
tt></b></p>
<p><tt>=E2=80=A6</tt><br>
</p>
<p>Despite what the text says "Determining target 172.16.1.1 MAC
address or next hop MAC address...", no ARP resolution of
destination (172.16.1.1) is performed at all. nping sends only
ARP requests to the router default route via (192.168.5.1).<br>
d8:58:d7:4b:4b:0f is 192.168.5.1 mac address.<br>
</p>
<p>Please see the attached files with debug output.</p>
<p><br>
</p>
<h2>Expected result</h2>
<p>nping, when used with --send-eth, sends ARP request and use
resolved MAC address to send RAW Ethernet packet in the same L2
segment.</p>
<p><br>
</p>
<h2>Actual result</h2>
<p>nping, with used with --send-eth, does not try to perform ARP
resolution of the destination and switches to routing mode.<br>
</p>
</blockquote>
</body>
</html>
--------------2B18E4AB8E217F1E92DC805C--
--DYlq6MAwD0X2AlJATxGlDlvYkrvdgp4hY
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"
-----BEGIN PGP SIGNATURE-----
Comment: https://keybase.io/verify
iQIzBAEBCAAdFiEEMiogvXcpmS32v71gXNcgLu+I93IFAl2mGhsACgkQXNcgLu+I
93LKWw/8ChqnLfbgIrkUv75tqesYuzLCegXDhVlg77r8QtLYqX/jhSFdms/LZLC0
eOQrYV4MBs7pc39lsgwpsDkaLP5f84gPsM4HA8BnbMaAruV4/RPQHeDe2BG5DzN2
9tWfh6qR3hhyo78bPtrzQ5yIXTKda3NaiNb74C1zp///XfLPy+xLlgdAczY4kony
6UqyfYA0a9SVGakacYL8rbbKx58SRD7wMaxv2yuejPjOmiQDGk3/hfb5RUuOetD/
bDcIh8yUSleIvMTqPVIQy3mRnYJ1JNWfdM2+k8GudHBqKMH+u+IjBFWPiLvnIweN
U0Q9C7rRcHrd8Q0UDxZOGn6D/H1WFTYvr878T8fOla8QFfhRPw82Y3yGcY5+d8ec
+rfq6t/8iHs7JkyNeg+Dbb+aGmycGLbSVJ/S9pgfB8bFnLz2be4b9nN0KmQwzzvi
ddtmwaCGhKx2bH2a8bts07+EBwdCh8aT5/UkwsKX1xoJiiNSwa50QAXkHCvd/xch
zq+S5p6hKIy+dgJaDBN9Zj0wJUTJQR0hI8Bj/XEU0PczvhfZlEFMOmfnYmSfIvp/
0birDJQ4nC8Q6Jz3yySlrZsZ4XT8+vwjCu79Ue7Sw4OhGcSg39sl28sI4Lu7ApJ1
rVR3efbjcGfIPzlKNEuyyW7MOo5YXYbmTmUkDcn6SPm5E5ebVFw=
=Vo5/
-----END PGP SIGNATURE-----
--DYlq6MAwD0X2AlJATxGlDlvYkrvdgp4hY--
--===============8852162568453047336==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
Sent through the dev mailing list
https://nmap.org/mailman/listinfo/dev
Archived at http://seclists.org/nmap-dev/
--===============8852162568453047336==--