屑俺日記

☆ nmap scan

$ time nmap -sn 192.*.*.1-254 | tee ping.txt
 
real	0m22.217s
user	0m0.034s
sys	0m0.050s
 
$ head -n10 ping.txt 
 
Starting Nmap 6.40 ( http://nmap.org ) at 2016-04-13 09:36 JST
Nmap scan report for 192.*.*.1
Host is up (0.0027s latency).
Nmap scan report for 192.*.*.41
Host is up (0.066s latency).
Nmap scan report for 192.*.*.45
Host is up (0.000087s latency).
Nmap scan report for 192.*.*.46
Host is up (0.00094s latency).
 
$ grep -c 192 ping.txt
24

下記の設定をしてping(1)に反応しないPC(Debian Stretch)もひっかかった。

$ sudo iptables -nL
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
DROP       icmp --  0.0.0.0/0            0.0.0.0/0           
ACCEPT     all  --  127.0.0.1            0.0.0.0/0           
ACCEPT     all  --  127.0.0.1            0.0.0.0/0           
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:22
 
Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
 
Chain OUTPUT (policy ACCEPT)
target     prot opt source 

スキャン中の通信は、狙われた側からはこんな感じ。 要するに、tcpの80と443にアクセスして存否を確認しているということか。
ちなみにssh以外、外部へのサービスは上げていない。

$ sudo tcpdump -q -n host $SCAN_PC and port not 22
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
11:28:24.101073 ARP, Request who-has 192.*.*.62 tell $SCAN_PC, length 46
11:28:24.101309 ARP, Request who-has 192.*.*.63 tell $SCAN_PC, length 46
11:28:24.101426 IP $SCAN_PC.43213 > 192.*.*.61.80: tcp 0
11:28:24.101448 IP 192.*.*.61.80 > $SCAN_PC.43213: tcp 0
11:28:24.101528 IP $SCAN_PC.54537 > 192.*.*.61.443: tcp 0
11:28:24.101535 IP 192.*.*.61.443 > $SCAN_PC.54537: tcp 0
11:28:25.097731 ARP, Request who-has 192.*.*.62 tell $SCAN_PC, length 46
11:28:25.097965 ARP, Request who-has 192.*.*.63 tell $SCAN_PC, length 46
11:28:26.097971 ARP, Request who-has 192.*.*.62 tell $SCAN_PC, length 46
11:28:26.097982 ARP, Request who-has 192.*.*.63 tell $SCAN_PC, length 46

tcpの80と443もDROPすると、今度は見つけられなくなった。