Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

On an Ubuntu VMWare VM I ran:

sudo nmap -sP 192.168.0.*

This returned:

Starting Nmap 5.00 ( http://nmap.org ) at 2010-12-28 22:46 PST

Host 192.168.0.0 is up (0.00064s latency).
Host 192.168.0.1 is up (0.00078s latency).
Host 192.168.0.2 is up (0.00011s latency).
.
.
.
Host 192.168.0.254 is up (0.00068s latency).
Host 192.168.0.255 is up (0.00066s latency).

So, nmap reported that every ip in the subnet 192.168.0.* was live. The problem is I only have 4 live machines on 192.168.0.* so why did nmap report every ip address was live?

The ip address of the Ubuntu VM is 192.168.28.131 From this VM I can ping the live systems on my internal subnet 192.168.0.* and get the expected response. And if I ping a machine that doesn't exist I can get no response as expected.

share|improve this question

2 Answers 2

try the --unprivileged parameter

..like nmap -sP --unprivileged 192.168.0.*

share|improve this answer

Some firewalls can explain this behavior.

Instead of blocking icmp, they will respond to each echo request they receive.

In this case, it could be due to VMware and the type of virtual network you're using.

share|improve this answer
    
The thing is, if I use the ping command from the VM it works as expected. Why would it behave one way for ping and another for nmap? –  martianway Dec 29 '10 at 9:28
    
nmap sends not only icmp echo request, but tcp probes also : nmap.org/book/man-host-discovery.html this could explain the difference. –  petrus Dec 29 '10 at 9:43

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.