Linux vs. Windows results

[Sandro Poppi]

Hi,

I ran into an interesting (weird?) behaviour of os detection of nmap v5.00:

Sometimes (not always) I get inaccurate results when I scan from a linux box while doing the same scan from a Windows XP box the os detection is perfect.

E.G. scanning a Windows 2003 Server SP2 (nmap -O -sSU -T4 <target>):

Linux: No exact OS matches
Windows: OS Details: Microsoft Windows Server 2003 SP1 or SP2

Scanner:
Linux: Fedora 11 with Fedora nmap rpm
Windows XP SP3: nmap.exe from nmap.org, WinPCap 4.0.2

nmap-os-db is identical on both systems

I haven't found anything similiar in the archive so I wonder if it's only me having this issue or if anyone else also has seen it, and ideally what the solution would be.

Thank you for your time,
Sandro
--
GRATIS für alle GMX-Mitglieder: Die maxdome Movie-FLAT!
Jetzt freischalten unter http://portal.gmx.net/de/go/maxdome01
_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://seclists.org/nmap-dev/

[Sandro Poppi]

Hi again,

It seems I don't run into a Linux vs Windows but nmap vs vmware issue ;)

I set up a new linux box and it worked instantly. Only difference now is the other linux is running under vmware.

Anyway I can't explain why this happens. Or is it as simple as "Don't run nmap under vmware"?

Thanks,
Sandro

-------- Original-Nachricht --------
> Datum: Mon, 09 Nov 2009 13:58:12 +0100
> Von: "Sandro Poppi" <spoppi@...>
> An: nmap-dev@...
> Betreff: Linux vs. Windows results

> Hi,
>
> I ran into an interesting (weird?) behaviour of os detection of nmap
> v5.00:
>
> Sometimes (not always) I get inaccurate results when I scan from a linux
> box while doing the same scan from a Windows XP box the os detection is
> perfect.
>
> E.G. scanning a Windows 2003 Server SP2 (nmap -O -sSU -T4 <target>):
>
> Linux: No exact OS matches
> Windows: OS Details: Microsoft Windows Server 2003 SP1 or SP2
>
> Scanner:
> Linux: Fedora 11 with Fedora nmap rpm
> Windows XP SP3: nmap.exe from nmap.org, WinPCap 4.0.2
>
> nmap-os-db is identical on both systems
>
> I haven't found anything similiar in the archive so I wonder if it's only
> me having this issue or if anyone else also has seen it, and ideally what
> the solution would be.
>
> Thank you for your time,
> Sandro
> --
> GRATIS für alle GMX-Mitglieder: Die maxdome Movie-FLAT!
> Jetzt freischalten unter http://portal.gmx.net/de/go/maxdome01
> _______________________________________________
> Sent through the nmap-dev mailing list
> http://cgi.insecure.org/mailman/listinfo/nmap-dev
> Archived at http://seclists.org/nmap-dev/

--
GRATIS für alle GMX-Mitglieder: Die maxdome Movie-FLAT!
Jetzt freischalten unter http://portal.gmx.net/de/go/maxdome01
_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://seclists.org/nmap-dev/

[Ron (list)]

That's interesting, because a significant number of people (myself
included) run it almost exclusively under VMWare. I'd like to rule out
VMWare as the cause, but you never know.



Sandro Poppi wrote:

> Hi again,
>
> It seems I don't run into a Linux vs Windows but nmap vs vmware issue ;)
>
> I set up a new linux box and it worked instantly. Only difference now is the other linux is running under vmware.
>
> Anyway I can't explain why this happens. Or is it as simple as "Don't run nmap under vmware"?
>
> Thanks,
> Sandro
>
> -------- Original-Nachricht --------
>> Datum: Mon, 09 Nov 2009 13:58:12 +0100
>> Von: "Sandro Poppi" <spoppi@...>
>> An: nmap-dev@...
>> Betreff: Linux vs. Windows results
>
>> Hi,
>>
>> I ran into an interesting (weird?) behaviour of os detection of nmap
>> v5.00:
>>
>> Sometimes (not always) I get inaccurate results when I scan from a linux
>> box while doing the same scan from a Windows XP box the os detection is
>> perfect.
>>
>> E.G. scanning a Windows 2003 Server SP2 (nmap -O -sSU -T4 <target>):
>>
>> Linux: No exact OS matches
>> Windows: OS Details: Microsoft Windows Server 2003 SP1 or SP2
>>
>> Scanner:
>> Linux: Fedora 11 with Fedora nmap rpm
>> Windows XP SP3: nmap.exe from nmap.org, WinPCap 4.0.2
>>
>> nmap-os-db is identical on both systems
>>
>> I haven't found anything similiar in the archive so I wonder if it's only
>> me having this issue or if anyone else also has seen it, and ideally what
>> the solution would be.
>>
>> Thank you for your time,
>> Sandro
>> --
>> GRATIS für alle GMX-Mitglieder: Die maxdome Movie-FLAT!
>> Jetzt freischalten unter http://portal.gmx.net/de/go/maxdome01
>> _______________________________________________
>> Sent through the nmap-dev mailing list
>> http://cgi.insecure.org/mailman/listinfo/nmap-dev
>> Archived at http://seclists.org/nmap-dev/
>

_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://seclists.org/nmap-dev/

[David Fifield]

On Mon, Nov 09, 2009 at 01:58:12PM +0100, Sandro Poppi wrote:

> I ran into an interesting (weird?) behaviour of os detection of nmap v5.00:
>
> Sometimes (not always) I get inaccurate results when I scan from a
> linux box while doing the same scan from a Windows XP box the os
> detection is perfect.
>
> E.G. scanning a Windows 2003 Server SP2 (nmap -O -sSU -T4 <target>):
>
> Linux: No exact OS matches
> Windows: OS Details: Microsoft Windows Server 2003 SP1 or SP2

This could be caused by different network conditions between the two
scanning machines and the target. Are they all on the same network?

Does the Linux scan print out a fingerprint? If so, then it probably had
a very close, but not exact, match. Try adding the --osscan-guess option
to force it to be printed.

David Fifield
_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://seclists.org/nmap-dev/

[DePriest, Jason R.]

On Mon, Nov 9, 2009 at 10:08 AM, Sandro Poppi <> wrote:

> Hi again,
>
> It seems I don't run into a Linux vs Windows but nmap vs vmware issue ;)
>
> I set up a new linux box and it worked instantly. Only difference now is the other linux is running under vmware.
>
> Anyway I can't explain why this happens. Or is it as simple as "Don't run nmap under vmware"?
>
> Thanks,
> Sandro

Could it be possible that you are overwhelming the network adapter
translation from virtual-NIC to physical NIC?

Do you have the vmware tools installed on the linux guest?  What
virtual  hardware for the NIC is it using and what module to you have
loaded for the driver?

Are you using NAT or bridged networking?

I have had problems with scanning from a host to a guest OS when the
guest OS doesn't have the vmware tools available.  For example, if I
scan a BeOS guest OS from my Windows host, I have to turn the timing
way down or the BeOS guest locks up.

-Jason
_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://seclists.org/nmap-dev/

[Sandro Poppi]

> Could it be possible that you are overwhelming the network adapter
> translation from virtual-NIC to physical NIC?

Not sure but I doubt.

>
> Do you have the vmware tools installed on the linux guest?  What
> virtual  hardware for the NIC is it using and what module to you have
> loaded for the driver?

I can't install vmware-tools since with Fedora 11 I get compile errors. I installed open-vm-tools though, but that didn't help.

The NIC's module is e1000

>
> Are you using NAT or bridged networking?

It's bridged.

Sandro
--
DSL-Preisknaller: DSL Komplettpakete von GMX schon für
16,99 Euro mtl.!* Hier klicken: http://portal.gmx.net/de/go/dsl02
_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://seclists.org/nmap-dev/

[Sandro Poppi]

> This could be caused by different network conditions between the two
> scanning machines and the target. Are they all on the same network?

no, the vmware is "nearer" (5 hops), the "native" linux is 9 hops.
 
> Does the Linux scan print out a fingerprint? If so, then it probably had
> a very close, but not exact, match. Try adding the --osscan-guess option
> to force it to be printed.

Yes, it does, but even with --osscan-guess it's not fitting in any way.

Sandro
--
DSL-Preisknaller: DSL Komplettpakete von GMX schon für
16,99 Euro mtl.!* Hier klicken: http://portal.gmx.net/de/go/dsl02
_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://seclists.org/nmap-dev/