From 89d10dd9e845886cdd442683f41504a30ab468ad Mon Sep 17 00:00:00 2001 From: david Date: Fri, 11 Jul 2008 00:35:39 +0000 Subject: [PATCH] Use rcvdtime, not NULL, as the received time when doing ping or port updates from ICMP probes during a protocol scan (protoscanicmphack). I don't know why it was NULL before, but that's wrong. It was probably never noticed because in the case of a port update, all that happens is a failure to update the timing. In the case of a ping probe, it would look like a dropped ping probe, but that woudl be unlikely because protocol scans usually don't take very long. I discovered it while testing code to allow ping probes to persist between host discovery and port scanning. --- scan_engine.cc | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/scan_engine.cc b/scan_engine.cc index 6a2c40d7d..c1eaf6a4e 100644 --- a/scan_engine.cc +++ b/scan_engine.cc @@ -3906,9 +3906,9 @@ static bool get_pcap_result(UltraScanInfo *USI, struct timeval *stime) { if (probe->protocol() == IPPROTO_ICMP) { if (probe->isPing()) - ultrascan_ping_update(USI, hss, probeI, NULL); + ultrascan_ping_update(USI, hss, probeI, &rcvdtime); else { - ultrascan_port_probe_update(USI, hss, probeI, PORT_OPEN, NULL); + ultrascan_port_probe_update(USI, hss, probeI, PORT_OPEN, &rcvdtime); icmp = (struct icmp *) ((char *)ip_icmp + 4 * ip_icmp->ip_hl); reason_sip = (ip_icmp->ip_src.s_addr == protoscanicmphackaddy.sin_addr.s_addr) ? 0 : ip_icmp->ip_src.s_addr; if(!icmp->icmp_code && !icmp->icmp_type)