CERBERUS/nmap
1
0
Fork 0
mirror of https://github.com/nmap/nmap.git synced 2026-08-04 06:40:48 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Ports are now considered open during a SYN scan if a SYN packet (without the ACK

Browse source 
flag) is received in response. This can be due to an extremely rare TCP feature
known as a simultaneous open or split handshake connection.
see http://nmap.org/misc/split-handshake.pdf
Added a reason code: ER_SYN and associated reason string: "split-handshake-syn".
This commit is contained in:
jah 2010-06-08 01:50:45 +00:00
parent 77ef606d52
commit a17609e6b4
4 changed files with 21 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

4
scan_engine.cc
View file

@ -4102,6 +4102,10 @@ static bool get_pcap_result(UltraScanInfo *USI, struct timeval *stime) {
/* Yeah! An open port */
newstate = PORT_OPEN;
current_reason = ER_SYNACK;
} else if (USI->scantype == SYN_SCAN && tcp->th_flags == TH_SYN) {
/* A SYN from a TCP Split Handshake - open port */
newstate = PORT_OPEN;
current_reason = ER_SYN;
} else if (tcp->th_flags & TH_RST) {
current_reason = ER_RESETPEER;
if (USI->scantype == WINDOW_SCAN ) {