Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

OLD QUESTION AND TITLE (Look further down for the updated question):

Why Nmap fragmented scan is only working on Backtrack?

I spent quite a few hours today trying to capture and study some fragmented IPv4 packets using Wireshark and Nmap security scanner.

I tried a couple of different OS' (Ubuntu and Debian) but to my surprise, Wireshark would only capture normal packets.

After launching the same Nmap scan from a Backtrack live CD it worked!

So to my understanding if it works on Backtrack which is tweaked for security purposes, there must be something (a setting maybe) preventing fragmented packets to the other Operating Systems.

After lots of Googling I did not manage to find the reason why this might be happening. Any ideas what this must be and if it is possible to perform an IP fragmented scan from an Ubuntu or a Debian OS?

UPDATED QUESTION: When I initially asked this question I was thinking that it might be an operating system related problem, but it turns out it might be a hardware related question because I managed to make a fragmented scan using an Ubuntu virtual machine.

So I can run nmap fragmented scans from virtual machines running on my physical machine, but not from my physical machine itself.

Is there any kernel setting (under /proc ?) preventing this, or it is hardware restriction and I cannot do anything about it?

share|improve this question
2  
Interesting. I'd imagine there's an option somewhere that is causing the network stack on the Ubuntu / Debian boxes to reassemble the fragmented packets before they leave the box. Either that, or the NIC is responsible. Are you running the Live CD from a VM and Ubuntu/Debian from a physical box? That might explain it. –  Polynomial Feb 26 '13 at 23:16
    
The Debian and the Backtrack was running virtual but in a different Hypervisor (Debian on a Xen baremetal and Backtrack on a VMware Workstation). The Ubuntu is native. I will make some more testing with a virtual Debian and Ubuntu running at VMware Workstation as Backtrack did, and report back my findings. –  Vangelis Tasoulas Feb 27 '13 at 13:53
    
I tested with an Ubuntu Server 12.04 in the same hypervisor and the fragmentation works! It must be something with the real hardware blocking fragmentation then. –  Vangelis Tasoulas Mar 2 '13 at 12:18
add comment

1 Answer

What network-card are you using?

I may be related to promiscuous mode, which does affect a lot of sniffing abilites of modern networking cards.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.