0

Why does the target of a nmap scan, where the target does not exist get entered into the arp cache?

nmap -v -P0 -sT  192.168.1.103

That scan always shows "host up".

This behaviour made me go crazy >:(

Edit: The arp cache is as shown in the correct answer. Thanks guys!

  • 1
    Please show the corresponding arp entry (edit the question) – Rui F Ribeiro May 12 '17 at 14:53
4

It shows "host up" because you told nmap to assume the host is up—that's what -P0 (or its newer equivalent -Pn) does.

Presumably it shows up in the arp cache like this:

Address                  HWtype  HWaddress           Flags Mask            Iface
192.168.1.103                    (incomplete)                              eth0

which means the kernel sent out an ARP request, but hasn't received a reply. That happened because you told the kernel to send a packet (well, quite a few packets, actually) to the host.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.