0

Why does the target of a nmap scan, where the target does not exist get entered into the arp cache?

nmap -v -P0 -sT  192.168.1.103

That scan always shows "host up".

This behaviour made me go crazy >:(

Edit: The arp cache is as shown in the correct answer. Thanks guys!

1
  • 1
    Please show the corresponding arp entry (edit the question) May 12, 2017 at 14:53

1 Answer 1

4

It shows "host up" because you told nmap to assume the host is up—that's what -P0 (or its newer equivalent -Pn) does.

Presumably it shows up in the arp cache like this:

Address                  HWtype  HWaddress           Flags Mask            Iface
192.168.1.103                    (incomplete)                              eth0

which means the kernel sent out an ARP request, but hasn't received a reply. That happened because you told the kernel to send a packet (well, quite a few packets, actually) to the host.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .