0

I have "(22 - 'Invalid argument')" using nmap. I've googled and got https://seclists.org/nmap-dev/, but that is discussing IPv6 while I've got this error using IPv4. It makes no mention of IPv4, so why am I getting this weird error?

I entered:

$ nmap --send-eth --release-memory --nsock-engine=epoll --allports --fuzzy \
     --randomize-hosts --log-errors  --max-os-tries=9 -n --reason          \
     --append-output --scanflags=URGACKPSHRSTSYNFIN --max-retries=6        \
     --host-timeout=225s --stats-every=10m --ttl=255 --min-hostgroup=5 .   \
     --max-hostgroup=25 --max-rtt-timeout=60s --scan-delay=250ms .         \
     --max-scan-delay=25s --stats-every=1 -v5 -sT -sV -A -p 80-82          \
     0.18.0.0

And got this result:

Starting Nmap 7.70 ( https://nmap.org ) at 2019-01-17 16:05 CET
NSE: Loaded 148 scripts for scanning.
NSE: Script Pre-scanning.
NSE: Starting runlevel 1 (of 2) scan.
Initiating NSE at 16:05
Completed NSE at 16:05, 0.00s elapsed
NSE: Starting runlevel 2 (of 2) scan.
Initiating NSE at 16:05
Completed NSE at 16:05, 0.00s elapsed
Initiating Ping Scan at 16:05
Scanning 0.18.0.0 [2 ports]
Stats: 0:00:01 elapsed; 0 hosts completed (0 up), 1 undergoing Ping Scan
Ping Scan Timing: About 0.00% done
Strange read error from 0.18.0.0 (22 - 'Invalid argument')
Strange read error from 0.18.0.0 (22 - 'Invalid argument')
Completed Ping Scan at 16:05, 0.50s elapsed (1 total hosts)
NSE: Script Post-scanning.
NSE: Starting runlevel 1 (of 2) scan.
Initiating NSE at 16:05
Completed NSE at 16:05, 0.00s elapsed
NSE: Starting runlevel 2 (of 2) scan.
Initiating NSE at 16:05
Completed NSE at 16:05, 0.00s elapsed
Read data files from: /usr/bin/../share/nmap
Note: Host seems down. If it is really up, but blocking our ping probes, try -Pn
Nmap done: 1 IP address (0 hosts up) scanned in 1.46 seconds

When trying with less arguments nmap -p 80-82 0.18.0.0 got:

Starting Nmap 7.70 ( https://nmap.org ) at 2019-01-17 16:24 CET
Strange read error from 0.18.0.0 (22 - 'Invalid argument')
Strange read error from 0.18.0.0 (22 - 'Invalid argument')
Note: Host seems down. If it is really up, but blocking our ping probes, try -Pn
Nmap done: 1 IP address (0 hosts up) scanned in 0.12 seconds

When trying with ncat I got:

$ nc -vvv 0.18.0.0 80
0.18.0.0: inverse host lookup failed: Unknown host
(UNKNOWN) [0.18.0.0] 80 (http) : Invalid argument
 sent 0, rcvd 0

$ nc -vvv 0.18.0.0 81
0.18.0.0: inverse host lookup failed: Unknown host
(UNKNOWN) [0.18.0.0] 81 (hosts2-ns) : Invalid argument
 sent 0, rcvd 0

I still have "Invalid argument" but this time instead of 22 I got the post numbers and service:

80 (http)
81 (hosts2-ns)

This raises a few questions:

  1. Does the "Invalid argument" of ncat and nmap relate to the same thing ?
  2. How can I make nmap for informative instead of printing 22?
  3. How can I say that the remote port is really CLOSE'd or is it really OPEN'ed and rejecting because of the firewall?
2

Address 0.18.0.0 (resp. 0.0.0.0/8) is not allowed as a destination IP address by standard™:

From RFC 6890:

2.2.2. IPv4 Special-Purpose Address Registry Entries

Tables 1 though 16, below, represent entries with which IANA has
initially populated the IPv4 Special-Purpose Address Registry.

          +----------------------+----------------------------+
          | Attribute            | Value                      |
          +----------------------+----------------------------+
          | Address Block        | 0.0.0.0/8                  |
          | Name                 | "This host on this network"|
          | RFC                  | [RFC1122], Section 3.2.1.3 |
          | Allocation Date      | September 1981             |
          | Termination Date     | N/A                        |
          | Source               | True                       |
          | Destination          | False                      |
          | Forwardable          | False                      |
          | Global               | False                      |
          | Reserved-by-Protocol | True                       |
          +----------------------+----------------------------+

                Table 1: "This host on this network"

Thus 0.0.0.0/8 and hence 0.18.0.0 is no valid destination address, hence the kernel returns EINVALID on socket operations trying to use it as a destination.

Hint: You might want to use RFC 1918 addresses for your locally administered network.

  • Thank's for your reply. This was really helpfull but also a bit confusing. I'v read RFCs 1918 and 6890 and the following CIDR IPs are listed as unreachable 10.0.0.0/8 100.64.0.0/10 127.0.0.0/8 169.254.0.0/16 172.16.0.0/12 192.0.0.0/24 192.0.2.0/24 192.88.99.0/24 192.168.0.0/16 198.18.0.0/15 198.51.100.0/24 203.0.113.0/24 240.0.0.0/4 255.255.255.255/32 I'v tried to connect using nmap/ncat and succeeded on some of those which I consider as an error since that are supposed to be 'unreachable' thank's – user2901196 Jan 26 at 13:49
  • reachable 'unreachable' IPs 127.254.254.254 169.254.0.1 192.0.3.1 127.158.154.70 127.122.122.10 127.36.6.123 127.66.103.130 127.12.163.165 conclusions for tests were all wrong because those IPs aren't supposed to be This means: 1) RFCs are wrong : very unlikely 2) I'v misinterpreted the real meaning for those, that is I'v included IP ranges that are valid WITHIN the invalid IPs 3) those RFC were superseeded (invalidated by newer RFCs): April 2013 RFC6890, February 1996 RFC1918, as they are 5 and 22 yo resp. 4) the remote IPs sysadmins didn't follow RFCs thanks in advance – user2901196 Jan 26 at 14:00
  • "strange error" resolved reading RFC 6890 & 1918 thank's – user2901196 Feb 2 at 23:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.