OLD QUESTION AND TITLE (Look further down for the updated question):

Why Nmap fragmented scan is only working on Backtrack?

I spent quite a few hours today trying to capture and study some fragmented IPv4 packets using Wireshark and Nmap security scanner.

I tried a couple of different OS' (Ubuntu and Debian) but to my surprise, Wireshark would only capture normal packets.

After launching the same Nmap scan from a Backtrack live CD it worked!

So to my understanding if it works on Backtrack which is tweaked for security purposes, there must be something (a setting maybe) preventing fragmented packets to the other Operating Systems.

After lots of Googling I did not manage to find the reason why this might be happening. Any ideas what this must be and if it is possible to perform an IP fragmented scan from an Ubuntu or a Debian OS?

UPDATED QUESTION: When I initially asked this question I was thinking that it might be an operating system related problem, but it turns out it might be a hardware related question because I managed to make a fragmented scan using an Ubuntu virtual machine.

So I can run nmap fragmented scans from virtual machines running on my physical machine, but not from my physical machine itself.

Is there any kernel setting (under /proc ?) preventing this, or it is hardware restriction and I cannot do anything about it?

  • 2
    Interesting. I'd imagine there's an option somewhere that is causing the network stack on the Ubuntu / Debian boxes to reassemble the fragmented packets before they leave the box. Either that, or the NIC is responsible. Are you running the Live CD from a VM and Ubuntu/Debian from a physical box? That might explain it.
    – Polynomial
    Feb 26, 2013 at 23:16
  • The Debian and the Backtrack was running virtual but in a different Hypervisor (Debian on a Xen baremetal and Backtrack on a VMware Workstation). The Ubuntu is native. I will make some more testing with a virtual Debian and Ubuntu running at VMware Workstation as Backtrack did, and report back my findings. Feb 27, 2013 at 13:53
  • I tested with an Ubuntu Server 12.04 in the same hypervisor and the fragmentation works! It must be something with the real hardware blocking fragmentation then. Mar 2, 2013 at 12:18

1 Answer 1


What network-card are you using?

I may be related to promiscuous mode, which does affect a lot of sniffing abilites of modern networking cards.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .