00:03:53 ~ # nmap -sS -sV -P0 -O -p 11523 lamusique.homelinux.org -d -n -vv --packet_trace Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2006-11-11 00:08 CET --------------- Timing report --------------- hostgroups: min 1, max 100000 rtt-timeouts: init 1000, min 100, max 10000 scan-delay: TCP 1000, UDP 1000 parallelism: min 0, max 0 max-retries: 10, host-timeout: 0 --------------------------------------------- Initiating SYN Stealth Scan against 81.251.121.11 [1 port] at 00:08 Packet capture filter (device wlan0): dst host 192.168.1.101 and (icmp or (tcp and (src host 81.251.121.11))) SENT (0.1520s) TCP 192.168.1.101:40663 > 81.251.121.11:11523 S ttl=51 id=6853 iplen=44 seq=3220594604 win=4096 RCVD (0.2330s) TCP 81.251.121.11:11523 > 192.168.1.101:40663 SA ttl=20 id=0 iplen=44 seq=2992210490 win=16184 ack=3220594605 Discovered open port 11523/tcp on 81.251.121.11 The SYN Stealth Scan took 0.09s to scan 1 total ports. Initiating service scan against 1 service on 81.251.121.11 at 00:08 NSOCK (0.3090s) TCP connection requested to 81.251.121.11:11523 (IOD #1) EID 8 NSOCK (0.3090s) nsock_loop() started (no timeout). 1 events pending NSOCK (0.3960s) Callback: CONNECT SUCCESS for EID 8 [81.251.121.11:11523] NSOCK (0.3960s) Read request from IOD #1 [81.251.121.11:11523] (timeout: 6000ms) EID 18 NSOCK (0.4800s) Callback: READ SUCCESS for EID 18 [81.251.121.11:11523] (20 bytes): SSH-2.0-OpenSSH_4.5. The service scan took 0.17s to scan 1 service on 1 host. Starting RPC scan against 81.251.121.11 Warning: OS detection will be MUCH less reliable because we did not find at least 1 open and 1 closed TCP port Packet capture filter (device wlan0): dst host 192.168.1.101 and (icmp or (tcp and src host 81.251.121.11)) For OSScan assuming port 11523 is open, 30676 is closed, and neither are firewalled SENT (0.4910s) TCP 192.168.1.101:40670 > 81.251.121.11:11523 SE ttl=54 id=56436 iplen=60 seq=2153633163 win=3072 SENT (0.4920s) TCP 192.168.1.101:40671 > 81.251.121.11:11523 ttl=46 id=15776 iplen=60 seq=2153633163 win=3072 SENT (0.4920s) TCP 192.168.1.101:40672 > 81.251.121.11:11523 SFPU ttl=42 id=26032 iplen=60 seq=2153633163 win=3072 SENT (0.4930s) TCP 192.168.1.101:40673 > 81.251.121.11:11523 A ttl=54 id=44781 iplen=60 seq=2153633163 win=3072 ack=0 SENT (0.4930s) TCP 192.168.1.101:40674 > 81.251.121.11:30676 S ttl=38 id=161 iplen=60 seq=2153633163 win=3072 SENT (0.4940s) TCP 192.168.1.101:40675 > 81.251.121.11:30676 A ttl=52 id=48599 iplen=60 seq=2153633163 win=1024 ack=0 SENT (0.4940s) TCP 192.168.1.101:40676 > 81.251.121.11:30676 FPU ttl=50 id=13301 iplen=60 seq=2153633163 win=3072 SENT (0.4950s) UDP 192.168.1.101:40663 > 81.251.121.11:30676 ttl=51 id=14537 iplen=328 RCVD (0.5630s) TCP 81.251.121.11:11523 > 192.168.1.101:43097 A ttl=20 id=2573 iplen=40 seq=3006165726 win=16184 ack=2486960373 RCVD (0.5640s) TCP 81.251.121.11:11523 > 192.168.1.101:43097 FA ttl=20 id=2574 iplen=40 seq=3006165726 win=16184 ack=2486960373 SENT (2.6040s) TCP 192.168.1.101:40670 > 81.251.121.11:11523 SE ttl=46 id=31023 iplen=60 seq=2153633163 win=3072 SENT (2.6040s) TCP 192.168.1.101:40671 > 81.251.121.11:11523 ttl=40 id=38521 iplen=60 seq=2153633163 win=1024 SENT (2.6040s) TCP 192.168.1.101:40672 > 81.251.121.11:11523 SFPU ttl=44 id=22894 iplen=60 seq=2153633163 win=1024 SENT (2.6040s) TCP 192.168.1.101:40673 > 81.251.121.11:11523 A ttl=53 id=18978 iplen=60 seq=2153633163 win=2048 ack=0 SENT (2.6040s) TCP 192.168.1.101:40674 > 81.251.121.11:30676 S ttl=40 id=19567 iplen=60 seq=2153633163 win=1024 SENT (2.6040s) TCP 192.168.1.101:40675 > 81.251.121.11:30676 A ttl=43 id=62361 iplen=60 seq=2153633163 win=4096 ack=0 SENT (2.6040s) TCP 192.168.1.101:40676 > 81.251.121.11:30676 FPU ttl=50 id=48135 iplen=60 seq=2153633163 win=3072 SENT (2.6040s) UDP 192.168.1.101:40663 > 81.251.121.11:30676 ttl=51 id=14537 iplen=328 SENT (4.6480s) TCP 192.168.1.101:40664 > 81.251.121.11:11523 S ttl=59 id=43037 iplen=60 seq=2153633164 win=4096 RCVD (4.7450s) TCP 81.251.121.11:11523 > 192.168.1.101:40664 SA ttl=20 id=0 iplen=44 seq=2994417985 win=16184 ack=2153633165 SENT (4.7660s) TCP 192.168.1.101:40665 > 81.251.121.11:11523 S ttl=37 id=32198 iplen=60 seq=2153633165 win=2048 RCVD (4.8500s) TCP 81.251.121.11:11523 > 192.168.1.101:40665 SA ttl=20 id=0 iplen=44 seq=3000272491 win=16184 ack=2153633166 SENT (4.8760s) TCP 192.168.1.101:40666 > 81.251.121.11:11523 S ttl=44 id=62837 iplen=60 seq=2153633166 win=1024 RCVD (4.9580s) TCP 81.251.121.11:11523 > 192.168.1.101:40666 SA ttl=20 id=0 iplen=44 seq=3001226517 win=16184 ack=2153633167 SENT (4.9870s) TCP 192.168.1.101:40667 > 81.251.121.11:11523 S ttl=58 id=23598 iplen=60 seq=2153633167 win=3072 RCVD (5.0680s) TCP 81.251.121.11:11523 > 192.168.1.101:40667 SA ttl=20 id=0 iplen=44 seq=2996444166 win=16184 ack=2153633168 SENT (5.0980s) TCP 192.168.1.101:40668 > 81.251.121.11:11523 S ttl=52 id=17257 iplen=60 seq=2153633168 win=1024 RCVD (5.1810s) TCP 81.251.121.11:11523 > 192.168.1.101:40668 SA ttl=20 id=0 iplen=44 seq=3001063623 win=16184 ack=2153633169 SENT (5.2090s) TCP 192.168.1.101:40669 > 81.251.121.11:11523 S ttl=44 id=32587 iplen=60 seq=2153633169 win=1024 RCVD (5.3130s) TCP 81.251.121.11:11523 > 192.168.1.101:40669 SA ttl=20 id=0 iplen=44 seq=3000555212 win=16184 ack=2153633170 Host 81.251.121.11 appears to be up ... good. Interesting ports on 81.251.121.11: PORT STATE SERVICE VERSION 11523/tcp open ssh OpenSSH 4.5 (protocol 2.0) Device type: web proxy|firewall|general purpose|broadband router Running: Blue Coat SGOS, Checkpoint Windows NT/2K/XP, IPCop Linux 2.4.X, Linux 1.X|2.4.X|2.6.X, OpenBSD 3.X, Sun Solaris 2.X|7, ZyXel ZyNOS OS details: BlueCoat SG4, Checkpoint SecurePlatform NG FP3, IPCop 1.4 - 1.4.6 Linux 2.4.2x-based firewall, Linux 1.3.20 (x86), Linux 2.4.20, Linux 2.4.20 - 2.4.22, Linux 2.6.10 - 2.6.11, OpenBSD 3.6 x86 with pf "scrub in all", Sun Solaris 2.5, 2.5.1, Sun Solaris 2.6 - 7 x86, ZyXel 944S Prestige router OS Fingerprint: TSeq(Class=RI%gcd=1%SI=21419F%IPID=Z%TS=U) T1(Resp=N) T2(Resp=N) T3(Resp=N) T4(Resp=N) T5(Resp=N) T6(Resp=N) T7(Resp=N) PU(Resp=N) TCP Sequence Prediction: Class=random positive increments Difficulty=2179487 (Good luck!) IPID Sequence Generation: All zeros Final times for host: srtt: 81535 rttvar: 81535 to: 407675 Nmap finished: 1 IP address (1 host up) scanned in 5.378 seconds Raw packets sent: 23 (1900B) | Rcvd: 9 (388B)