00:08:47 ~ # nmap -sS -sV -P0 -O -p 11523 lamusique.homelinux.org -d -n -vv --packet_trace Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2006-11-11 00:11 CET --------------- Timing report --------------- hostgroups: min 1, max 100000 rtt-timeouts: init 1000, min 100, max 10000 scan-delay: TCP 1000, UDP 1000 parallelism: min 0, max 0 max-retries: 10, host-timeout: 0 --------------------------------------------- Initiating SYN Stealth Scan against 81.251.121.11 [1 port] at 00:11 Packet capture filter (device wlan0): dst host 192.168.1.101 and (icmp or (tcp and (src host 81.251.121.11))) SENT (0.1540s) TCP 192.168.1.101:39901 > 81.251.121.11:11523 S ttl=38 id=61787 iplen=44 seq=916924753 win=3072 RCVD (0.2560s) TCP 81.251.121.11:11523 > 192.168.1.101:39901 SA ttl=20 id=0 iplen=44 seq=3182215848 win=9999 ack=916924754 Discovered open port 11523/tcp on 81.251.121.11 The SYN Stealth Scan took 0.11s to scan 1 total ports. Initiating service scan against 1 service on 81.251.121.11 at 00:11 NSOCK (0.3370s) TCP connection requested to 81.251.121.11:11523 (IOD #1) EID 8 NSOCK (0.3370s) nsock_loop() started (no timeout). 1 events pending NSOCK (0.4180s) Callback: CONNECT SUCCESS for EID 8 [81.251.121.11:11523] NSOCK (0.4180s) Read request from IOD #1 [81.251.121.11:11523] (timeout: 6000ms) EID 18 NSOCK (0.5060s) Callback: READ SUCCESS for EID 18 [81.251.121.11:11523] (20 bytes): SSH-2.0-OpenSSH_4.5. The service scan took 0.17s to scan 1 service on 1 host. Starting RPC scan against 81.251.121.11 Warning: OS detection will be MUCH less reliable because we did not find at least 1 open and 1 closed TCP port Packet capture filter (device wlan0): dst host 192.168.1.101 and (icmp or (tcp and src host 81.251.121.11)) For OSScan assuming port 11523 is open, 35935 is closed, and neither are firewalled SENT (0.5150s) TCP 192.168.1.101:39908 > 81.251.121.11:11523 SE ttl=47 id=21097 iplen=60 seq=1068874503 win=4096 SENT (0.5160s) TCP 192.168.1.101:39909 > 81.251.121.11:11523 ttl=45 id=12544 iplen=60 seq=1068874503 win=2048 SENT (0.5160s) TCP 192.168.1.101:39910 > 81.251.121.11:11523 SFPU ttl=48 id=35147 iplen=60 seq=1068874503 win=1024 SENT (0.5170s) TCP 192.168.1.101:39911 > 81.251.121.11:11523 A ttl=39 id=49604 iplen=60 seq=1068874503 win=4096 ack=0 SENT (0.5170s) TCP 192.168.1.101:39912 > 81.251.121.11:35935 S ttl=52 id=54730 iplen=60 seq=1068874503 win=1024 SENT (0.5180s) TCP 192.168.1.101:39913 > 81.251.121.11:35935 A ttl=52 id=16746 iplen=60 seq=1068874503 win=1024 ack=0 SENT (0.5180s) TCP 192.168.1.101:39914 > 81.251.121.11:35935 FPU ttl=39 id=20642 iplen=60 seq=1068874503 win=4096 SENT (0.5180s) UDP 192.168.1.101:39901 > 81.251.121.11:35935 ttl=59 id=35528 iplen=328 RCVD (0.5900s) TCP 81.251.121.11:11523 > 192.168.1.101:43102 A ttl=20 id=13913 iplen=40 seq=3185666358 win=9999 ack=2680623671 RCVD (0.5920s) TCP 81.251.121.11:11523 > 192.168.1.101:43102 FA ttl=20 id=13914 iplen=40 seq=3185666358 win=9999 ack=2680623671 SENT (3.6340s) TCP 192.168.1.101:39908 > 81.251.121.11:11523 SE ttl=39 id=22441 iplen=60 seq=1068874503 win=4096 SENT (3.6340s) TCP 192.168.1.101:39909 > 81.251.121.11:11523 ttl=49 id=37627 iplen=60 seq=1068874503 win=2048 SENT (3.6340s) TCP 192.168.1.101:39910 > 81.251.121.11:11523 SFPU ttl=39 id=18677 iplen=60 seq=1068874503 win=4096 SENT (3.6340s) TCP 192.168.1.101:39911 > 81.251.121.11:11523 A ttl=37 id=58727 iplen=60 seq=1068874503 win=2048 ack=0 SENT (3.6350s) TCP 192.168.1.101:39912 > 81.251.121.11:35935 S ttl=55 id=39725 iplen=60 seq=1068874503 win=4096 SENT (3.6350s) TCP 192.168.1.101:39913 > 81.251.121.11:35935 A ttl=44 id=36426 iplen=60 seq=1068874503 win=1024 ack=0 SENT (3.6350s) TCP 192.168.1.101:39914 > 81.251.121.11:35935 FPU ttl=58 id=31731 iplen=60 seq=1068874503 win=3072 SENT (3.6350s) UDP 192.168.1.101:39901 > 81.251.121.11:35935 ttl=59 id=35528 iplen=328 RCVD (3.7360s) TCP 81.251.121.11:6667 > 192.168.1.101:46589 PA ttl=21 id=35697 iplen=141 seq=2894499788 win=7504 ack=1602288093 RCVD (6.4740s) TCP 81.251.121.11:6667 > 192.168.1.101:46589 A ttl=21 id=35698 iplen=40 seq=2894499889 win=7504 ack=1602288119 RCVD (7.0720s) TCP 81.251.121.11:6667 > 192.168.1.101:46589 PA ttl=21 id=35699 iplen=116 seq=2894499889 win=7504 ack=1602288119 SENT (7.0730s) TCP 192.168.1.101:39902 > 81.251.121.11:11523 S ttl=47 id=58215 iplen=60 seq=1068874504 win=4096 RCVD (7.1720s) TCP 81.251.121.11:11523 > 192.168.1.101:39902 SA ttl=20 id=0 iplen=44 seq=3197614389 win=9999 ack=1068874505 SENT (7.1910s) TCP 192.168.1.101:39903 > 81.251.121.11:11523 S ttl=37 id=26184 iplen=60 seq=1068874505 win=2048 RCVD (7.2720s) TCP 81.251.121.11:11523 > 192.168.1.101:39903 SA ttl=20 id=0 iplen=44 seq=3187432317 win=9999 ack=1068874506 SENT (7.3020s) TCP 192.168.1.101:39904 > 81.251.121.11:11523 S ttl=42 id=18975 iplen=60 seq=1068874506 win=3072 RCVD (7.4010s) TCP 81.251.121.11:11523 > 192.168.1.101:39904 SA ttl=20 id=0 iplen=44 seq=3189470223 win=9999 ack=1068874507 SENT (7.4210s) TCP 192.168.1.101:39905 > 81.251.121.11:11523 S ttl=41 id=32660 iplen=60 seq=1068874507 win=2048 RCVD (7.5070s) TCP 81.251.121.11:11523 > 192.168.1.101:39905 SA ttl=20 id=0 iplen=44 seq=3195769028 win=9999 ack=1068874508 SENT (7.5320s) TCP 192.168.1.101:39906 > 81.251.121.11:11523 S ttl=57 id=48161 iplen=60 seq=1068874508 win=2048 RCVD (7.6120s) TCP 81.251.121.11:11523 > 192.168.1.101:39906 SA ttl=20 id=0 iplen=44 seq=3201314161 win=9999 ack=1068874509 SENT (7.6430s) TCP 192.168.1.101:39907 > 81.251.121.11:11523 S ttl=37 id=559 iplen=60 seq=1068874509 win=2048 RCVD (7.7240s) TCP 81.251.121.11:11523 > 192.168.1.101:39907 SA ttl=20 id=0 iplen=44 seq=3203461159 win=9999 ack=1068874510 Host 81.251.121.11 appears to be up ... good. Interesting ports on 81.251.121.11: PORT STATE SERVICE VERSION 11523/tcp open ssh OpenSSH 4.5 (protocol 2.0) Device type: web proxy|firewall|general purpose|broadband router Running: Blue Coat SGOS, Checkpoint Windows NT/2K/XP, IPCop Linux 2.4.X, Linux 1.X|2.4.X|2.6.X, OpenBSD 3.X, Sun Solaris 2.X|7, ZyXel ZyNOS OS details: BlueCoat SG4, Checkpoint SecurePlatform NG FP3, IPCop 1.4 - 1.4.6 Linux 2.4.2x-based firewall, Linux 1.3.20 (x86), Linux 2.4.20, Linux 2.4.20 - 2.4.22, Linux 2.6.10 - 2.6.11, OpenBSD 3.6 x86 with pf "scrub in all", Sun Solaris 2.5, 2.5.1, Sun Solaris 2.6 - 7 x86, ZyXel 944S Prestige router OS Fingerprint: TSeq(Class=RI%gcd=1%SI=2E0246%IPID=Z%TS=U) T1(Resp=N) T2(Resp=N) T3(Resp=N) T4(Resp=N) T5(Resp=N) T6(Resp=N) T7(Resp=N) PU(Resp=N) TCP Sequence Prediction: Class=random positive increments Difficulty=3015238 (Good luck!) IPID Sequence Generation: All zeros Final times for host: srtt: 101405 rttvar: 101405 to: 507025 Nmap finished: 1 IP address (1 host up) scanned in 7.788 seconds Raw packets sent: 23 (1900B) | Rcvd: 12 (685B