1

I want to wake up and see the devices connected on my local network, using NMAP.

So I execute this command :

sudo nmap -sn -PU[7] -PE 10.11.204.1/24

(extract from the man page :

  • sn: Ping Scan - disable port scan
  • PS/PA/PU/PY[portlist]: TCP SYN/ACK, UDP or SCTP discovery to given ports
  • PE/PP/PM: ICMP echo, timestamp, and netmask request discovery probes)

So, NMAP finds perfectly devices. But lets say device A is found, if I disconnect A from the network (airplane mode), and execute the exact same NMAP command : NMAP will continue to find A. If I keep executing the command, A will be found as online ("Host is up (0.0047s latency).") during some time, and after 2/3 minutes it will not be found anymore by NMAP. And what is really strange is that I have information about latency overtime even when I have manually disconnected A.

It appears that there is somewhere a timeout, maybe the arp-timeout ? And one thing I dont understand, even if there is a timeout why does NMAP gives me a latency when A is physically disconnected ?

Thank you.

Improve this question
4
  • 1
    I suspect you aren't scanning the device you think you are.
    – Ryan Foley
    Aug 25, 2015 at 1:05
  • I am pretty sure I am. The fact that the device is removed after 1/2 minutes proves it.
    – phenetas
    Aug 25, 2015 at 1:54
  • Have you ever found a reason for this behavior?
    – Vladimir
    Feb 11, 2018 at 18:10
  • Hm, the same experience here today. For one particular IP address was nmap -sP scan telling 'Host is alive'. Does not matter if the network cable was in or out :( Any idea what's going wrong? Thanks.
    – user2194898
    Oct 5, 2022 at 9:16

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Browse other questions tagged or ask your own question.