312-50V10 · Question #294
From the two screenshots below, which of the following is occurring? First one: 1 [10.0.0.253]# nmap -sP 10.0.0.0/24 3 Starting Nmap 5 Host 10.0.0.1 appears to be up. 6 MAC Address: 00:09:5B:29:FD:96
The correct answer is A. 10.0.0.253 is performing an IP scan against 10.0.0.0/24, 10.0.0.252 is performing a port scan. The first nmap command (-sP) is a ping/host-discovery scan of a full /24 subnet run from 10.0.0.253, while the second (-sO) is an IP protocol scan targeting a single host run from 10.0.0.252.
Question
From the two screenshots below, which of the following is occurring? First one:
1 [10.0.0.253]# nmap -sP 10.0.0.0/24 3 Starting Nmap 5 Host 10.0.0.1 appears to be up. 6 MAC Address: 00:09:5B:29:FD:96 (Netgear) 7 Host 10.0.0.2 appears to be up. 8 MAC Address: 00:0F:B5:96:38:5D (Netgear) 9 Host 10.0.0.4 appears to be up. 10 Host 10.0.0.5 appears to be up. 11 MAC Address: 00:14:2A:B1:1E:2E (Elitegroup Computer System Co.) 12 Nmap finished: 256 IP addresses (4 hosts up) scanned in 5.399 seconds Second one:
1 [10.0.0.252]# nmap -sO 10.0.0.2 3 Starting Nmap 4.01 at 2006-07-14 12:56 BST 4 Interesting protocols on 10.0.0.2:
5 (The 251 protocols scanned but not shown below are 6 in state: closed) 7 PROTOCOL STATE SERVICE 8 1 open icmp 9 2 open|filtered igmp 10 6 open tcp 11 17 open udp 12 255 open|filtered unknown 14 Nmap finished: 1 IP address (1 host up) scanned in 15 1.259 seconds 1 [10.0.0.253]# nmap -sP 1 [10.0.0.253]# nmap -sP
Options
- A10.0.0.253 is performing an IP scan against 10.0.0.0/24, 10.0.0.252 is performing a port scan
- B10.0.0.253 is performing an IP scan against 10.0.0.2, 10.0.0.252 is performing a port scan against
- C10.0.0.2 is performing an IP scan against 10.0.0.0/24, 10.0.0.252 is performing a port scan
- D10.0.0.252 is performing an IP scan against 10.0.0.2, 10.0.0.252 is performing a port scan against
How the community answered
(36 responses)- A75% (27)
- B8% (3)
- C3% (1)
- D14% (5)
Why each option
The first nmap command (-sP) is a ping/host-discovery scan of a full /24 subnet run from 10.0.0.253, while the second (-sO) is an IP protocol scan targeting a single host run from 10.0.0.252.
The command 'nmap -sP 10.0.0.0/24' issued from 10.0.0.253 performs a ping scan (IP/host discovery) across the entire /24 subnet, and 'nmap -sO 10.0.0.2' issued from 10.0.0.252 performs an IP protocol scan that identifies which layer-4 protocols (ICMP, IGMP, TCP, UDP, etc.) are open on 10.0.0.2 - the source hosts, target scopes, and scan types in option A match the output exactly.
The first scan targets the entire 10.0.0.0/24 subnet, not just 10.0.0.2 as this option incorrectly states, misrepresenting the scope of the -sP command.
The subnet scan originates from 10.0.0.253 (the host issuing the first nmap command), not from 10.0.0.2, which is merely one of the discovered targets.
This option attributes both scans to 10.0.0.252, but the first nmap command was clearly executed from the prompt at 10.0.0.253, not 10.0.0.252.
Concept tested: Nmap -sP ping scan vs -sO IP protocol scan identification
Source: https://nmap.org/book/man-port-scanning-techniques.html
Topics
Community Discussion
No community discussion yet for this question.