312-50V11 · Question #294
From the two screenshots below, which of the following is occurring? First one: 1 [10.0.0.253]# nmap -sP 10.0.0.0/24 3 Starting Nmap 5 Host 10.0.0.1 appears to be up. 6 MAC Address…
The correct answer is A. 10.0.0.253 is performing an IP scan against 10.0.0.0/24, 10.0.0.252 is performing a port scan. The first nmap command performs a ping sweep across an entire subnet to discover live hosts, while the second performs an IP protocol scan against a single target to identify which layer-3 protocols it supports.
Question
From the two screenshots below, which of the following is occurring? First one:
1 [10.0.0.253]# nmap -sP 10.0.0.0/24 3 Starting Nmap 5 Host 10.0.0.1 appears to be up. 6 MAC Address: 00:09:5B:29:FD:96 (Netgear) 7 Host 10.0.0.2 appears to be up. 8 MAC Address: 00:0F:B5:96:38:5D (Netgear) 9 Host 10.0.0.4 appears to be up. 10 Host 10.0.0.5 appears to be up. 11 MAC Address: 00:14:2A:B1:1E:2E (Elitegroup Computer System Co.) 12 Nmap finished: 256 IP addresses (4 hosts up) scanned in 5.399 seconds Second one:
1 [10.0.0.252]# nmap -sO 10.0.0.2 3 Starting Nmap 4.01 at 2006-07-14 12:56 BST 4 Interesting protocols on 10.0.0.2:
5 (The 251 protocols scanned but not shown below are 6 in state: closed) 7 PROTOCOL STATE SERVICE 8 1 open icmp 9 2 open|filtered igmp 10 6 open tcp 11 17 open udp 12 255 open|filtered unknown 14 Nmap finished: 1 IP address (1 host up) scanned in 15 1.259 seconds 1 [10.0.0.253]# nmap -sP 1 [10.0.0.253]# nmap -sP
Options
- A10.0.0.253 is performing an IP scan against 10.0.0.0/24, 10.0.0.252 is performing a port scan
- B10.0.0.253 is performing an IP scan against 10.0.0.2, 10.0.0.252 is performing a port scan against
- C10.0.0.2 is performing an IP scan against 10.0.0.0/24, 10.0.0.252 is performing a port scan
- D10.0.0.252 is performing an IP scan against 10.0.0.2, 10.0.0.252 is performing a port scan against
How the community answered
(67 responses)- A73% (49)
- B7% (5)
- C16% (11)
- D3% (2)
Why each option
The first nmap command performs a ping sweep across an entire subnet to discover live hosts, while the second performs an IP protocol scan against a single target to identify which layer-3 protocols it supports.
Host 10.0.0.253 runs `nmap -sP 10.0.0.0/24`, which is a ping scan that sweeps all 256 addresses in the subnet and reports which hosts are up - this is an IP or host discovery scan. Host 10.0.0.252 runs `nmap -sO 10.0.0.2`, which is an IP protocol scan that probes the target to determine which IP protocols (ICMP=1, IGMP=2, TCP=6, UDP=17) are open or filtered, functioning as a protocol-level port scan equivalent.
The first scan targets the entire /24 subnet (10.0.0.0/24), not just the single host 10.0.0.2 as this choice states.
The ping sweep in the first screenshot originates from 10.0.0.253, not from 10.0.0.2, which is merely a discovered host in the results.
The IP discovery scan originates from 10.0.0.253, not 10.0.0.252; attributing both scans to 10.0.0.252 contradicts the source addresses shown in the screenshots.
Concept tested: Nmap ping sweep vs IP protocol scan flag identification
Source: https://nmap.org/book/man-host-discovery.html
Topics
Community Discussion
No community discussion yet for this question.