312-50V9 · Question #67
From the two screenshots below, which of the following is occurring? First one: 1 [10.0.0.253]# nmap -sP 10.0.0.0/24 3 Starting Nmap 5 Host 10.0.0.1 appears to be up. 6 MAC Address…
The correct answer is A. 10.0.0.253 is performing an IP scan against 10.0.0.0/24, 10.0.0.252 is performing a port scan. The first screenshot shows nmap -sP (ping sweep) run from 10.0.0.253 across the /24 subnet to discover live hosts; the second shows nmap -sO (IP protocol scan) run from 10.0.0.252 against 10.0.0.2 to enumerate supported layer-3 protocols.
Question
From the two screenshots below, which of the following is occurring? First one:
1 [10.0.0.253]# nmap -sP 10.0.0.0/24 3 Starting Nmap 5 Host 10.0.0.1 appears to be up. 6 MAC Address: 00:09:5B:29:FD:96 (Netgear) 7 Host 10.0.0.2 appears to be up. 8 MAC Address: 00:0F:B5:96:38:5D (Netgear) 9 Host 10.0.0.4 appears to be up. 10 Host 10.0.0.5 appears to be up. 11 MAC Address: 00:14:2A:B1:1E:2E (Elitegroup Computer System Co.) 12 Nmap finished: 256 IP addresses (4 hosts up) scanned in 5.399 seconds Second one:
1 [10.0.0.252]# nmap -sO 10.0.0.2 3 Starting Nmap 4.01 at 2006-07-14 12:56 BST 4 Interesting protocols on 10.0.0.2:
5 (The 251 protocols scanned but not shown below are 6 in state: closed) 7 PROTOCOL STATE SERVICE 8 1 open icmp 9 2 open|filtered igmp 10 6 open tcp 11 17 open udp 12 255 open|filtered unknown 14 Nmap finished: 1 IP address (1 host up) scanned in 15 1.259 seconds 1 [10.0.0.253]# nmap -sP 1 [10.0.0.253]# nmap -sP
Options
- A10.0.0.253 is performing an IP scan against 10.0.0.0/24, 10.0.0.252 is performing a port scan
- B10.0.0.253 is performing an IP scan against 10.0.0.2, 10.0.0.252 is performing a port scan against
- C10.0.0.2 is performing an IP scan against 10.0.0.0/24, 10.0.0.252 is performing a port scan
- D10.0.0.252 is performing an IP scan against 10.0.0.2, 10.0.0.252 is performing a port scan against
How the community answered
(27 responses)- A78% (21)
- B4% (1)
- C7% (2)
- D11% (3)
Why each option
The first screenshot shows nmap -sP (ping sweep) run from 10.0.0.253 across the /24 subnet to discover live hosts; the second shows nmap -sO (IP protocol scan) run from 10.0.0.252 against 10.0.0.2 to enumerate supported layer-3 protocols.
The -sP flag instructs nmap to perform a ping-based host discovery sweep across 10.0.0.0/24, identifying which IP addresses are live - this is the IP scan originating from 10.0.0.253. The -sO flag instructs nmap to probe which IP protocols (ICMP=1, IGMP=2, TCP=6, UDP=17, etc.) are open or filtered on the target, functioning as a protocol-level scan run from 10.0.0.252 against 10.0.0.2.
The first scan targets the entire 10.0.0.0/24 range, not just 10.0.0.2, so 10.0.0.253 is not scanning only 10.0.0.2.
10.0.0.2 is the target of the second scan, not the scanner; the first scan originates from 10.0.0.253 as shown in the shell prompt.
The IP/host-discovery scan originates from 10.0.0.253 against the /24 range, not from 10.0.0.252 against 10.0.0.2.
Concept tested: Nmap ping sweep vs IP protocol scan flags
Source: https://nmap.org/book/man-host-discovery.html
Topics
Community Discussion
No community discussion yet for this question.