Options Folder Page
The options page lets you choose general nmap options. The following picture shows a screenshot
of the options page:

General Options
The following general options can be selected:
- Fragmentation: This option causes the requested SYN, FIN, XMAS, or
NULL scan to use tiny fragmented IP packets. The
idea is to split up the TCP header over several
packets to make it harder for packet filters,
intrusion detection systems, and other annoyances
to detect what you are doing. Be careful with this!
Some programs have trouble handling these tiny
packets. My favorite sniffer segmentation faulted
immediately upon receiving the first 36-byte frag
ment. After that comes a 24 byte one! While this
method won't get by packet filters and firewalls
that queue all IP fragments (like the CON
FIG_IP_ALWAYS_DEFRAG option in the Linux kernel),
some networks can't afford the performance hit this
causes and thus leave it disabled.
Note that I do not yet have this option working on
all systems. It works fine for my Linux, FreeBSD,
and OpenBSD boxes and some people have reported
success with other *NIX variants.
- Get Identd Info: This turns on TCP reverse ident scanning. As noted
by Dave Goldsmith in a 1996 Bugtraq post, the ident
protocol (rfc 1413) allows for the disclosure of
the username that owns any process connected via
TCP, even if that process didn't initiate the con
nection. So you can, for example, connect to the
http port and then use identd to find out whether
the server is running as root. This can only be
done with a full TCP connection to the target port
(i.e. the -sT scanning option). When -I is used,
the remote host's identd is queried for each open
port found. Obviously this won't work if the host
is not running identd.
- Resolve All: Tells Nmap to always do reverse DNS resolution on
the target IP addresses. Normally this is only
done when a machine is found to be alive.
- Don't resolve: Tells Nmap to never do reverse DNS resolution on
the active IP addresses it finds. Since DNS is
often slow, this can help speed things up.
- Fast Scan: Specifies that you only wish to scan for ports
listed in the services file which comes with nmap
(or the protocols file for -sO). This is obviously
much faster than scanning all 65535 ports on a
host.
- OS Detection: This option activates remote host identification
via TCP/IP fingerprinting. In other words, it uses
a bunch of techniques to detect subtleties in the
underlying operating system network stack of the
computers you are scanning. It uses this informa
tion to create a 'fingerprint' which it compares
with its database of known OS fingerprints (the
nmap-os-fingerprints file) to decide what type of
system you are scanning.
If Nmap is unable to guess the OS of a machine, and
conditions are good (eg at least one open port),
Nmap will provide a URL you can use to submit the
fingerprint if you know (for sure) the OS running
on the machine. By doing this you contribute to
the pool of operating systems known to nmap and
thus it will be more accurate for everyone. Note
that if you leave an IP address on the form, the
machine may be scanned when we add the fingerprint
(to validate that it works).
The -O option also enables several other tests.
One is the "Uptime" measurement, which uses the TCP
timestamp option (RFC 1323) to guess when a machine
was last rebooted. This is only reported for
machines which provide this information.
Another test enabled by -O is TCP Sequence
Predictability Classification. This is a measure
that describes approximately how hard it is to
establish a forged TCP connection against the
remote host. This is useful for exploiting source-
IP based trust relationships (rlogin, firewall fil
ters, etc) or for hiding the source of an attack.
The actual difficulty number is based on statisti
cal sampling and may fluctuate. It is generally
better to use the English classification such as
"worthy challenge" or "trivial joke". This is only
reported in normal output with -v.
When verbose mode (-v) is on with -O, IPID Sequence
Generation is also reported. Most machines are in
the "incremental" class, which means that they
increment the "ID" field in the IP header for each
packet they send. This makes them vulnerable to
several advanced information gathering and spoofing
attacks.
- Random Host: This option tells Nmap to generate its own hosts to
scan by simply picking random numbers :). It will
never end. This can be useful for statistical sam
pling of the Internet to estimate various things.
If you are ever really bored, try nmap -sS -iR -p
80 to find some web servers to look at.
Debug Options
The following debug options can be selected:
- Debug: Writes debug output to the log screen.
- Verbose: This is a highly recommended option
and it gives out more information about what is
going on. You can use it twice for greater effect.
Use Debug a couple of times if you really want to get
crazy with scrolling the screen!Writes debug output to the log screen.
- Very Verbose: Even more verbose output.
Copyright © JV Software