nmap not scanning networks?

[Chuck Swiger]

Alex Povolotsky wrote:
> Attempt to scan a network with any method except plain ping results in an error:
> 
> truss nmap -sT -p 21 '172.19.17.*'

I can confirm the problem, anyway, although I'm not sure it's germane to 
freebsd-security.  :-)

> [...]
> sendto(0x4,0x8094200,0,0x0,{ AF_INET 172.19.17.0:0 },0x10) ERR#49 'Can't assign 
> requested address'
> [...]
> 
> What's strange that man on send(2) doesn't state that EADDRNOTAVAIL can ever be returned from sendto().

nmap interprets the wildcard character in a network address to include the 
all-zeros "base network address" and the all-ones "network broadcast address". 
  I seem to recall that some systems won't let you send traffic to the 
all-zeros address which might explain the EADDRNOTAVAIL, although my 
explanation is not entirely satisfactory as there are still problems:

Consider trying "nmap -sT -p 21 '172.19.17.1-255'", only it results in similar 
behavior:

# nmap -sT -p 21 '10.1.1.1-10'

Starting nmap 3.50 ( http://www.insecure.org/nmap/ ) at 2004-06-16 14:29 EDT
sendto in send_ip_raw: sendto(4, packet, 28, 0, 10.1.1.1, 16) => Can't assign 
requested address
Sleeping 15 seconds then retrying

-- 
-Chuck

PS: I would suggest CC'ing the port maintainer of nmap about this and maybe 
moving the discussion to freebsd-ports...?