Telnet server on NETIO-230A crashes when doing a port scan with os detection on Telnet port 23

[pklaus]

An advanced style (OS detection) nmap portscan on telnet port 23 of the NETIO 230A makes the telnet server crash (not reachable anymore):

nmap -A -T4 -PN -p 23 192.168.1.4

recovery

The telnet server can be recovered: Just try to connect to the telnet port once (which will fail). The next time you attempt to the telnet port it is up again.

[pklaus]

still problems in v.2.31: you have to connect once, disconnect and connect again... as described under "recovery" in bug report

[pklaus]

This seems to be fixed for 2.33:

philipp@lion:~$ nmap -A -T4 -PN -p 1234 192.168.1.4

Starting Nmap 5.21 ( http://nmap.org ) at 2011-03-26 01:42 CET
Nmap scan report for 192.168.1.4
Host is up (0.0023s latency).
PORT     STATE SERVICE  VERSION
1234/tcp open  hotline?
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at http://www.insecure.org/cgi-bin/servicefp-submit.cgi :
SF-Port1234-TCP:V=5.21%I=7%D=3/26%Time=4D8D3681%P=x86_64-unknown-linux-gnu
SF:%r(NULL,22,"100\x20HELLO\x20CEC8E95D\x20-\x20KSHELL\x20V1\.2\r\n")%r(Ge
SF:tRequest,37,"100\x20HELLO\x20CEC8E95D\x20-\x20KSHELL\x20V1\.2\r\n502\x2
SF:0UNKNOWN\x20COMMAND\r\n")%r(GenericLines,22,"100\x20HELLO\x200867FCE9\x
SF:20-\x20KSHELL\x20V1\.2\r\n")%r(HTTPOptions,37,"100\x20HELLO\x20435C107A
SF:\x20-\x20KSHELL\x20V1\.2\r\n502\x20UNKNOWN\x20COMMAND\r\n")%r(RTSPReque
SF:st,37,"100\x20HELLO\x207E50240F\x20-\x20KSHELL\x20V1\.2\r\n502\x20UNKNO
SF:WN\x20COMMAND\r\n")%r(RPCCheck,22,"100\x20HELLO\x20B94437AA\x20-\x20KSH
SF:ELL\x20V1\.2\r\n")%r(DNSVersionBindReq,22,"100\x20HELLO\x20F4384B49\x20
SF:-\x20KSHELL\x20V1\.2\r\n")%r(DNSStatusRequest,22,"100\x20HELLO\x202F2C5
SF:EED\x20-\x20KSHELL\x20V1\.2\r\n")%r(Help,37,"100\x20HELLO\x206A20B597\x
SF:20-\x20KSHELL\x20V1\.2\r\n502\x20UNKNOWN\x20COMMAND\r\n")%r(SSLSessionR
SF:eq,39,"100\x20HELLO\x2005968352\x20-\x20KSHELL\x20V1\.2\r\n502\x20UNKNO
SF:WN\x20COMMAND\r\n\x20\x08")%r(SMBProgNeg,3D,"100\x20HELLO\x20408A97FD\x
SF:20-\x20KSHELL\x20V1\.2\r\n\x20\x08506\x20INPUT\x20LINE\x20TOO\x20LONG\r
SF:\n")%r(X11Probe,22,"100\x20HELLO\x207B7EABB8\x20-\x20KSHELL\x20V1\.2\r\
SF:n")%r(FourOhFourRequest,37,"100\x20HELLO\x20B672BF77\x20-\x20KSHELL\x20
SF:V1\.2\r\n502\x20UNKNOWN\x20COMMAND\r\n")%r(LPDString,37,"100\x20HELLO\x
SF:20F166D33C\x20-\x20KSHELL\x20V1\.2\r\n502\x20UNKNOWN\x20COMMAND\r\n")%r
SF:(LDAPBindReq,22,"100\x20HELLO\x20AE06E7B2\x20-\x20KSHELL\x20V1\.2\r\n")
SF:%r(SIPOptions,F4,"100\x20HELLO\x20E8FAFB81\x20-\x20KSHELL\x20V1\.2\r\n5
SF:02\x20UNKNOWN\x20COMMAND\r\n502\x20UNKNOWN\x20COMMAND\r\n502\x20UNKNOWN
SF:\x20COMMAND\r\n502\x20UNKNOWN\x20COMMAND\r\n502\x20UNKNOWN\x20COMMAND\r
SF:\n502\x20UNKNOWN\x20COMMAND\r\n502\x20UNKNOWN\x20COMMAND\r\n502\x20UNKN
SF:OWN\x20COMMAND\r\n502\x20UNKNOWN\x20COMMAND\r\n502\x20UNKNOWN\x20COMMAN
SF:D\r\n")%r(LANDesk-RC,22,"100\x20HELLO\x2023EF0F57\x20-\x20KSHELL\x20V1\
SF:.2\r\n")%r(TerminalServer,22,"100\x20HELLO\x205EE32332\x20-\x20KSHELL\x
SF:20V1\.2\r\n")%r(NCP,22,"100\x20HELLO\x2099D73711\x20-\x20KSHELL\x20V1\.
SF:2\r\n")%r(NotesRPC,22,"100\x20HELLO\x20D4CB4AF6\x20-\x20KSHELL\x20V1.2
SF:\r\n")%r(WMSRequest,3B,"100\x20HELLO\x200FC05EE0\x20-\x20KSHELL\x20V1\.
SF:2\r\n506\x20INPUT\x20LINE\x20TOO\x20LONG\r\n");

Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 116.36 seconds

After this port scan I could connect via telnet (netcat) immediately without problems.