search

robertdavidgraham / masscan

TCP port scanner, spews SYN packets asynchronously, scanning entire Internet in under 5 minutes.
GNU Affero General Public License v3.0
23.08k stars 3.03k forks source link

Log entries being omitted when multiple (non-range) ports specified. #10

Closed malevolm closed 10 years ago

malevolm commented 10 years ago

Target system 127.0.0.1 has ports 22 and 80 open.

./masscan -sS -p22,80 127.0.0.1

This only reports one of the open ports, where as

./masscan -sS --ports 22-80 127.0.0.1

reports both as open.

robertdavidgraham commented 10 years ago

I can reproduce. Working on fixing it now.

robertdavidgraham commented 10 years ago

Ok, problem is fixed. It was a bug in how I calculated the "increment" based on "shards". The way shards work is 1/2 and 2/2, rather than 0/2 and 1/2. Thus, I had an off-by-one error. Stupid and obvious :)

malevolm commented 10 years ago

I've recompiled, but still getting some inconsistencies. I don't know if this is just the price of a high PPS, but:

./masscan -sS -p80,22 88.45.209.90 Starting masscan 1.0 (http://bit.ly/14GZzcT) at 2013-09-19 04:48:41 GMT -- forced options: -sS -Pn -n --randomize-hosts -v --send-eth Initiating SYN Stealth Scan Scanning 1 hosts [2 ports/host] Discovered open port 80/tcp on 88.45.209.90

./masscan -sS -p22,80 88.45.209.90 Starting masscan 1.0 (http://bit.ly/14GZzcT) at 2013-09-19 04:48:33 GMT -- forced options: -sS -Pn -n --randomize-hosts -v --send-eth Initiating SYN Stealth Scan Scanning 1 hosts [2 ports/host] Discovered open port 80/tcp on 88.45.209.90 Discovered open port 22/tcp on 88.45.209.90

Sometimes no ports are discovered. Is this an inherent part of the scan? Would there be a better suited scan type for accuracy?

Also if I may make a request: could you group matching ports? For cases when you're only interested in machines with both ports open.