2

I've just stumbled upon something pretty weird, at least for me at this moment.
When i've finished setting up my openBSD 5.5 server, along with the isc-dhcp43-server port. I tried to see if i could find this service by doing a nmap-scan from a client.
But somehow the command listed below fails to find the open port (67), although the service is actually and providing ip-addresses.

Am i missing something here?

sudo nmap -Pn -p1-1024 [ip-address]



EDIT: I've also tried to scan the server using the -sU parameter, but even then it returns that the host is down. So i think it's safe to imply that finding a dhcp server does require to send out a dhcp-request packet, and that just port scanning doesn't suffice.

sudo nmap -Pn -sU -p1-1024 [ip-address]



Upon digging a bit deeper, i read that nmap should be able to send a dhcp-discover packet.
http://nmap.org/nsedoc/scripts/dhcp-discover.html

sudo nmap -Pn -sU -p1-1024 --script=dhcp-discover [ip-address] -vv

But on my system this returns the following error.
Unknown datalink type 138.

I will investigate this further tomorrow!

Improve this question

1 Answer 1

Reset to default
6

You're performing a SYN scan (the default when run as root) which only scans for TCP services. DHCP, on the other hand, is a UDP service, so will only be found with a UDP scan (-sU). Even then, it might not be found, as it is up to each application to respond to UDP packets, if it does not, then there will also be no response. This will lead to nmap giving the response "open|filtered", which means basically "the packet was not rejected". Alternatively, if an ICMP port unreachable message is received in response, nmap will mark the port "closed". Only if a response from the application is received (which most DHCP servers will not give to a UDP scan) will you get "open". See the NMAP documentation for details on port scanning techniques.

Improve this answer
2
  • So that basicly means an dhcpd server can't be detected by just port scanning, but requires being able to send a dhcp-request packet. Nice to know! :) Commented Nov 1, 2014 at 15:03
  • @DJake Lots of UDP services are like this, which is why Nmap sends appropriate payloads when possible during the port scan, in order to elicit a response: nmap.org/book/nmap-payloads.html Commented Nov 2, 2014 at 12:47

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.