eth0:1 and nmap?

I'm trying to troubleshoot a network, and ifconfig gave me a response
I've never seen:


eth0 Link encap:Ethernet HWaddr 00:01:03:34:6C:B4
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:34648 errors:0 dropped:0 overruns:1 frame:0
TX packets:21424 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:3085669 (2.9 Mb) TX bytes:3113240 (2.9 Mb)
Interrupt:10 Base address:0xec00

eth0:1 Link encap:Ethernet HWaddr 00:01:03:34:6C:B4
inet addr:192.168.238.60 Bcast:192.168.238.255
Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:34648 errors:0 dropped:0 overruns:1 frame:0
TX packets:21426 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:3085669 (2.9 Mb) TX bytes:3113572 (2.9 Mb)
Interrupt:10 Base address:0xec00


1) What does eth0:1 mean? Could it be ip aliasing? I'm running RH9 - a
stock kernel I believe, which I don't think has ip aliasing support
because its deprecated, but I'm not sure.

2) How can I fix nmap in this case:
/usr/local> nmap -p 389 192.168.238.61

Starting nmap V. 3.00 ( www.insecure.org/nmap/ )
Failed to lookup device subnet/netmask: eth0: no IPv4 address assigned
QUITTING!

/usr/local> nmap -e eth0:1 -p 389 192.168.238.61

Starting nmap V. 3.00 ( www.insecure.org/nmap/ )
I cannot figure out what source address to use for device eth0:1, does
it even exist?
QUITTING!

iksrazal

iksrazal <(E-Mail Removed)> wrote:
> I'm trying to troubleshoot a network, and ifconfig gave me a response
> I've never seen:
>
>
> eth0 Link encap:Ethernet HWaddr 00:01:03:34:6C:B4
> UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
> RX packets:34648 errors:0 dropped:0 overruns:1 frame:0
> TX packets:21424 errors:0 dropped:0 overruns:0 carrier:0
> collisions:0 txqueuelen:100
> RX bytes:3085669 (2.9 Mb) TX bytes:3113240 (2.9 Mb)
> Interrupt:10 Base address:0xec00
>
> eth0:1 Link encap:Ethernet HWaddr 00:01:03:34:6C:B4
> inet addr:192.168.238.60 Bcast:192.168.238.255
> Mask:255.255.255.0
> UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
> RX packets:34648 errors:0 dropped:0 overruns:1 frame:0
> TX packets:21426 errors:0 dropped:0 overruns:0 carrier:0
> collisions:0 txqueuelen:100
> RX bytes:3085669 (2.9 Mb) TX bytes:3113572 (2.9 Mb)
> Interrupt:10 Base address:0xec00

> 1) What does eth0:1 mean? Could it be ip aliasing?

It certainly does. Under IPv4, each interface can have only one address
attached to it. (IPv6 doesn't have this limitation). To get around this,
we make virtual interfaces, giving each one its own seperate address.

> 2) How can I fix nmap in this case:
> /usr/local> nmap -p 389 192.168.238.61
>
> Starting nmap V. 3.00 ( www.insecure.org/nmap/ )
> Failed to lookup device subnet/netmask: eth0: no IPv4 address assigned
> QUITTING!

You must assign eth0 an interface if you want to use it meaningfully,
otherwise the packets won't have a valid source address.

> /usr/local> nmap -e eth0:1 -p 389 192.168.238.61
>
> Starting nmap V. 3.00 ( www.insecure.org/nmap/ )
> I cannot figure out what source address to use for device eth0:1, does
> it even exist?

This is a bug. Report it.

You can work around it by telling nmap which source address to bind to,
by using the -S option.

--
Cameron Kerr
(E-Mail Removed) : http://nzgeeks.org/cameron/
Empowered by Perl!

On 18 May 2004 14:01:07 -0700, iksrazal <(E-Mail Removed)> wrote:
> I'm trying to troubleshoot a network, and ifconfig gave me a response
> I've never seen:
>
>
> eth0 Link encap:Ethernet HWaddr 00:01:03:34:6C:B4
> UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
> RX packets:34648 errors:0 dropped:0 overruns:1 frame:0
> TX packets:21424 errors:0 dropped:0 overruns:0 carrier:0
> collisions:0 txqueuelen:100
> RX bytes:3085669 (2.9 Mb) TX bytes:3113240 (2.9 Mb)
> Interrupt:10 Base address:0xec00
>
> eth0:1 Link encap:Ethernet HWaddr 00:01:03:34:6C:B4
> inet addr:192.168.238.60 Bcast:192.168.238.255
> Mask:255.255.255.0
> UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
> RX packets:34648 errors:0 dropped:0 overruns:1 frame:0
> TX packets:21426 errors:0 dropped:0 overruns:0 carrier:0
> collisions:0 txqueuelen:100
> RX bytes:3085669 (2.9 Mb) TX bytes:3113572 (2.9 Mb)
> Interrupt:10 Base address:0xec00
>
>
> 1) What does eth0:1 mean? Could it be ip aliasing? I'm running RH9 - a
> stock kernel I believe, which I don't think has ip aliasing support
> because its deprecated, but I'm not sure.

IP aliasing is not depreciated. What may be depreciated is having to add
it to the kernel, because I believe it is native now (always there). Why
are you using an alias without assigning an IP to eth0?

> 2) How can I fix nmap in this case:
> /usr/local> nmap -p 389 192.168.238.61
>
> Starting nmap V. 3.00 ( www.insecure.org/nmap/ )
> Failed to lookup device subnet/netmask: eth0: no IPv4 address assigned
> QUITTING!
>
> /usr/local> nmap -e eth0:1 -p 389 192.168.238.61

You might try -S which is just before -e in 'man nmap'.

--
David Efflandt - All spam ignored http://www.de-srv.com/