Guest User!

You are not Sophos Staff.

This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Nmap shows everything as up that's not on local network

My Sophos XG has 4 networks:

- 192.168.3.0/24: Guest network, variable devices

- 192.168.4.0/24: Internal net, at most 30 devices

- 192.168.5.0/24: Internal too, mostly VM's and 2 physical PC's

- 192.168.6.0/24: Test network, 0 IP's used besides the Sophos Interface on 192.168.6.1

 

I got a host on 192.168.5.7 which has Nmap installed.

I just performed a scan:

 

Test 1: Command: nmap -sn 192.168.5.0/24

Result: Nmap done: 256 IP addresses (9 hosts up) scanned in 2.32 seconds - This is correct.

 

Test 2: Command: nmap -sn 192.168.4.0/24

Result:  Nmap done: 256 IP addresses (253 hosts up) scanned in 1.36 seconds

 

 

Test 3: Command used:  nmap -sn 192.168.255.0/24

Result: Nmap done: 256 IP addresses (256 hosts up) scanned in 0.09 seconds 

 

How does this work? I have NO hosts on 192.168.255.0/24.. it's not even connected to the XG..

192.168.4.0/24 has 253 hosts up where there should be 20 at most.

 

The UTM 9 did NOT do this and would show hosts properly offline.

What does the Sophos XG do? reply for hosts that's not there? How can I disable this behaviour?

If I run nmap I want the honest results and see which hosts are available and which are not.



This thread was automatically locked due to age.
  • While running test 3 (or smaller subnet like 192.168.255.0/30) use tcpdump on both LAN and WAN interface to see what happens.
    Either XG or your ISP will send back RST packet, to get rid of connection you're trying to set up. 
    Nmap in turn assumes that IP is alive, but maybe nmap draws wrong conclusion....