MAC address is shown on port scan

hywaydave · 02-11-2005, 01:45 PM

When I perform a portscan on my FreeBSD box using nmap on my linux box it comes back with the ports that are open along with the MAC address of the NIC.

When I portscan my linux box it doesn't return the MAC address. Is there something I need to configure on my BSD machine so that it does not report this? Or is this even necessary? Thanks.

frob23 · 02-11-2005, 01:49 PM

On the local network this is really not needed. You can get the MAC address for any box by just using the arp command. All you have to do is communicate with the machine in some way (nmap would work) and then use the arp command.

hywaydave · 02-11-2005, 03:17 PM

what I was wondering if it was not necessary to prevent this information from showing up when someone does a port scan from the internet. This is used as a web server.

frob23 · 02-11-2005, 08:50 PM

Quote:

From the CVS commit list for nmap.
Added MAC address printing. If Nmap receives packet from a target machine which is on an Ethernet segment directly connected to the scanning machine, Nmap will print out the target MAC address. Nmap also now contains a database (derived from the official IEEE version) which it uses to determine the vendor name of the target ethernet interface.

This is not a characteristic of FreeBSD. It is a function of the version of nmap you have installed on Linux as compared to the one on FreeBSD (and/or their defaults). This is also obvious because ports do not return anything like a MAC address in their packets... so this isn't something you could configure on FreeBSD.

Further, when the computers are not on the same Ethernet as the scanning computer... this information is unavailable -- which is why nmap can't return it.