nmap alwys report "Host seems down."

postcd · 07-13-2016, 02:26 PM

Hello, nmap on Linux CentOS always report "Host seems down."

Quote:

# nmap ianfette.org;nmap ianfette.org -Pn;nmap -sP -vv --packet-trace google.com

Starting Nmap 5.51 ( http://nmap.org ) at 2016-07-13 15:22 EDT
Note: Host seems down. If it is really up, but blocking our ping probes, try -Pn
Nmap done: 1 IP address (0 hosts up) scanned in 0.49 seconds

Starting Nmap 5.51 ( http://nmap.org ) at 2016-07-13 15:22 EDT
Nmap done: 1 IP address (0 hosts up) scanned in 0.50 seconds

Starting Nmap 5.51 ( http://nmap.org ) at 2016-07-13 15:22 EDT
Warning: Hostname google.com resolves to 6 IPs. Using 64.233.185.102.
Initiating ARP Ping Scan at 15:22
Scanning google.com (64.233.185.102) [1 port]
SENT (0.0510s) ARP who-has 64.233.185.102 tell 127.0.0.1
SENT (0.2520s) ARP who-has 64.233.185.102 tell 127.0.0.1
Completed ARP Ping Scan at 15:22, 0.43s elapsed (1 total hosts)
Nmap scan report for google.com (64.233.185.102) [host down]
Other addresses for google.com (not scanned): 64.233.185.113 64.233.185.100 64.233.185.139 64.233.185.138 64.233.185.101
Read data files from: /usr/share/nmap
Note: Host seems down. If it is really up, but blocking our ping probes, try -Pn
Nmap done: 1 IP address (0 hosts up) scanned in 0.47 seconds
Raw packets sent: 2 (56B) | Rcvd: 0 (0B)

# ping ianfette.org -c2
PING ianfette.org (173.201.140.128) 56(84) bytes of data.
64 bytes from p3nlhg53c096.shr.prod.phx3.secureserver.net (173.201.140.128): icmp_seq=1 ttl=54 time=52.7 ms
64 bytes from p3nlhg53c096.shr.prod.phx3.secureserver.net (173.201.140.128): icmp_seq=2 ttl=54 time=52.6 ms

Please which commands should i do to discover cause?

TB0ne · 07-13-2016, 02:34 PM

Quote:

Originally Posted by postcd

Hello, nmap on Linux CentOS always report "Host seems down." Please which commands should i do to discover cause?

No idea, because you *STILL* provide next to no useful information when asking a question, despite being asked to repeatedly. You don't say what version/distro of Linux, what environment this is running in, etc.

There could be a thousand different things, depending on the environment, like firewalls, routers/switches, WAN interfaces, etc., that you've not said anything about. Since you can ping it, then (as the message TELLS YOU), the scan is being blocked. Whether that's by the remote server, firewall, selinux, iptables, router/switch we can't tell you. Ask your system administrator and your network administrator...they will be able to help.

You can read the man pages/docs on nmap. It is different by default, ping is ICMP, and nmap ping sends a syn package: try using the -PE, -PM, -PP flags to make it do an ICMP ping. Are you running this as root?

postcd · 07-14-2016, 12:38 AM

yes, if provided info. is not enough, let me know which additional commands i should execute.

TB0ne · 07-14-2016, 07:10 AM

Quote:

Originally Posted by postcd

yes, if provided info. is not enough, let me know which additional commands i should execute.

Again, you are missing the point. YOU need to provide the missing information. You STILL aren't answering the questions you were just asked, and you were handed something to try. Your response was to ask for yet MORE commands.

Try again.

Habitual · 07-14-2016, 01:01 PM

Quote:

Originally Posted by postcd

yes, if provided info. is not enough, let me know which additional commands i should execute.

Code:

nmap ianfette.org -Pn

You know where it said to "try -Pn" ?
Just a wild guess.

postcd · 07-19-2016, 10:41 AM

Ofcourse, i already tried -Pn but it says host is down while im sure it is up (can see ianfette.org webpage from my home computer), but from remote linux server it says down:

Quote:

# nmap ianfette.org -Pn -vv

Starting Nmap 5.51 ( http://nmap.org ) at 2016-07-19 11:38 EDT
Initiating ARP Ping Scan at 11:38
Scanning ianfette.org (173.201.140.128) [1 port]
Completed ARP Ping Scan at 11:38, 0.43s elapsed (1 total hosts)
Nmap scan report for ianfette.org (173.201.140.128) [host down]
Read data files from: /usr/share/nmap
Nmap done: 1 IP address (0 hosts up) scanned in 0.51 seconds
Raw packets sent: 2 (56B) | Rcvd: 0 (0B)

Please idea why down and how to fix? Thank you

TB0ne · 07-19-2016, 11:27 AM

Quote:

Originally Posted by postcd

Ofcourse, i already tried -Pn but it says host is down while im sure it is up (can see ianfette.org webpage from my home computer), but from remote linux server it says down:

Please idea why down and how to fix? Thank you

Yes, you were spoon-fed an answer in post #2...did you not read or understand it?

TB0ne · 07-19-2016, 11:28 AM

Quote:

Originally Posted by Habitual

Code:

nmap ianfette.org -Pn

You know where it said to "try -Pn" ?
Just a wild guess.

Good luck...I gave him the flags for nmap to use ICMP, and he's still asking...have also asked him for information, which is STILL missing. See any of the OP's other threads where such behavior is exhibited.

Habitual · 07-19-2016, 12:00 PM

Quote:

Originally Posted by postcd

Please idea why down and how to fix? Thank you

Fix? What "fix". 100 push ups, that's the fix.
Use another tool, like netcat (nc)

If you know the webpage is up, why not just nmap port 80 ?

ianfette.org / 173.201.140.128 / godaddy.com Address Space.
Maybe GoDaddy don't want you scanning 1000 ports unnecessarily on their IP?

See what UDP says:

Code:

sudo nmap 173.201.140.128 -sU -Pn -p 80

or use:

Code:

netcat -z -v ianfette.org 80
Connection to ianfette.org 80 port [tcp/http] succeeded!

Get you some!