Re: BUG: Unusual TCP Connect() results.

[Michal Schmidt <xschmi00@stud.feec.vutbr.cz>]

Alastair Poole wrote:
> I have tested various kernels including 2.6.11.10 2.6.11.11 and 
> 2.6.12-rc6 and am having unusual results regarding connect().  Earlier 
> kernels do not return the same strange results.

What is the last version that works as expected for you?

> I have tested numerous basic port scanners, including my own, and 
> strangely ports which are NOT open are being reported as open.  I have 
> checked these ports by various means -- to be certain they are NOT open 
> -- and in various runlevels; the results are the same.
> 
> The number of ports listed changes in size and they appear to be 
> random.  For example, on one scan ports 22, 3455, 4532 and 6236 will 
> appear open; on another scan it might be 22, 3567, 3879, 3889, 6589 and 
> 7374.
> However, ports which ARE open do also appear as open alongside these 
> "rogue" ports.  I have also tested this on another system with the same 
> results.  It is also interesting to note that a basic TCP nmap scan does 
> not return these unusual results.

Are you testing your scanner only on localhost? Maybe you are just lucky 
and connect your TCP socket to itself.

> Enclosed is example code that produces these results on the named 
> kernels and systems.
> [...]
> int
> main (int argc, char **argv)
> {
>  int sd, result, server_port;
>  *struct* hostent *he;
>  *struct* sockaddr_in servaddr;

What are these asterisks doing there? Next time when you copy&paste 
code, please make sure you don't mangle it.

Michal