Use correct lengths for FQDN, not MAXHOSTNAMELEN #140

dmiller-nmap opened this Issue May 28, 2015 · 3 comments


None yet
1 participant

As defined in nbase.h (or in some system header file on Linux), MAXHOSTNAMELEN is 64. This is the maximum length of a hostname, but not of a DNS name, which may be longer. RFC 1035 spells out that DNS names are formed of labels, each of which must be 63 octets or less, and that labels are combined to form a DNS name (a.k.a. FQDN) which may not exceed 255 octets. Each label is length-prefixed, so the ASCII readable name may only be 253 characters.

Nmap currently uses MAXHOSTNAMELEN in some places where the 253-character length should be used instead. As a simple example (because has wildcard DNS), you can scan the 71-character DNS name "" with a short timeout to see that the message about "Skipping host due to host timeout" truncates the name at 64 characters:

$ nmap -p 80 --host-timeout 1ms -Pn

Starting Nmap 6.40 ( ) at 2015-05-28 18:32 UTC
Nmap scan report for (
Host is up (0.039s latency).
rDNS record for
Skipping host abcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyz0123456789.n due to host timeout
Nmap done: 1 IP address (1 host up) scanned in 0.08 seconds

Nmap also uses this length for the proxy host for Idle scan (-sI) and for the FTP server name for Bounce scan (-b). Nping uses MAXHOSTNAMELEN, but defines it to be 128. A more complete audit should probably be made.

Confirmed still a problem:

  1. const char *Target::NameIP() const in Example command: nmap -n -sL
  2. Example command: ./nmap -b
  3., in validation for -sI option, rejects longer DNS names. Example command: ./nmap -sI
  4., once you bypass the length validation above. Example command is same as the previous point.

Essentially, any time MAXHOSTNAMELEN is used to refer to or contain a DNS name, it is used incorrectly.

CC @w0nan0w


ghost commented Jul 20, 2016

Hello @dmiller-nmap, thank you for your observations, I opened a new PR (#462) which aims to fix this.
Waiting for your feedback,


ghost commented Jul 26, 2016

Hello @dmiller-nmap, I just pushed the commit for this issue. Let me know if something goes wrong. Thank you for your time,

nmap-bot closed this in 32efc8b Jul 26, 2016

@sergeykhegay sergeykhegay added a commit to sergeykhegay/nmap that referenced this issue Jul 27, 2016

@sergeykhegay vincent + sergeykhegay Use FQDN_LEN instead of MAXHOSTNAMELEN for DNS name buffers
This closes #140 (issue #140), namely "Use correct lengths 
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment