Skip to content

won't resolve hostname if dns answer is big (no tcp re-query) #364

@mhlavink

Description

@mhlavink

Hi, one of our users found an issue in nmap, that it does not resolves hostname if dns answer is too big for udp payload.

Original report:
nmap is not able to resolve hostname if dns server reply is more than 512 bytes.nmap expects reply from dns server side in the form of UDP Packet but if size is more than 512 bytes then it is failed to process data so it is not able to resolve hostname.

Steps to Reproduce:

  1. Add the dummy entries in named zone configuration file to increase the size of packet
  2. Set localhost as nameserver in reosolv.conf
  3. Execute namp command nmap -O -T5
    It returns the line as "Nmap scan report for 10.65.2.210" No hostname is showing.
    In successful case it shows as "Nmap scan report for dhcp2-210..com (10.65.2.210)"

Actual results:
It is not returning hostname in case if dns packet reply size is more than 512 bytes.

Expected results:
It should send the query on tcp also in case if size is more than 512 bytes as glibc does in case of using --system-dns in nmap command

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions