Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

won't resolve hostname if dns answer is big (no tcp re-query) #364

mhlavink opened this issue Apr 14, 2016 · 1 comment


Copy link

commented Apr 14, 2016

Hi, one of our users found an issue in nmap, that it does not resolves hostname if dns answer is too big for udp payload.

Original report:
nmap is not able to resolve hostname if dns server reply is more than 512 bytes.nmap expects reply from dns server side in the form of UDP Packet but if size is more than 512 bytes then it is failed to process data so it is not able to resolve hostname.

Steps to Reproduce:

  1. Add the dummy entries in named zone configuration file to increase the size of packet
  2. Set localhost as nameserver in reosolv.conf
  3. Execute namp command nmap -O -T5
    It returns the line as "Nmap scan report for" No hostname is showing.
    In successful case it shows as "Nmap scan report for ("

Actual results:
It is not returning hostname in case if dns packet reply size is more than 512 bytes.

Expected results:
It should send the query on tcp also in case if size is more than 512 bytes as glibc does in case of using --system-dns in nmap command


This comment has been minimized.

Copy link

commented Apr 15, 2016

Reported earlier as #103. We added support for parsing truncated replies, which helps somewhat, but did not implement TCP fallback. The reverse DNS code in is quite modular, so it shouldn't be too difficult to implement this.

@nmap-bot nmap-bot closed this in 0c1d68d Jul 19, 2016
sergeykhegay added a commit to sergeykhegay/nmap that referenced this issue Jul 27, 2016
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
None yet
2 participants
You can’t perform that action at this time.