Skip to content

Skip directed-broadcast addresses silently in iteration mode - #6

Open
grisutheguru wants to merge 1 commit into
resurrecting-open-source-projects:masterfrom
grisutheguru:silent-skip-on-eacces
Open

Skip directed-broadcast addresses silently in iteration mode#6
grisutheguru wants to merge 1 commit into
resurrecting-open-source-projects:masterfrom
grisutheguru:silent-skip-on-eacces

Conversation

@grisutheguru

Copy link
Copy Markdown

Problem

When iterating a CIDR range, nbtscan sends a NetBIOS query to every address in the range, including the directed-broadcast (e.g. .255 for a /24). Without SO_BROADCAST set on the UDP socket, Linux rejects sendto() to such addresses with EACCES, which is surfaced as:

192.168.69.255	Sendto failed: Permission denied

The wording suggests a privileges problem and routinely sends users chasing sudo / setcap fixes that don't apply.

Fix

Treat EACCES from sendto() as a "skip this address silently" signal rather than print an error. Default iteration semantics are unchanged for all non-broadcast addresses.

Behaviour comparison

Before:

$ nbtscan 192.168.69.0/24
192.168.69.255	Sendto failed: Permission denied
Doing NBT name scan for addresses from 192.168.69.0/24

IP address       NetBIOS Name     Server    User             MAC address
------------------------------------------------------------------------------
192.168.69.2     S3E3             <server>  <unknown>        02:a0:79:49:24:95

After:

$ nbtscan 192.168.69.0/24
Doing NBT name scan for addresses from 192.168.69.0/24

IP address       NetBIOS Name     Server    User             MAC address
------------------------------------------------------------------------------
192.168.69.2     S3E3             <server>  <unknown>        02:a0:79:49:24:95

For ranges whose broadcast is not directly connected (e.g. nbtscan 192.168.68.0/23 from a host on 192.168.69.0/24), behaviour is unchanged: only the locally-connected .255 was raising EACCES, and that's the only address now being silently skipped.

Verified that the kernel mechanism is SO_BROADCAST

import socket
s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
s.sendto(b'test', ('192.168.69.255', 137))
# OSError: [Errno 13] Permission denied

s.setsockopt(socket.SOL_SOCKET, socket.SO_BROADCAST, 1)
s.sendto(b'test', ('192.168.69.255', 137))
# 4

Future work (separate PR)

An opt-in -B / --broadcast flag that sets SO_BROADCAST and sends a single query to the directed-broadcast of the input range (no iteration) would be a meaningful speedup for the common /24 case. Happy to follow up with a separate PR for that if this one lands.

When iterating a CIDR range (e.g. /24), nbtscan tries to sendto() every
address including the directed-broadcast (.255). Without SO_BROADCAST
on the socket, the Linux kernel rejects this with EACCES, which is
surfaced as the misleading "Sendto failed: Permission denied" error.
The wording suggests a privileges problem and routinely sends users
chasing sudo / setcap fixes that do not apply.

Treat EACCES from sendto as a "skip this address silently" signal
rather than print the error. Default iteration semantics for all other
addresses are unchanged. An explicit broadcast probe (single packet
with SO_BROADCAST set, opt-in via flag) would be a separate feature.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant