Sample Header Ad - 728x90

What's the differnce between "Connection timed out" v/s "No route to host" for ncat command?

0 votes
1 answer
544 views
I tried to use ncat command to 2 diff unknown IPs from a CENTOS 7 (linux) terminal.
[abc@localhost ~]$ ncat -zv 10.11.78.5 22
Ncat: Version 7.50 ( https://nmap.org/ncat  )
Ncat: No route to host.
[abc@localhost ~]$ ncat -zv 10.11.215.243 22
Ncat: Version 7.50 ( https://nmap.org/ncat  )
Ncat: Connection timed out.
In case case 1 , we I use tcpdump to see
10.11.77.147.22 > 10.11.236.41.55722: Flags [P.], cksum 0x4ef1 (incorrect -> 0xcc2c), seq 2565:2601, ack 1124, win 318, options [nop,nop,TS val 523166642 ecr 4195774342], length 36
13:57:39.271990 [SOURCE_MAC] > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 42: Ethernet (len 6), IPv4 (len 4), Request who-has 10.11.78.5 tell 10.11.77.147, length 28
13:57:39.272428 [SOURCE_MAC] > [DEST_MAC], ethertype IPv4 (0x0800), length 150: (tos 0x12,ECT(0), ttl 64, id 2262, offset 0, flags [DF], proto TCP (6), length 136)
    10.11.77.147.22 > 10.11.236.41.55722: Flags [P.], cksum 0x4f21 (incorrect -> 0x12b6), seq 2601:2685, ack 1124, win 318, options [nop,nop,TS val 523166656 ecr 4195774342], length 84
13:57:39.641351 [SRC_MAC] > [DEST_MAC], ethertype IPv4 (0x0800), length 66: (tos 0x48, ttl 58, id 0, offset 0, flags [DF], proto TCP (6), length 52)
    10.11.236.41.55722 > 10.11.77.147.22: Flags [.], cksum 0x580f (correct), ack 2601, win 2047, options [nop,nop,TS val 4195774724 ecr 523166642], length 0
13:57:39.641351 [SRC_MAC] > [DEST_MAC], ethertype IPv4 (0x0800), length 66: (tos 0x48, ttl 58, id 0, offset 0, flags [DF], proto TCP (6), length 52)
    10.11.236.41.55722 > 10.11.77.147.22: Flags [.], cksum 0x57ae (correct), ack 2685, win 2046, options [nop,nop,TS val 4195774724 ecr 523166656], length 0
13:57:40.272221 [SOURCE_MAC] > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 42: Ethernet (len 6), IPv4 (len 4), Request who-has 10.11.78.5 tell 10.11.77.147, length 28
In case case 2 , we I use tcpdump then I see:
15:27:20.847566 SRC_MAC > DEST_MAC, ethertype IPv4 (0x0800), length 102: (tos 0x4a,ECT(0), ttl 58, id 0, offset 0, flags [DF], proto TCP (6), length 88)
    10.11.236.41.56347 > 10.11.77.147.22: Flags [P.], cksum 0x3679 (correct), seq 3046:3082, ack 2950, win 2048, options [nop,nop,TS val 3721004625 ecr 528532842], length 36
15:27:20.860097 DEST_MAC > SRC_MAC, ethertype IPv4 (0x0800), length 102: (tos 0x12,ECT(0), ttl 64, id 35536, offset 0, flags [DF], proto TCP (6), length 88)
    10.11.77.147.22 > 10.11.236.41.56347: Flags [P.], cksum 0x0cb5 (correct), seq 2950:2986, ack 3082, win 318, options [nop,nop,TS val 528548224 ecr 3721004625], length 36
15:27:20.860124 DEST_MAC > SRC_MAC, ethertype IPv4 (0x0800), length 150: (tos 0x12,ECT(0), ttl 64, id 35537, offset 0, flags [DF], proto TCP (6), length 136)
    10.11.77.147.22 > 10.11.236.41.56347: Flags [P.], cksum 0xfd88 (correct), seq 2986:3070, ack 3082, win 318, options [nop,nop,TS val 528548231 ecr 3721004625], length 84
15:27:20.865395 DEST_MAC > SRC_MAC, ethertype IPv4 (0x0800), length 74: (tos 0x0, ttl 64, id 15451, offset 0, flags [DF], proto TCP (6), length 60)
    10.11.77.147.58106 > 10.11.215.243.22: Flags [S], cksum 0xcab1 (correct), seq 2395880917, win 29200, options [mss 1460,sackOK,TS val 528548238 ecr 0,nop,wscale 7], length 0
15:27:21.178240 SRC_MAC > DEST_MAC, ethertype IPv4 (0x0800), length 66: (tos 0x48, ttl 58, id 0, offset 0, flags [DF], proto TCP (6), length 52)
    10.11.236.41.56347 > 10.11.77.147.22: Flags [.], cksum 0x990d (correct), ack 2986, win 2047, options [nop,nop,TS val 3721004956 ecr 528548224], length 0
15:27:21.178240 SRC_MAC > DEST_MAC, ethertype IPv4 (0x0800), length 66: (tos 0x48, ttl 58, id 0, offset 0, flags [DF], proto TCP (6), length 52)
    10.11.236.41.56347 > 10.11.77.147.22: Flags [.], cksum 0x98b3 (correct), ack 3070, win 2046, options [nop,nop,TS val 3721004956 ecr 528548231], length 0
15:27:21.867037 DEST_MAC > SRC_MAC, ethertype IPv4 (0x0800), length 74: (tos 0x0, ttl 64, id 15452, offset 0, flags [DF], proto TCP (6), length 60)
    10.11.77.147.58106 > 10.11.215.243.22: Flags [S], cksum 0xc6c7 (correct), seq 2395880917, win 29200, options [mss 1460,sackOK,TS val 528549240 ecr 0,nop,wscale 7], length 0
15:27:23.870566 DEST_MAC > SRC_MAC, ethertype IPv4 (0x0800), length 74: (tos 0x0, ttl 64, id 15453, offset 0, flags [DF], proto TCP (6), length 60)
    10.11.77.147.58106 > 10.11.215.243.22: Flags [S], cksum 0x3aa9 (incorrect -> 0xbef3), seq 2395880917, win 29200, options [mss 1460,sackOK,TS val 528551244 ecr 0,nop,wscale 7], length 0
15:27:23.996114 SRC_MAC > DEST_MAC, ethertype IPv4 (0x0800), length 102: (tos 0xc0, ttl 58, id 50466, offset 0, flags [none], proto ICMP (1), length 88)
    10.11.26.4 > 10.11.77.147: ICMP host 10.11.215.243 unreachable, length 68
	(tos 0x0, ttl 57, id 15451, offset 0, flags [DF], proto TCP (6), length 60)
    10.11.77.147.58106 > 10.11.215.243.22: Flags [S], cksum 0xcaf6 (correct), seq 2395880917, win 29200, options [mss 1391,sackOK,TS val 528548238 ecr 0,nop,wscale 7], length 0
15:27:23.996114 SRC_MAC > DEST_MAC, ethertype IPv4 (0x0800), length 102: (tos 0xc0, ttl 58, id 50467, offset 0, flags [none], proto ICMP (1), length 88)
    10.11.26.4 > 10.11.77.147: ICMP host 10.11.215.243 unreachable, length 68
	(tos 0x0, ttl 57, id 15452, offset 0, flags [DF], proto TCP (6), length 60)
    10.11.77.147.58106 > 10.11.215.243.22: Flags [S], cksum 0xc70c (correct), seq 2395880917, win 29200, options [mss 1391,sackOK,TS val 528549240 ecr 0,nop,wscale 7], length 0
15:27:26.999948 SRC_MAC > DEST_MAC, ethertype IPv4 (0x0800), length 102: (tos 0xc0, ttl 58, id 50468, offset 0, flags [none], proto ICMP (1), length 88)
    10.11.26.4 > 10.11.77.147: ICMP host 10.11.215.243 unreachable, length 68
It starts from 10.xx so Private IPs. Also I've santised mac addresses for obv reasons. 1. Both IPs seem unreachable, but we have diff in output? 2. In one case we get ICMP packet while that is absent in other? 3. "Connection timed out" v/s "No route to host" 4. What more to search for the real cause? local host : 10.11.77.147
Asked by Ayush Raj (101 rep)
Jan 9, 2024, 04:30 PM
Last activity: Jan 9, 2024, 04:51 PM