knx-gateway-info.nse scans default port 3671 only about nmap-scripts HOT 4 CLOSED

This is not related to the NSE script but rather a property of Nmap. Nmap has a "special" feature for this, here is a quote from the Nmap manpage (man 1 nmap):

There are two special features for advanced users only. One is to prefix script names and expressions with + to force them to run even if they normally wouldn't (e.g. the relevant service wasn't detected on the target port).

So for your example you could run:

nmap -sU -p8888 --script +knx-gateway-info.nse 8.8.8.8

This should then run the script also on UDP port 8888.

from nmap-scripts.

Thank you for explanations! Yes, "+knx-gateway-info.nse" works with one port number. Should it works with port range? If I run "nmap -v -sU -p3600-3700 --script +knx-gateway-info.nse 192.168.88.212" it doesn't detect KNX gateway in local net:

from nmap-scripts.

AFAIK it should also work for port ranges. However, I guess it will only run on ports that Nmap found to be open. As this is UDP I'm not really sure how reliable this would be for large port ranges. I think using NSE scripts for large port ranges with UDP is not the best way to tackle this task.

The better solution will (hopefully) soon be available in Nmap: a service probe for KNXnet/IP. This will allow to detect gateways even faster and more reliable (as reliable as it gets with UDP..). I've submitted it to Nmap and I hope that it will be included in the next few days. But you could use the patch from the mailinglist to already test it.

from nmap-scripts.

Thanks agian! It's clear. I close this issue.

from nmap-scripts.