I have got a vps for test nmap over tor. I installed psad on the vps.
This is where 9050 port is listening (my desktop):
roto Recv-Q Send-Q Local Address Foreign Address State PID/Program
name
tcp 0 0 localhost:9050 0.0.0.0:* LISTEN -
tcp 0 0 host.****.****:40966 tor-proxy-03.for-p:9002 ESTABLISHED -
These are the nmap options I'm using:
sudo nmap --proxy socks4://127.0.0.1:9050 -sS -Pn 123.66.98.2 -p22,5555,6666,7777
note -Pn ( no icmp )
This is how I test my ip and it works
curl -x socks4://127.0.0.1:9050 ifconfig.io
this is what psad returns:
Mar 22 20:33:59 vm5656.server.net psad[14413]: src: 75.xx.xxx.2 signature match:
"P2P Napster Client Data communication attempt" (sid: 563) tcp port: 6666
Mar 22 20:33:59 vm5656.server.net psad[14413]: src: 75.xx.xxx.2 signature match:
"P2P Napster Client Data communication attempt" (sid: 564) tcp port: 5555
Mar 22 20:33:59 vm5656.server.net psad[14413]: src: 75.xx.xxx.2 signature match:
"P2P Napster Client Data communication attempt" (sid: 562) tcp port: 7777
Mar 22 20:33:59 vm5656.server.net psad[14413]: scan detected (Nmap -sT or -sS
scan): 75.xx.xxx.2 -> 123.66.98.2 tcp: [5555-7777] flags: SYN tcp pkts: 9 DL: 5
The psad can read my real ip 75.xx.xxx.2 and I don't understand maybe the wrong option on nmap Can yo help me ?Thanks