Re: Nmap on Solaris 9 and Solaris 10 not working right? Going way too slow.

[jayrhine () comcast net]

> The most accurate way to tell which nmap is using is to go into
> its libpcap directory and ./configure :

Okay, its definately running DLPI.

> When you get a chance could you put this code snippet where
> my OpenBSD patch went in tcpip.cc? It's an *untested*
> modification of the code from the above message:

Okay, I applied this patch and it made a major difference. Its still not as fast as linux, but it is much faster.  

For comparison I've scanned an old Solaris 7 host (good for speed tests because it has 0 tcp rate limiting, and udp 
rate limiting can be disabled).  

Linux Nmap doing a complete TCP Scan (0-65535) - 1.1 seconds
Linux Nmap doing a complete UDP Scan (0-65535) - 1.2 seconds

Solaris Nmap doing a complete TCP Scan (0-65535) - 20 seconds
Solaris Nmap doing a complete UDP Scan (0-65535) - 91 seconds

For more comparision, I've also Scanning against a Solaris 10 host (where you cannot completely disable tcp rate 
limiting)

Linux Nmap doing a complete TCP Scan (0-65535) - 45 seconds
Linux Nmap doing a complete UDP Scan (0-65535) - 1.6 seconds

Solaris Nmap doing a complete TCP Scan (0-65535) - 48 seconds
Solaris Nmap doing a complete UDP Scan (0-65535) - 95 seconds

I did not notice substancial CPU usage during the scan, so I do not think this is a factor.  However, the Linux machine 
is more powerful than the Solaris one.  So my conclusion is that your patch results in a really substancial performance 
improvement, but clearly there is something that is still slowing it down relative to Linux.  


> Some header files might need to be #included too.. Possibly one
> or more of these:

It turns out I needed to include the following line:

#include "sys/bufmod.h"

_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://SecLists.Org