Re: Problem while running nmap as root

[David Fifield <david () bamsoftware com>]

On Mon, Aug 09, 2010 at 12:21:15PM +0530, priyank garg wrote:
> Hi Tom,
> I tried scanning scanme.namp.org. I am able to do it as non-root user but
> when I do it as root, it says that host is not up. I don't know what is
> happening.
>
> ~Priyank
>
> On Fri, Aug 6, 2010 at 8:41 PM, Colin Beckingham <colbec () start ca> wrote:
>
> > I'm seeing this problem as well, OpenSuse 11.2 using kernel 2.6.35.
> >
> > Following command works fine as non-root but fails as root. Note I am
> > sending send-ip and debug is at 9.
> >
> > # nmap --send-ip -d9 -T4 -A -v -PE -PS22,25,80 -PA21,23,80,3389
> > 192.168.0.1/24
> >
> > Output is:
> >
> > ...
> > Initiating Ping Scan at 10:50
> > Scanning 101 hosts [8 ports/host]
> > pcap_open_live(eth0, 100, 0, 200) FAILED. Reported error: socket: Address
> > family not supported by protocol.  Will wait 5 seconds then retry.
> > pcap_open_live(eth0, 100, 0, 200) FAILED. Reported error: socket: Address
> > family not supported by protocol.  Will wait 25 seconds then retry.
> > Call to pcap_open_live(eth0, 100, 0, 200) failed three times. Reported
> > error: socket: Address family not supported by protocol
> > There are several possible reasons for this, depending on your operating
> > system:
> > LINUX: If you are getting Socket type not supported, try modprobe af_packet
> > or recompile your kernel with SOCK_PACKET enabled.
> > *BSD:  If you are getting device not configured, you need to recompile your
> > kernel with Berkeley Packet Filter support.  If you are getting No such file
> > or directory, try creating the device (eg cd /dev; MAKEDEV <device>; or use
> > mknod).
> > *WINDOWS:  Nmap only supports ethernet interfaces on Windows for most
> > operations because Microsoft disabled raw sockets as of Windows XP SP2.
> >  Depending on the reason for this error, it is possible that the
> > --unprivileged command-line argument will help.
> > SOLARIS:  If you are trying to scan localhost or the address of an
> > interface and are getting '/dev/lo0: No such file or directory' or 'lo0: No
> > DLPI device found', complain to Sun.  I don't think Solaris can support
> > advanced localhost scans.  You can probably use "-PN -sT localhost" though.
> >
> >
> > QUITTING!
> >
> > modprobe does not find af_packet.
> > Searching the kernel config for SOCK_PACKET comes up empty.

Send the output of these commands (as root):

nmap -n -sP -d3 scanme.nmap.org
nmap --iflist
nmap -V

David Fifield
_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://seclists.org/nmap-dev/