performance issues -- wtf

["Andy Lutomirski" <Luto () myrealbox com>]

Here's a good one:

I run nmap -sS -P0 -n -r -v -d -d -p1-1000 <win2k box on local ethernet>, and it takes awhile.  The debug shows that 
retries are needed.  If I add --scan_delay 1, no (or very few) packets are dropped, and the scan completes much faster. 
 I get the fastest results with --max_parallelism 1 (w/o scan_delay), but --max_parallelism 2 does not have nearly the 
same effect.

If I add --win_norawsock, then the speeds are much increased without either max_parallelism or scan_delay, for 
--max_parallelism 1 is still the fastest.

To add insult to injury, port 389 comes up filtered if and only if I do not set --win_nor (so that sends are over real 
raw sockets).

WTF is happening?

Andy Lutomirski