nmap scan memory footprint grows without bound

["Carlson, Scott" <Scott.Carlson () schwab com>]

Hello,
 
I recently did some scanning of my entire 10.0.0.0/8 network in search of
web servers and found that the the nmap 3.75 memory footprint grew without
bounds and eventually nmap ran the box out of memory!  Quite a bit of my
10.0 space is not-used, and I noticed that this memory footprint grew more
as it didn't find stuff.  Any thoughts?  Is this because the hosts that
don't exist are never timed out?
 
Here's as much data as I have.
 
Scan's that I had to run because it kept dying:
 
nmap -v -v -d -d -d -pT:80 -T5 -n -oG port80_scan --append_output 10.0.0.0/8
nmap -v -v -d -d -d -pT:80 -T5 -n -oG port80_scan --append_output
10.28-.0-.0-
nmap -v -v -d -d -d -pT:80 -T5 -n -oG port80_scan --append_output
10.96-.0-.0-
nmap -v -v -d -d -d -pT:80 -T5 -n -oG port80_scan --append_output
10.151-.0-.0-
nmap -v -v -d -d -d -pT:80 -T5 -n -oG port80_scan --append_output
10.246-.0-.0-

 
My Box:
RHAS 3.0 Enterprise, Compaq DL380, 4 GB RAM
 
Linux XXXXXXX 2.4.21-15.ELsmp #1 SMP Thu Apr 22 00:18:24 EDT 2004 i686 i686
i386 GNU/Linux

 
 
--------------------------------------------------------------------
> From part of the run over the weekend
-------------------------------------------------------------------
Mem:  4120240k av, 3656812k used,  463428k free,       0k shrd,  240092k
buff
                   2654836k actv,  560616k in_d,    5168k in_c
Swap: 2097144k av,       0k used, 2097144k free                  906972k
cached
 
  PID USER     PRI  NI  SIZE  RSS SHARE STAT %CPU %MEM   TIME CPU COMMAND
20351 root      15   0 2080M 2.0G  1016 S     0.6 51.7  14:31   2 nmap
    1 root      15   0   512  512   452 S     0.0  0.0   2:01   2 init
 
 
 
Mem:  4120240k av, 3897764k used,  222476k free,       0k shrd,  240092k
buff
                   2892880k actv,  561940k in_d,    5168k in_c
Swap: 2097144k av,       0k used, 2097144k free                  908556k
cached
 
  PID USER     PRI  NI  SIZE  RSS SHARE STAT %CPU %MEM   TIME CPU COMMAND
20351 root      15   0 2313M 2.3G  1016 R     0.3 57.4  15:41   1 nmap
    1 root      15   0   512  512   452 S     0.0  0.0   2:01   0 init
 
---------------------------------------
> From a little bit today.
---------------------------------------
  PID USER     PRI  NI  SIZE  RSS SHARE STAT %CPU %MEM   TIME CPU COMMAND
32307 root      15   0  241M 241M  1012 S     0.4  6.0   1:15   0 nmap
32307 root      15   0  243M 243M  1012 S     0.1  6.0   1:15   2 nmap
32307 root      15   0  249M 249M  1012 S     0.4  6.1   1:18   0 nmap
32307 root      15   0  254M 254M  1012 S     0.1  6.3   1:19   0 nmap
32307 root      15   0  287M 287M  1012 S     0.2  7.1   1:29   2 nmap
32307 root      15   0  304M 304M  1012 S     1.4  7.5   1:33   0 nmap
32307 root      15   0  313M 313M  1012 S     0.2  7.7   1:34   2 nmap
32307 root      15   0  340M 340M  1012 S     1.6  8.4   1:42   0 nmap
32307 root      15   0  354M 354M  1012 S     0.2  8.7   1:44   0 nmap
32307 root      15   0  362M 362M  1012 S     0.4  9.0   1:46   2 nmap
32307 root      15   0  367M 367M  1012 S     0.2  9.1   1:47   1 nmap
32307 root      15   0  380M 380M  1012 S     2.9  9.4   1:51   2 nmap

Can anyone recommend scan parameters or is there any more data needed so I
can continue my scanning without having to worry about my scan dying all the
time?
 
Thanks much!
Scott Carlson
s <mailto:scott.carlson () schwab com> cott.carlson () schwab com


Warning: All email sent to this address will be received by the Charles
Schwab email system and is subject to Archival and review by someone other
than the recipient