Re: nmap looping (3.96BETA1)

[Michael Hornung <hornung () cac washington edu>]

I compiled 3.999 and was able to reproduce this problem.

-Mike

On Thu, 26 Jan 2006 at 12:14, Michael Hornung wrote:

|I am experiencing a reproducible but not consistent problem running 3.96BETA1
|that I never experienced with prior releases, and I believe it is related to
|the new max_retries option.  This is on i386 Linux 2.4. When I initiate single
|scan instances, it has worked fine so far.  On one project, though, I'm running
|about 50 instances of nmap in parallel, each with the same arguments.  Only
|occasionally will one of the processes continue running and never quit when it
|should.
|
|Nmap was compiled with Martin's rate limit patch, and configured with:
|
|       ./configure --without-nmapfe
|
|I run the scans, one per host, like:
|
|nmap -PE -sS -O -T4 --min_parallelism 70 --max_parallelism 200   \
|--initial_rtt_timeout 100 --max_rtt_timeout 100 --osscan_limit   \
|--max_retries 3 --datadir /home/hornung/nmap/src/nmap-3.96BETA1  \
|-vv -d9 xx.yy.zz.73
|
|What I will find on occasion (and can reproduce with some success if I fire up
|several parallel scan instances) is that nmap eventually prints:
|
|       Warning: Finishing early because retransmission cap hit.
|
|But then it continues doing something, and the process does not quit, and thus
|the results are never printed.  Looking at the debugging output, eventually
|nmap is just printing this over and over again:
|
|**TIMING STATS**: IP, probes
|active/freshportsleft/retry_stack/outstanding/retra
|nwait/onbench, cwnd/ccthresh/delay, timeout/srtt/rttvar/
|   Groupstats (1/1 incomplete): 0/*/*/*/*/* 70.00/2/* 100000/462/114
|   xx.yy.zz.73: 0/0/1124/0/0/0 70.00/2/5 100000/462/114
|
|The number of probes on the retry stack never decrease or time out.  I have a
|core dump and a ~39MB log of that scan (until I sent it a SIGQUIT) if it would
|be helpful to see those.
|
|Or should I try getting 3.999 to compile (though I had trouble with libpcre
|this morning) and see if it can be reproduced with that?  Either way, would
|other information be helpful in untangling this?  Thanks.
|
|-Mike Hornung
|


_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev