Re: massping migration and you

[David Fifield <david () bamsoftware com>]

On Thu, Aug 30, 2007 at 05:52:30AM +0000, Brandon Enright wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> I apologize for replying to my own post.  I was not able to reproduce the
> bug on a second run with the same options.  I'll keep trying.
>
> The results for the two scans this time around were:
>
> Pre-migration (svn from a few days ago):
>
> Nmap finished: 186336 IP addresses (11600 hosts up) scanned in 1330.331
> seconds
>
> real    22m10.338s
> user    0m8.086s
> sys     0m40.785s
>
> Post-migration:
>
> Nmap done: 186336 IP addresses (11554 hosts up) scanned in 9040.909 seconds
>
> real    150m40.914s
> user    21m38.227s
> sys     2m26.036s

Wow, that's alarming. Your scan is one I would expect the migrated host
discovery to do well at. Although I've never tested it on such a large
group of hosts.

Can you send me the times from scanning just one of your /16 address
spaces? Maybe there's something that's making the scan scale
non-linearly. Also, please try it again with -T4. That increases the
congestion window recovery speed, which will help if you're getting lots
of drops.

ultra_scan is much more cautious in the face of drops than massping was.
Are you getting many? You can find out by running with -d2 and grepping
the log file for "DROPPED".

Thanks for testing!

David

_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://SecLists.Org