Re: Nmap on Solaris 9 and Solaris 10 not working right? Going way too slow.

[doug () hcsw org]

On Thu, Aug 07, 2008 at 06:26:46PM +0000 or thereabouts, jayrhine () comcast net wrote:
> The Solaris machines go MUCH slower than the Linux 
> machines.  Note the the below issues only appear to occur with Syn and UDP 
> scans.  They do not appear to affect connect scans.

This sounds like a pcap buffering issue. Do your versions of solaris use
BPF or DLPI or ...? If BPF, it could be that putting the pcap descriptor
into BIOCIMMEDIATE mode would help:

http://seclists.org/nmap-dev/2007/q1/0174.html

If you could apply this patch

http://seclists.org/nmap-dev/2007/q1/att-0174/nmap-4_21ALPHA1-openbsd-performance_patch

removing the #ifdef OPENBSD and possibly changing the constant to
whatever is found in your /usr/include/net/bpf.h and then test the
performance, this would be a big help. One of the reasons why this
patch wasn't applied is that we weren't sure which systems it should
be used on.

Ideally tcpip.cc would #include <net/bpf.h> but I had problems
with redefining BPF structures when I tried this, hence the
hard-coded constant.

Doug

Attachment: signature.asc
Description: Digital signature

_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://SecLists.Org