massping issue

[Justin Azoff <JAzoff () uamail albany edu>]

Hi, since upgrading from debian etch nmap to debian lenny nmap (4.11 to
4.62) I noticed that a script that runs a ping scan across our /16
stopped finding 90% of the hosts.

The command ran is simply:
nmap --host_timeout 2000 -n -sP -PE a.b.0.0/16

The highest latency on the network is under 100ms, so 2000 should be
more than high enough to find everything.

I used git bisect against git://git.debian.org/~lamont/nmap.git to track
this down to a commit, and the result was

d37f15389455ff474c00223cbf18be4117cedd76.

which corresponds to '4.22SOC6'

The changelog for that says:

+o Included David's major massping migration project.  The same
+  underlying engine is now uses for ping scanning as for port
+  scanning.  We hope this will lead to better performance and
+  accuracy, as well as helping to de-bloat Nmap.  Please test it out
+  and report your results to nmap-dev!  For more details, see
+  http://seclists.org/nmap-dev/2007/q3/0277.html

the test I ran was:

time sudo nmap --host_timeout 2000 -n -sP -PE a.b.0.0/16 -oG - | grep
'Status: Up' -c

I verified that with the previous rev
(f501df2e2a74f0bc8ce35a9ddc67d6864afddf96) the results are:
num: 3868
time: 9:36

with d37f15389455ff474c00223cbf18be4117cedd76 the results are:
num: 291
time: 1:11

so it runs in 1/10th the time, but finds 1/10th the hosts.

I also tested this with nmap-4.85BETA7:
num: 376
time: 0:39

and svn HEAD:
num: 351
time: 0:40

As a workaround I changed the timeout to 30000.  That finds the expected
number of hosts, and runs in about 13 minutes.

Tests were ran on linux 2.6.26.

-- 
- Justin

_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://SecLists.Org