Re: Problem while running nmap as root

[Colin Beckingham <colbec () start ca>]

I'm seeing this problem as well, OpenSuse 11.2 using kernel 2.6.35.

Following command works fine as non-root but fails as root. Note I am 
sending send-ip and debug is at 9.

# nmap --send-ip -d9 -T4 -A -v -PE -PS22,25,80 -PA21,23,80,3389 
192.168.0.1/24

Output is:

...
Initiating Ping Scan at 10:50
Scanning 101 hosts [8 ports/host]
pcap_open_live(eth0, 100, 0, 200) FAILED. Reported error: socket: 
Address family not supported by protocol.  Will wait 5 seconds then retry.
pcap_open_live(eth0, 100, 0, 200) FAILED. Reported error: socket: 
Address family not supported by protocol.  Will wait 25 seconds then retry.
Call to pcap_open_live(eth0, 100, 0, 200) failed three times. Reported 
error: socket: Address family not supported by protocol
There are several possible reasons for this, depending on your operating 
system:
LINUX: If you are getting Socket type not supported, try modprobe 
af_packet or recompile your kernel with SOCK_PACKET enabled.
*BSD:  If you are getting device not configured, you need to recompile 
your kernel with Berkeley Packet Filter support.  If you are getting No 
such file or directory, try creating the device (eg cd /dev; MAKEDEV 
<device>; or use mknod).
*WINDOWS:  Nmap only supports ethernet interfaces on Windows for most 
operations because Microsoft disabled raw sockets as of Windows XP SP2. 
 Depending on the reason for this error, it is possible that the 
--unprivileged command-line argument will help.
SOLARIS:  If you are trying to scan localhost or the address of an 
interface and are getting '/dev/lo0: No such file or directory' or 'lo0: 
No DLPI device found', complain to Sun.  I don't think Solaris can 
support advanced localhost scans.  You can probably use "-PN -sT 
localhost" though.


QUITTING!

modprobe does not find af_packet.
Searching the kernel config for SOCK_PACKET comes up empty.
--
---
Colin Beckingham
613-454-5369
http://www.it4gh.com
_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://seclists.org/nmap-dev/