Re: Weird Crash - "WAITING_TO_RUNNING"

[Nathan <nathan.stocks () gmail com>]

On Wed, Nov 3, 2010 at 11:29 AM, Patrick Donnelly <batrick () batbytes com> wrote:
> On Wed, Nov 3, 2010 at 1:07 PM, Nathan <nathan.stocks () gmail com> wrote:
> > "Is this on a 32-bit machine?" -- The hardware is 64-bit capable, but
> > the old version of linux on it is compiled in 32-bit, I think.  The OS
> > can address more than 4GB RAM, but the stuff running on it seems to
> > act very 32-bit.  Python's maxint is 32-bit, anyway:
> >
> > $ python
> > Python 2.5.2 (r252:60911, Oct 30 2008, 18:03:18)
> > [GCC 4.1.2 (Gentoo 4.1.2 p1.1)] on linux2
> > Type "help", "copyright", "credits" or "license" for more information.
> > > > > import sys
> > > > > sys.maxint
> > 2147483647
> >
> > $ uname -a
> > Linux scan5 2.6.23-gentoo-r9 #4 SMP Tue Oct 12 16:02:12 MDT 2010 i686
> > Intel(R) Xeon(R) CPU E5507 @ 2.27GHz GenuineIntel GNU/Linux
>
> Your processor (running as 32 bit) is using PAE (Physical Address
> Extension) to allow more than 4GB of RAM. Your process is still only
> allowed ~4GB of addressable RAM. This is why Nmap is crashing for you.

Okay, I'll buy that that is the _symptom_ we're seeing.  I can't
imagine you're trying to imply that it's normal for an nmap scan of
one target to take that much RAM, though.  At 65,535 ports, 4GB gives
you 64KB PER PORT.  I could generate a small jpeg thumbnail of the
traffic sent to each port at that rate.

The question is, WHAT is using up that RAM, and how do we stop it?   I
could run multiple instances of this same scan on this same box with
nmap 4.68 (that I just upgraded from) against this target without any
problems at all.

Did anyone look at the stack trace???  It seriously can't be normal to
run "skypev2-version" and "jdwp-version" tens of thousands of times
until you run out of RAM.  Infinite loop, anyone?  Or, perhaps this is
caused by nmap erroneously thinking every single port is open (which
is one of the things I hoped upgrading would fix), where the
underlying assumption is that very few ports will be open so we can
use a ton of memory to investigate each open port?

~ Nathan
_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://seclists.org/nmap-dev/