Host timeouts on large SYN scans

[pierre.lalet () cea fr]

Hi list,

I run scans on a LAN / fast WAN with "-iL -" and an external script 
feeds the targets in a random order when select() says nmap's stdin is 
ready.

"--host-timeout" is set to "15m" or "60m"

After running a Ping scan against 4096 targets, nmap runs a succession 
of (SYN, Service, Traceroute, NSE) scans against "hostgroups".

The first hostgroup has 4 hosts, and all the next ones have 64 (or 
whatever specified with --max-hostgroup). At first everything works pretty
fine, but after a few hostgroups (5 to 10), all the "SYN Stealth Scan" 
task end with "XX hosts timed out" (with XX the size of the hostgroup).

This is 100% reproducible, and happens with the SVN version. I didn't 
try with the stable version yet.

I've then tried some tweaks like "--nogcc" or specifying a 
"--min-parallelism" value (e.g. 30) with no different result.

I have no rate-limiting device between the targets and the scan machine.

Do you have an idea of what I could do to try to debug (or fix !) this 
issue?

Regards,

Pierre

_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://seclists.org/nmap-dev/