Nmap Development mailing list archives
RE: FATAL Bad Memory Block.
From: Mark Huss <mark.huss () systemexperts com>
Date: Mon, 30 Nov 2015 14:22:21 -0500
Here you go: nmap -n -Pn -d2 -p 80 192.168.1.1 Starting Nmap 7.00 ( https://nmap.org ) at 2015-11-30 14:09 Eastern Standard Tim e Fetchfile found C:\Program Files (x86)\Nmap/nmap-services Winpcap present, dynamic linked to: WinPcap version 4.1.3 (packet.dll version 10 , 2, 0, 5002), based on libpcap version 1.0 branch 1_0_rel0b (20091008) NPF service is already running. Fetchfile found C:\Program Files (x86)\Nmap/nmap.xsl The max # of sockets we are using is: 0 --------------- Timing report --------------- hostgroups: min 1, max 100000 rtt-timeouts: init 1000, min 100, max 10000 max-scan-delay: TCP 1000, UDP 1000, SCTP 1000 parallelism: min 0, max 0 max-retries: 10, host-timeout: 0 min-rate: 0, max-rate: 0 --------------------------------------------- Fetchfile found C:\Program Files (x86)\Nmap/nmap-payloads Initiating ARP Ping Scan at 14:09 Scanning 192.168.1.1 [1 port] Packet capture filter (device eth1): arp and arp[18:4] = 0x0024BEDD and arp[22:2 ] = 0x03D5 FATAL Bad Memory Block. ultrascan_host_probe_update called for machine 192.168.1.1 state UNKNOWN -> HOST _UP (trynum 0 time: 0) Changing ping technique for 192.168.1.1 to ARP Changing global ping host to 192.168.1.1. Stats: 0:00:00 elapsed; 0 hosts completed (0 up), 1 undergoing ARP Ping Scan ARP Ping Scan Timing: About 100.00% done; ETC: 14:09 (0:00:00 remaining) Current sending rates: 4.59 packets / s, 192.66 bytes / s. Completed ARP Ping Scan at 14:09, 0.23s elapsed (1 total hosts) Overall sending rates: 4.59 packets / s, 192.66 bytes / s. Initiating SYN Stealth Scan at 14:09 192.168.1.1 pingprobe type ARP is inappropriate for this scan type; resetting. Scanning 192.168.1.1 [1 port] Packet capture filter (device eth1): dst host 192.168.1.12 and (icmp or icmp6 or ((tcp or udp or sctp) and (src host 192.168.1.1))) FATAL Bad Memory Block. Discovered open port 80/tcp on 192.168.1.1 Changing ping technique for 192.168.1.1 to tcp to port 80; flags: S Changing global ping host to 192.168.1.1. Completed SYN Stealth Scan at 14:09, 0.02s elapsed (1 total ports) Overall sending rates: 62.50 packets / s, 2750.00 bytes / s. Nmap scan report for 192.168.1.1 Fetchfile found C:\Program Files (x86)\Nmap/nmap-mac-prefixes MAC prefix 0001C8 is duplicated in C:\Program Files (x86)\Nmap/nmap-mac-prefixes ; ignoring duplicates. MAC prefix 080030 is duplicated in C:\Program Files (x86)\Nmap/nmap-mac-prefixes ; ignoring duplicates. MAC prefix 080030 is duplicated in C:\Program Files (x86)\Nmap/nmap-mac-prefixes ; ignoring duplicates. Host is up, received arp-response (0.00s latency). Scanned at 2015-11-30 14:09:23 Eastern Standard Time for 0s PORT STATE SERVICE REASON 80/tcp open http syn-ack ttl 64 MAC Address: F8:E4:FB:8C:C2:B4 (Actiontec Electronics) Final times for host: srtt: 0 rttvar: 3750 to: 100000 Read from C:\Program Files (x86)\Nmap: nmap-mac-prefixes nmap-payloads nmap-serv ices. Nmap done: 1 IP address (1 host up) scanned in 0.44 seconds Raw packets sent: 2 (72B) | Rcvd: 2 (72B) From: Daniel Miller [mailto:bonsaiviking () gmail com] Sent: Monday, November 30, 2015 12:58 PM To: Mark Huss Cc: Nmap-dev Subject: Re: FATAL Bad Memory Block. Mark, Thanks for this bug report. A quick web search shows this string in connection with WinPcap, though I can't find it in either their source or ours. This does not seem like an out-of-memory issue, and 2GB should be more than adequate. Can you post the output of this command, which will show the version of WinPcap linked along with extra debugging info? nmap -n -Pn -d2 -p 25 {IP} It would also be helpful to have information about whether Nmap seems to be accurate. The scan you showed has port 25 being filtered because of no response. Can you connect directly with a different program, or does nmap -sT show a different result? Dan On Wed, Nov 25, 2015 at 8:41 AM, Mark Huss <mark.huss () systemexperts com> wrote: Since updating to v7 , whenever I run nmap on my laptop I get somewhere between ‘a couple of’ to ‘large streams’ of the error above, depending on the options on the command line. In between all the error messages nmap seems to be working ok and printing out the appropriate messages. I did a site search and found no mention of this particular error. Win7 x64 SP1 i7 2620M CPU 4G RAM(>2G available) Nmap 7 seems to work fine on my larger box (Win7 x64 SP1 16GB RAM). Is 2GB too little to run nmap in now? Examples: nmap -p 25 -Pn -v -v -v -Pn {IP} -- ( a couple of errors:) Starting Nmap 7.00 ( https://nmap.org ) at 2015-11-25 09:25 Eastern Standard Time Initiating Parallel DNS resolution of 1 host. at 09:25 Completed Parallel DNS resolution of 1 host. at 09:25, 0.02s elapsed DNS resolution of 1 IPs took 0.64s. Mode: Async [#: 5, OK: 1, NX: 0, DR: 0, SF:0, TR: 1, CN: 0] Initiating SYN Stealth Scan at 09:25 Scanning {host (IP)} [1 port] FATAL Bad Memory Block. FATAL Bad Memory Block. Completed SYN Stealth Scan at 09:25, 2.15s elapsed (1 total ports) Nmap scan report for {host (IP)} Host is up, received user-set. Scanned at 2015-11-25 09:25:42 Eastern Standard Time for 2s PORT STATE SERVICE REASON 25/tcp filtered smtp no-response Read data files from: C:\Program Files (x86)\Nmap Nmap done: 1 IP address (1 host up) scanned in 2.95 seconds Raw packets sent: 2 (88B) | Rcvd: 0 (0B) nmap -p 25 -T4 -A -v -v -v -Pn {IP} -- LOTS of errors: Starting Nmap 7.00 ( https://nmap.org ) at 2015-11-25 09:25 Eastern Standard Time […] Initiating OS detection (try #1) against { host (IP) } FATAL Bad Memory Block. FATAL Bad Memory Block. FATAL Bad Memory Block. FATAL Bad Memory Block. FATAL Bad Memory Block. FATAL Bad Memory Block. FATAL Bad Memory Block. FATAL Bad Memory Block. FATAL Bad Memory Block. FATAL Bad Memory Block. FATAL Bad Memory Block. FATAL Bad Memory Block. FATAL Bad Memory Block. FATAL Bad Memory Block. FATAL Bad Memory Block. FATAL Bad Memory Block. FATAL Bad Memory Block. FATAL Bad Memory Block. FATAL Bad Memory Block. FATAL Bad Memory Block. FATAL Bad Memory Block. Initiating Traceroute at 09:23 FATAL Bad Memory Block. FATAL Bad Memory Block. FATAL Bad Memory Block. FATAL Bad Memory Block. FATAL Bad Memory Block. FATAL Bad Memory Block. FATAL Bad Memory Block. FATAL Bad Memory Block. FATAL Bad Memory Block. FATAL Bad Memory Block. FATAL Bad Memory Block. FATAL Bad Memory Block. FATAL Bad Memory Block. FATAL Bad Memory Block. FATAL Bad Memory Block. FATAL Bad Memory Block. FATAL Bad Memory Block. FATAL Bad Memory Block. FATAL Bad Memory Block. FATAL Bad Memory Block. FATAL Bad Memory Block. FATAL Bad Memory Block. FATAL Bad Memory Block. FATAL Bad Memory Block. FATAL Bad Memory Block. FATAL Bad Memory Block. FATAL Bad Memory Block. FATAL Bad Memory Block. FATAL Bad Memory Block. FATAL Bad Memory Block. FATAL Bad Memory Block. FATAL Bad Memory Block. FATAL Bad Memory Block. FATAL Bad Memory Block. FATAL Bad Memory Block. FATAL Bad Memory Block. FATAL Bad Memory Block. FATAL Bad Memory Block. FATAL Bad Memory Block. FATAL Bad Memory Block. FATAL Bad Memory Block. FATAL Bad Memory Block. FATAL Bad Memory Block. FATAL Bad Memory Block. FATAL Bad Memory Block. FATAL Bad Memory Block. FATAL Bad Memory Block. FATAL Bad Memory Block. FATAL Bad Memory Block. FATAL Bad Memory Block. FATAL Bad Memory Block. FATAL Bad Memory Block. FATAL Bad Memory Block. FATAL Bad Memory Block. FATAL Bad Memory Block. FATAL Bad Memory Block. FATAL Bad Memory Block. FATAL Bad Memory Block. FATAL Bad Memory Block. FATAL Bad Memory Block. FATAL Bad Memory Block. FATAL Bad Memory Block. FATAL Bad Memory Block. FATAL Bad Memory Block. FATAL Bad Memory Block. FATAL Bad Memory Block. FATAL Bad Memory Block. FATAL Bad Memory Block. FATAL Bad Memory Block. FATAL Bad Memory Block. FATAL Bad Memory Block. FATAL Bad Memory Block. FATAL Bad Memory Block. FATAL Bad Memory Block. Completed Traceroute at 09:24, 9.14s elapsed […] Mark Huss | | <mailto:mark.huss () systemexperts com> mark.huss () systemexperts com SystemEXPERTS | Leadership in Security & Compliance _______________________________________________ Sent through the dev mailing list https://nmap.org/mailman/listinfo/dev Archived at http://seclists.org/nmap-dev/
Attachment:
smime.p7s
Description:
_______________________________________________ Sent through the dev mailing list https://nmap.org/mailman/listinfo/dev Archived at http://seclists.org/nmap-dev/
Current thread:
- FATAL Bad Memory Block. Mark Huss (Nov 30)
- Re: FATAL Bad Memory Block. Daniel Miller (Nov 30)
- RE: FATAL Bad Memory Block. Mark Huss (Nov 30)
- Re: FATAL Bad Memory Block. Daniel Miller (Nov 30)