Re: OS X 10.6 Problems with privileged scans

[David Fifield <david () bamsoftware com>]

On Fri, Oct 23, 2009 at 12:40:39PM -0400, Walt Scrivens wrote:
> I misunderstood :-(
>
> Here is the terminal output:
> =====================
> Starting Nmap 5.05BETA1 ( http://nmap.org ) at 2009-10-23 12:37 EDT
> The max # of sockets we are using is: 0
> --------------- Timing report ---------------
>   hostgroups: min 1, max 100000
>   rtt-timeouts: init 1000, min 100, max 10000
>   max-scan-delay: TCP 1000, UDP 1000, SCTP 1000
>   parallelism: min 0, max 0
>   max-retries: 10, host-timeout: 0
>   min-rate: 0, max-rate: 0
> ---------------------------------------------
> Warning: Unable to open interface vmnet8 -- skipping it.
> Warning: Unable to open interface vmnet1 -- skipping it.
> Initiating Ping Scan at 12:37
> Scanning 64.13.134.52 [4 ports]
> Pcap filter: dst host 192.168.1.144 and (icmp or ((tcp or udp or sctp)  
> and (src host 64.13.134.52)))
> Packet capture filter (device en1): dst host 192.168.1.144 and (icmp or 
> ((tcp or udp or sctp) and (src host 64.13.134.52)))
> SENT (0.0100s) ICMP 192.168.1.144 > 64.13.134.52 echo request (type=8/ 
> code=0) ttl=51 id=34354 iplen=28
> SENT (0.0100s) TCP 192.168.1.144:34731 > 64.13.134.52:443 S ttl=48  
> id=45564 iplen=44  seq=1339274943 win=1024 <mss 1460>
> SENT (0.0100s) TCP 192.168.1.144:34731 > 64.13.134.52:80 A ttl=44  
> id=20245 iplen=40  seq=1339274943 win=1024 ack=4226847096
> SENT (0.0100s) ICMP 192.168.1.144 > 64.13.134.52 Timestamp request  
> (type=13/code=0) ttl=40 id=9543 iplen=40
> **TIMING STATS** (0.0100s): IP, probes active/freshportsleft/ 
> retry_stack/outstanding/retranwait/onbench, cwnd/ssthresh/delay,  
> timeout/srtt/rttvar/
>    Groupstats (1/1 incomplete): 4/*/*/*/*/* 10.00/75/* 1000000/-1/-1
>    64.13.134.52: 4/0/0/4/0/0 10.00/75/0 1000000/-1/-1
> Current sending rates: 8639.31 packets / s, 328293.74 bytes / s.
> Overall sending rates: 8639.31 packets / s, 328293.74 bytes / s.
> .
> .
> .
> At this point it locks up.

Is that with the patch from
http://seclists.org/nmap-dev/2009/q4/att-155/pcap_datalink_log.diff? I
would have expected a "pcap_next" debug line near the end there.

David Fifield
_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://seclists.org/nmap-dev/