Re: NMap Slowness (and Partial Fix) on Ubuntu-Based Distros

[Daniel Miller <bonsaiviking () gmail com>]

Davide,

Thanks for following up on this. I did some further testing myself on
kernel 4.1.0 and found that there is indeed still a problem with packet
loss. I am not sure what the underlying cause is, or if upstream libpcap
has fixed it in development, but there is no released version that
addresses the problem. I just pushed a change suggested by nnposter on
github [1] that drops TPACKET_V3 support back to TPACKET_V2 (if available).
This solved the packet loss problem for us.

For a similar workaround with the latest BETA source tarball, you can add
the --disable-packet-ring option when you run ./configure. This disables
the packet ring capture entirely, so there may be some performance impact
in extreme cases.

Dan

[1] https://github.com/nmap/nmap/issues/34#issuecomment-119365645

On Tue, Sep 15, 2015 at 4:53 AM, Davide Girardi <davidegirardi () gmail com>
wrote:

> On Wed, Sep 9, 2015 at 7:45 PM, Daniel Miller <bonsaiviking () gmail com>
> wrote:
> > Thanks for the detailed bug report. This is a known issue that stems
> from a
> > Linux kernel bug that was fixed in kernel 3.19.
>
> Hi again folks.
>
> I did some tests with kernel 3.19 and the latest libpcap downloaded
> from the tcpdump site and compiled locally.
>
> Nmap 6.47 is blazing fast compared to nmap 6.49beta4.
>
> Here are some examples:
>
>
>
> root@bb:/home/gira/tmp# ./nmap-6.47/nmap -sS -n 192.168.3.99
>
> Starting Nmap 6.47 ( http://nmap.org ) at 2015-09-15 11:29 CEST
> Nmap scan report for 192.168.3.99
> Host is up (0.00034s latency).
> Not shown: 996 closed ports
> PORT    STATE SERVICE
> 80/tcp  open  http
> 139/tcp open  netbios-ssn
> 443/tcp open  https
> 445/tcp open  microsoft-ds
> MAC Address: 00:D0:4B:92:2D:89 (LA CIE Group S.A.)
>
> Nmap done: 1 IP address (1 host up) scanned in 0.09 seconds
>
>
>
> root@bb:/home/gira/tmp# ./nmap-6.49BETA4/nmap -sS -n 192.168.3.99
>
> Starting Nmap 6.49BETA4 ( https://nmap.org ) at 2015-09-15 11:29 CEST
> Nmap scan report for 192.168.3.99
> Host is up (0.00038s latency).
> Not shown: 996 closed ports
> PORT    STATE SERVICE
> 80/tcp  open  http
> 139/tcp open  netbios-ssn
> 443/tcp open  https
> 445/tcp open  microsoft-ds
> MAC Address: 00:D0:4B:92:2D:89 (LA CIE Group S.A.)
>
> Nmap done: 1 IP address (1 host up) scanned in 1.69 seconds
>
> gira@bb:~/tmp$ uname -a
> Linux bb 3.19.0-28-generic #30~14.04.1-Ubuntu SMP Tue Sep 1 09:32:55
> UTC 2015 x86_64 x86_64 x86_64 GNU/Linux
>
>
>
> gira@bb:~/tmp$ ldd nmap-6.47/nmap
> linux-vdso.so.1 =>  (0x00007ffcc551b000)
> libssl.so.1.0.0 => /lib/x86_64-linux-gnu/libssl.so.1.0.0
> (0x00007f37810ca000)
> libcrypto.so.1.0.0 => /lib/x86_64-linux-gnu/libcrypto.so.1.0.0
> (0x00007f3780cef000)
> libdl.so.2 => /lib/x86_64-linux-gnu/libdl.so.2 (0x00007f3780aeb000)
> libstdc++.so.6 => /usr/lib/x86_64-linux-gnu/libstdc++.so.6
> (0x00007f37807e7000)
> libm.so.6 => /lib/x86_64-linux-gnu/libm.so.6 (0x00007f37804e1000)
> libgcc_s.so.1 => /lib/x86_64-linux-gnu/libgcc_s.so.1 (0x00007f37802cb000)
> libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f377ff06000)
> /lib64/ld-linux-x86-64.so.2 (0x00007f3781329000)
>
>
>
> gira@bb:~/tmp$ ldd nmap-6.49BETA4/nmap
> linux-vdso.so.1 =>  (0x00007ffcceb6c000)
> libssl.so.1.0.0 => /lib/x86_64-linux-gnu/libssl.so.1.0.0
> (0x00007f0afa86f000)
> libcrypto.so.1.0.0 => /lib/x86_64-linux-gnu/libcrypto.so.1.0.0
> (0x00007f0afa494000)
> libdl.so.2 => /lib/x86_64-linux-gnu/libdl.so.2 (0x00007f0afa290000)
> libstdc++.so.6 => /usr/lib/x86_64-linux-gnu/libstdc++.so.6
> (0x00007f0af9f8c000)
> libm.so.6 => /lib/x86_64-linux-gnu/libm.so.6 (0x00007f0af9c86000)
> libgcc_s.so.1 => /lib/x86_64-linux-gnu/libgcc_s.so.1 (0x00007f0af9a70000)
> libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f0af96ab000)
> /lib64/ld-linux-x86-64.so.2 (0x00007f0afaace000)
>
>
> Same test conditions and same configuration compile-wise.
>
>
> Any ideas?
>
> Thanks
> --
>   Davide Girardi
>   <davidegirardi () gmail com>
_______________________________________________
Sent through the dev mailing list
https://nmap.org/mailman/listinfo/dev
Archived at http://seclists.org/nmap-dev/