Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm running CentOS 5.3 in an openVZ container, and I'm receiving "operation not permitted" errors from Nmap.

[root@test nmap-5.21]# ./nmap scanme.nmap.org

Starting Nmap 5.21 ( http://nmap.org ) at 2010-12-12 17:03 MSK

Warning: File ./nmap-services exists, but Nmap is using /usr/local/share/nmap/nmap-services for security and consistency reasons. set NMAPDIR=. to give priority to files in your local directory (may affect the other data files too).

sendto in send_ip_packet: sendto(4, packet, 28, 0, 64.13.134.52, 16) => Operation not permitted

Offending packet: ICMP 127.0.0.1 > 64.13.134.52 echo request (type=8/code=0) ttl=46 id=49000 iplen=28 sendto in send_ip_packet: sendto(4, packet, 40, 0, 64.13.134.52, 16) => Operation not permitted

Offending packet: ICMP 127.0.0.1 > 64.13.134.52 Timestamp request (type=13/code=0) ttl=49 id=23010 iplen=40

sendto in send_ip_packet: sendto(4, packet, 40, 0, 64.13.134.52, 16) => Operation not permitted

Offending packet: ICMP 127.0.0.1 > 64.13.134.52 Timestamp request (type=13/code=0) ttl=56 id=36657 iplen=40

sendto in send_ip_packet: sendto(4, packet, 28, 0, 64.13.134.52, 16) => Operation not permitted

Offending packet: ICMP 127.0.0.1 > 64.13.134.52 echo request (type=8/code=0) ttl=51 id=43181 iplen=28

Note: Host seems down. If it is really up, but blocking our ping probes, try -PN Nmap done: 1 IP address (0 hosts up) scanned in 3.15 seconds

I have no iptables rules set.

How can I get this working?

share|improve this question

Maybe your container has a venet interface, which has security restrictions. You need to use veth interfaces to send broadcasts and other nonstandard packets. See Differences between venet and veth.

share|improve this answer
    
Yeah, I am using a venet interface. Unfortunately, I can't control this. Do you know of any "simpler" port scanners that will still be able to function correctly? – a-- Dec 14 '10 at 13:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .