1

I am running the rolling release of Kali as a guest OS on windows through Virtualbox and dealing with the following problem...(which I believe is a result of misconfiguration of software)

I am currently trying to do 3 things (simultaneously)

  • test masscan
  • use Nload to observe masscan performance
  • browse the internet

As the title says, my internet performance is nonexistent when I am trying to do these few things at the same time. I also cannot ping google either. I read this article https://www.cyberciti.biz/faq/linux-tcp-tuning/ about improving performance and I followed the articles' suggestions but still suffer the same symptoms. What is happening here? I am more interested in understanding where to look to resolve this than the actual solution(although, I do want to solve this problem). I come from a windows background so I'm not sure where to look in Linux to start solving this issue. Nload shows my throughput as 57.59 kBit/s which is nowhere near my bandwidth. Why is this throughput so low? Where should I be looking to determine what is misconfigured.

Also worth noting, I can reasonably say that my hardware is capable of doing more as I have a 16 core box with 48 gigs of ram. 8 of which is dedicated to this specific instance of Kali.

Also worth noting, when I run a speed test through Google's search engine tool my download speed is 141.1 Mbps and the upload speed is 21.6 Mbps. Although that is not the same as my host OS, it is still significantly better than the results I saw using masscan. The Nload output also matched these results at the time of testing. These last observations are what lead me to think this is a misconfiguration of software.

2
  • How are you configuring/invoking masscan? Also, are you running it on a publicly routable IP address or is it behind a NAT?
    – Spiff
    Aug 6, 2017 at 7:50
  • I am running it from behind a NAT, and the command I used was their "test" string copied and pasted directly with a mouse. This issue also presents itself when using enumall as well. When I get to the altdns portion of the scan i have (literally) 0 bps throughput according to nload. The "average" however does fluctuate but i think that's based on the time. I either have to take the interface down and bring it back up, or shutdown the machine, or save the machine state and start it again. I've tried temporarily disabling the firewall as well but that doesn't seem to help either.
    – Anonymous
    Aug 6, 2017 at 9:55

3 Answers 3

0

You're probably running out of ports on your NAT, or maybe overwhelming your NAT's mapping table. A typical NAPT setup only has a single public IP address, so it only has 64Ki TCP ports and 64Ki UDP ports to use.

Even if a TCP connection is fully closed, the connection goes into a TIME_WAIT state for something like 2 minutes to make sure the connection's 4-tuple doesn't get reused for a new connection while late packets from the old connection may still be in the network. A tool like masscan probably has to be smart about handling multiple 4-tuples from the same source TCP port and IP address, but a separate NAT may not be as smart about it, and may use a separate TCP port on the NAT public IP address for each connection, which would burn through all 64Ki possible TCP ports very quickly.

NAPT gateways can't tell if a UDP flow is over, so they often keep UDP port mappings around for a timeout of 30 seconds up to a few minutes.

Even if the NAT is smart about reusing the same source TCP or UDP port for a lot of connection 4-tuples, the sheer volume of connections that masscan can create could overwhelm the NAT's ability to keep track of all the parallel open connections.

If you're trying to scan all ~4 billion IPv4 addresses at masscan's "performance testing" example rate of 100,000, you'll swamp that 64Ki port number limit in less than a second. I'd expect anything over about 500 attempts per second to cause this problem. No wonder their default rate is only 100.

2
  • I ended up changing the network settings in Vbox and it resolved my issue.. Specifically, the NAT settings.
    – Anonymous
    Aug 7, 2017 at 22:02
  • @Anonymous I'm glad you found a solution. If you have specific findings for how Virtualbox users should adjust their NAT settings to make high-speed masscan work, please post your own Answer and click the checkmark next to it. I'd rather have later visitors to this site get a complete answer like you could write, rather than just my rough guess that it may be NAT port exhaustion.
    – Spiff
    Aug 7, 2017 at 23:50
0

This ended up being a problem related to my NAT setting within Virtualbox. Im not 100% clear on how Virtual Box manages NAT responsibilities so I cannot give a technical explanation but after I changed from "NAT" to "Bridged NAT" this problem went away. I haven't tested Masscan, but while using ALTDNS with my NAT in the original configuration the subdomain enumeration I discussed in the comments took over 3 hours and I had to repeatedly take down/bring up the interface. After the adjustments that turned into 30 minutes with no resetting of the interface.

-1

Btw to answer directly to your question you are overflooding your router which does Native Address Translation and rerouting for every packet you send, you are slowing down response of your own router.

You might try adding your pc straightly to the demilitarized zone on the router.

Although I'm not sure how much that would help with outgoing requests not incoming.

3
  • I have a gig router, with a 150 Mbps WAN connection coming into it. I doubt my router is the issue, especially since I can browse and use the Host OS normally.
    – Anonymous
    Aug 6, 2017 at 10:03
  • Well since the issue is with guest OS you might want to try to fiddle with iptables on debian kali-linux and set your network device in bridged mode with the baremetal networking device on host OS. One more recommendation it is better to run Linux as a host and windows as a guest also using KVM or XEN and Qemu is much better performing then VirtualBox.
    – MarkoShiva
    Aug 6, 2017 at 10:08
  • Specifically how is that supposed to solve the problem? (especially when my connections are dropping intermittently and not permanently)
    – Anonymous
    Aug 6, 2017 at 10:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .