0

If I run the following command bare-metal on my machine it takes a few mere seconds to run:

nmap -v -n -p- <ip of other debian box>

However if I run the extact same command inside docker it takes utterly ages, I've got no idea quite how long as I get bored every time before it finishes:

Starting Nmap 7.70 ( https://nmap.org ) at 2019-03-14 17:58 UTC
Initiating Ping Scan at 17:58
Scanning 10.44.143.51 [4 ports]
Completed Ping Scan at 17:58, 0.23s elapsed (1 total hosts)
Initiating SYN Stealth Scan at 17:58
Scanning 10.44.143.51 [65535 ports]
Discovered open port 22/tcp on 10.44.143.51
Discovered open port 111/tcp on 10.44.143.51
Increasing send delay for 10.44.143.51 from 0 to 5 due to max_successful_tryno increase to 4
Increasing send delay for 10.44.143.51 from 5 to 10 due to 11 out of 33 dropped probes since last increase.
Increasing send delay for 10.44.143.51 from 10 to 20 due to 11 out of 29 dropped probes since last increase.
Increasing send delay for 10.44.143.51 from 20 to 40 due to 11 out of 25 dropped probes since last increase.
Increasing send delay for 10.44.143.51 from 40 to 80 due to 11 out of 32 dropped probes since last increase.
SYN Stealth Scan Timing: About 11.91% done; ETC: 18:03 (0:03:49 remaining)
SYN Stealth Scan Timing: About 12.38% done; ETC: 18:06 (0:07:12 remaining)
SYN Stealth Scan Timing: About 12.85% done; ETC: 18:10 (0:10:17 remaining)
SYN Stealth Scan Timing: About 13.31% done; ETC: 18:13 (0:13:08 remaining)
SYN Stealth Scan Timing: About 13.78% done; ETC: 18:17 (0:15:45 remaining)
SYN Stealth Scan Timing: About 14.25% done; ETC: 18:19 (0:18:09 remaining)
^C

The time to scan just seems to go on forever.

As a stabbing guess I'm assuming this is something to do with nmap in the container having to go through the docker network and out onto the real network, which I presume is NATed, and so takes ages.

I'm keen to use nmap in docker as opposed to on the host as I'm using this in a fully automated setting where I already have a pool of hosts running docker and can despatch jobs for them to run (inside containers).

Any suggestions as to what is causing the speed issues and how to solve it?

1 Answer 1

1

can you verify which scan method is being used and trying interchanging them?

to force the Connect method: use -sT and for the SYN method: -sS

2
  • I specifically want to use -sS (which I think is the default). I have tried adding that both on the host and in the container and it makes no difference to the speed at all. Equally I also tried in an nspawn container and that has the same issue as docker. Commented Mar 15, 2019 at 22:03
  • I'm barking up the complete wrong tree and missing the point, yes in the container it is defaulting to -sS and so I need to prod it to use -sT which solved the problem! Thanks for pointing that out Commented Mar 15, 2019 at 22:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .