I'm attempting to use nmap on my Tomato router (Linux 2.6) to do a quick survey of a particular subnet on my LAN. Even when I set it to scan a single client it takes close to four minutes to complete. Based on the debugging output I can see that the scan itself is extremely quick, but the total time is... not.

Here's the command I'm using (for testing only):

nmap -d -n -sn -vv

And here is the output:

Starting Nmap 5.35DC1 ( http://nmap.org ) at 2014-09-17 21:37 CEST 
--------------- Timing report --------------- 
  hostgroups: min 1, max 100000 
  rtt-timeouts: init 1000, min 100, max 10000 
  max-scan-delay: TCP 1000, UDP 1000, SCTP 1000 
  parallelism: min 0, max 0 
  max-retries: 10, host-timeout: 0 
  min-rate: 0, max-rate: 0 
Initiating ARP Ping Scan at 21:37
Scanning [1 port] 
Packet capture filter (device br1): arp and arp[18:4] = 0x08606EBA and arp[22:2] = 0x3D18 
Completed ARP Ping Scan at 21:37, 0.15s elapsed (1 total hosts)
Overall sending rates: 6.73 packets / s, 282.53 bytes / s. 
Nmap scan report for 
Host is up, received arp-response (0.087s latency). 
MAC Address: XX:XX:XX:E8:53:2D (Unknown) 
Final times for host: srtt: 86931 rttvar: 86931  to: 434655 
Read from /opt/share/nmap: nmap-mac-prefixes nmap-payloads. 
Nmap done: 1 IP address (1 host up) scanned in 235.73 seconds 
           Raw packets sent: 1 (28B) | Rcvd: 1 (28B) 

As you can see, the ping scan completes in no time, but the total time is 235s. I believe it attempts to match the OUI of the MAC address using nmap-mac-prefixes, but I can't imagine that taking so long.

I've tried all sorts of options to no avail. Any idea where the delay is coming from?

  • worth trying also on the nmap mailing list – barlop Sep 17 '14 at 22:52

I'm not sure what the slowdown is, but the standard Nmap debugging advice surely applies:

  1. Update your Nmap. Version 5.35DC1 was released in 2010, 4 years ago. For an actively developed project like Nmap, that's ancient history. Try the latest version (6.47 at the time of this writing) at http://nmap.org/download.html
  2. Increase debug level. You will get more verbose output as you add -d arguments. For most purposes, -d3 is the most that you will need.
  3. If the problem persists, file a bug report to dev@nmap.org with the output of:
    • nmap --version
    • nmap --iflist
    • The command causing problems (including where in the output the hang occurs, if possible)

One final note: Since you are running Nmap on an embedded system, it's entirely possible that processing and file access times will be much slower than on a general purpose computer.

  • Nmap was installed via Optware and that is apparently the latest version it has. I'm not sure how to (or if I can) update the version, but I'll look into it. Good info, thanks. – jluce50 Sep 18 '14 at 13:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.