NMAP results inconsistent

Question

I'm doing a NMAP scan that runs continuously. For some reason the results are not consistent. Sometimes it detects all the connected devices of the local network and sometimes only some of them.

Background about the network I'm scanning: I'm using Ubuntu to create a private local network by sharing the WAN to the LAN. My subnet is 10.42.0.0/24 and the scanning machine is the one that shares the network.

NMAP params I tried:

• nmap 10.42.0.0/24 -O -T4 -F
• nmap 10.42.0.0/24 -T4 -F
• nmap 10.42.0.0/24 -O
• nmap 10.42.0.0/24 -O -Pn
• nmap 10.42.0.0/24 -O -Pn -e <the local network interface>

In all of the tests I'm getting this problem.

EXAMPLE: S1:

$ sudo nmap 10.42.0.0/24 -O -Pn -e eth0
Starting Nmap 7.70 ( https://nmap.org ) at 2019-02-24 13:17 IST
Nmap scan report for Galaxy-S8 (10.42.0.147)
Host is up (0.0094s latency).
All 1000 scanned ports on Galaxy-S8 (10.42.0.147) are closed
MAC Address: ***** (Samsung Electro-mechanics(thailand))
Too many fingerprints match this host to give specific OS details
Network Distance: 1 hop

OS detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 256 IP addresses (1 host up) scanned in 13.80 seconds

Scan2:

$ sudo nmap 10.42.0.0/24 -O -Pn -e eth0
Starting Nmap 7.70 ( https://nmap.org ) at 2019-02-24 13:28 IST
RTTVAR has grown to over 2.3 seconds, decreasing to 2.0
RTTVAR has grown to over 2.3 seconds, decreasing to 2.0
RTTVAR has grown to over 2.3 seconds, decreasing to 2.0
Nmap scan report for NX (10.42.0.26)
Host is up (0.0031s latency).
Not shown: 998 closed ports
PORT     STATE SERVICE
902/tcp  open  iss-realsecure
8082/tcp open  blackice-alerts
MAC Address: **** (Intel Corporate)
Device type: general purpose
Running: Linux 3.X|4.X
OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4
OS details: Linux 3.2 - 4.9
Network Distance: 1 hop

OS detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 256 IP addresses (1 host up) scanned in 31.74 seconds

scan3:

$ sudo nmap 10.42.0.0/24 -O -Pn -e eth0
Starting Nmap 7.70 ( https://nmap.org ) at 2019-02-24 13:29 IST
Nmap done: 256 IP addresses (0 hosts up) scanned in 15.98 seconds

Scan4:

$ sudo nmap 10.42.0.0/24 -O -Pn -e eth0
Starting Nmap 7.70 ( https://nmap.org ) at 2019-02-24 13:29 IST
RTTVAR has grown to over 2.3 seconds, decreasing to 2.0
RTTVAR has grown to over 2.3 seconds, decreasing to 2.0
RTTVAR has grown to over 2.3 seconds, decreasing to 2.0
RTTVAR has grown to over 2.3 seconds, decreasing to 2.0
RTTVAR has grown to over 2.3 seconds, decreasing to 2.0
RTTVAR has grown to over 2.3 seconds, decreasing to 2.0
RTTVAR has grown to over 2.3 seconds, decreasing to 2.0
RTTVAR has grown to over 2.3 seconds, decreasing to 2.0
RTTVAR has grown to over 2.3 seconds, decreasing to 2.0
RTTVAR has grown to over 2.3 seconds, decreasing to 2.0
RTTVAR has grown to over 2.3 seconds, decreasing to 2.0
Nmap scan report for NX (10.42.0.26)
Host is up (0.015s latency).
Not shown: 998 closed ports
PORT     STATE SERVICE
902/tcp  open  iss-realsecure
8082/tcp open  blackice-alerts
MAC Address: **** (Intel Corporate)
Device type: general purpose
Running: Linux 3.X|4.X
OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4
OS details: Linux 3.2 - 4.9
Network Distance: 1 hop

Nmap scan report for Galaxy-S8 (10.42.0.147)
Host is up (0.020s latency).
All 1000 scanned ports on Galaxy-S8 (10.42.0.147) are filtered (828) or closed (172)
MAC Address: **** (Samsung Electro-mechanics(thailand))
Too many fingerprints match this host to give specific OS details
Network Distance: 1 hop

OS detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 256 IP addresses (2 hosts up) scanned in 83.02 seconds

So first scan detected 10.42.0.147
second detected 10.42.0.26
third did not detect anything
and the last one detected 10.42.0.26 and 10.42.0.147.

Would appreciate the help.

Answer 1

I have seen this behaviour in nmap before, and from my experience it doesn’t have anything to do with nmap itself, but the devices that are being scanned.

I think the actual problem here is the device’s firewall blocking the scan. This can be because of different rates, different ports and other custom options on firewalls (you might not even know exist). Some firewalls open and close ports rapidly. My android phone was popping on and off the network just like this.

Before trying anything else, you should check the firewall on the devices. You can also scan more using -Pn or try using masscan to see if the problem persists.

This may not be qualified as an answer, but atleast it’s something to be aware of.