Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
When I scan an external IP address with Nmap my router always reboots itself, sometimes I even have to manually restart it by using the power switch.
The command I usually use is:
nmap -p 1-65535 -T4 -A -v -Pn *IP address*
I'm using an Asus RT-AC66U with the latest firmware. I have also tried using the Asuswrt-Merlin firmware but the result is still the same.
Has anyone else experienced this problem and solved it?
You are probably exhausting the router's resources, primarily the NAT table. Every outgoing connection maps your scanning machine's private IP address and source port onto a new source port on the router's public IP address. Since there are more IP address + source port combinations than there are source ports on the single public IP, the router has to do extra work to avoid collisions. Ideally, this would not cause a reboot or a crash, but home routers are not ideal pieces of equipment.
The easiest way to slow your scan down to something your router can handle would be to change -T4 to -T3 (the default). If that doesn't work, continue reducing the timing options until you get a good result. The other thing that can help if you are scanning more than one known-alive IP address is to not use -Pn.
Personally haven't used Nmap in a while but it sounds like you're unintentionally DoSing yourself? Does the aggressive (-A) parameter not overwrite -T4 and just scan as fast as possible? If that's the case, it's pretty easy to UDP flood home routers.
Definitely sounds like a timing issue though. Look up the aggressive parameter and take what you need from it (it uses 4-5 flags that you can set manually anyway) and from there, play with rate limiting and possibly maximum transmission unit.
-A has nothing to do with timing. It stands for "advanced" and is equivalent of -sV -sC -O --traceroute but skips -O and --traceroute if you do not have sufficient privileges. You are confusing it with -T aggressive, which is equivalent to -T4.
– bonsaiviking
Oct 23 '15 at 19:08
