I'm running nmap periodically to monitor which hosts are in our server subnet:

rm list; for i in $(seq 1 254) ; do echo 10.10.10.$i >> list ; done
sudo nmap -oG - -PE -sn -iL list

Most of the time, it discovers 28 hosts, but sometimes less.

I've set up tshark (tcpdump) to capture all non-ssh traffic (2scans.pcapng file) and as far as I can tell, for some hosts, there is no difference in network traffic between when nmap reports a host as "Statups: Up" or not.

E.g. two subsequent runs of the nmap script above produced this output:

Scan 1:

# Nmap 6.47 scan initiated Fri Aug 10 11:12:57 2018 as: nmap -oG - -PE -sn -iL list
Host: 10.10.10.2 (access-switch01.capmon)   Status: Up
Host: 10.10.10.3 (backnet-switch02.capmon)  Status: Up
Host: 10.10.10.4 () Status: Up
Host: 10.10.10.6 (c5-capmon.capmon) Status: Up
Host: 10.10.10.8 (blackboxserversensor.capmon)  Status: Up
Host: 10.10.10.21 (overvaagning.capmon) Status: Up
Host: 10.10.10.50 (s-nas.capmon)    Status: Up
Host: 10.10.10.63 (proxmox13.capmon)    Status: Up
Host: 10.10.10.64 (proxmox14.capmon)    Status: Up
Host: 10.10.10.66 (proxmox16.capmon)    Status: Up
Host: 10.10.10.69 (proxmox01.capmon)    Status: Up
Host: 10.10.10.71 (proxmox03.capmon)    Status: Up
Host: 10.10.10.91 (proxmox11-imm.capmon)    Status: Up
Host: 10.10.10.92 (proxmox12-imm.capmon)    Status: Up
Host: 10.10.10.93 (proxmox13-imm.capmon)    Status: Up
Host: 10.10.10.95 (proxmox16-imm.capmon)    Status: Up
Host: 10.10.10.100 (nas.capmon) Status: Up
Host: 10.10.10.109 (nessus.capmon)  Status: Up
Host: 10.10.10.248 (smsgw2.capmon)  Status: Up
Host: 10.10.10.250 (asa.capmon) Status: Up
Host: 10.10.10.251 (pfsense.capmon) Status: Up
# Nmap done at Fri Aug 10 11:12:58 2018 -- 254 IP addresses (21 hosts up) scanned in 1.05 seconds

Scan 2:

# Nmap 6.47 scan initiated Fri Aug 10 11:13:08 2018 as: nmap -oG - -PE -sn -iL list
Host: 10.10.10.1 (capmon-backnet.capmon)    Status: Up
Host: 10.10.10.2 (access-switch01.capmon)   Status: Up
Host: 10.10.10.3 (backnet-switch02.capmon)  Status: Up
Host: 10.10.10.4 () Status: Up
Host: 10.10.10.6 (c5-capmon.capmon) Status: Up
Host: 10.10.10.8 (blackboxserversensor.capmon)  Status: Up
Host: 10.10.10.21 (overvaagning.capmon) Status: Up
Host: 10.10.10.50 (s-nas.capmon)    Status: Up
Host: 10.10.10.63 (proxmox13.capmon)    Status: Up
Host: 10.10.10.64 (proxmox14.capmon)    Status: Up
Host: 10.10.10.65 (proxmox15.capmon)    Status: Up
Host: 10.10.10.66 (proxmox16.capmon)    Status: Up
Host: 10.10.10.69 (proxmox01.capmon)    Status: Up
Host: 10.10.10.71 (proxmox03.capmon)    Status: Up
Host: 10.10.10.72 (proxmox04.capmon)    Status: Up
Host: 10.10.10.73 (proxmox05.capmon)    Status: Up
Host: 10.10.10.91 (proxmox11-imm.capmon)    Status: Up
Host: 10.10.10.92 (proxmox12-imm.capmon)    Status: Up
Host: 10.10.10.93 (proxmox13-imm.capmon)    Status: Up
Host: 10.10.10.94 (proxmox15-imm.capmon)    Status: Up
Host: 10.10.10.95 (proxmox16-imm.capmon)    Status: Up
Host: 10.10.10.100 (nas.capmon) Status: Up
Host: 10.10.10.109 (nessus.capmon)  Status: Up
Host: 10.10.10.122 ()   Status: Up
Host: 10.10.10.248 (smsgw2.capmon)  Status: Up
Host: 10.10.10.249 (smsgw.capmon)   Status: Up
Host: 10.10.10.250 (asa.capmon) Status: Up
Host: 10.10.10.251 (pfsense.capmon) Status: Up
# Nmap done at Fri Aug 10 11:13:10 2018 -- 254 IP addresses (28 hosts up) scanned in 1.73 seconds

I've investigated the missing 10.10.10.1 and indeed, there is no ICMP Echo reply for it. But for e.g. 10.10.10.94, it seems the traffic to/from that host seems exactly the same for the two scans:

> tshark -ta -r 2scans.pcapng -Y 'ip.addr==10.10.10.94'
  633 11:12:58.475808 172.22.216.210 → 10.10.10.94  ICMP 42 Echo (ping) request  id=0x6527, seq=0/0, ttl=59
  639 11:12:58.476203  10.10.10.94 → 172.22.216.210 ICMP 60 Echo (ping) reply    id=0x6527, seq=0/0, ttl=63 (request in 633)
  752 11:12:58.589521 172.22.216.210 → 10.10.10.94  ICMP 42 Echo (ping) request  id=0x6823, seq=0/0, ttl=46
  761 11:12:58.589943  10.10.10.94 → 172.22.216.210 ICMP 60 Echo (ping) reply    id=0x6823, seq=0/0, ttl=63 (request in 752)
 1413 11:13:10.224663 172.22.216.210 → 10.10.10.94  ICMP 42 Echo (ping) request  id=0x379d, seq=0/0, ttl=45
 1416 11:13:10.225120  10.10.10.94 → 172.22.216.210 ICMP 60 Echo (ping) reply    id=0x379d, seq=0/0, ttl=63 (request in 1413)
 1443 11:13:10.324831 172.22.216.210 → 10.10.10.94  ICMP 42 Echo (ping) request  id=0x1e55, seq=0/0, ttl=58
 1446 11:13:10.325277  10.10.10.94 → 172.22.216.210 ICMP 60 Echo (ping) reply    id=0x1e55, seq=0/0, ttl=63 (request in 1443)

Can anybody explain why nmap didn't report 10.10.10.94 as up in the first scan (packets 633-761)?

  • Not sure but from my point of view looks like there is a internal issue on nmap, my suggestion is to valgrind the command (valgrind ./nmap .....) and if you see reported issues from valgrind you should inform the nmap developers on the mailing list about it because could be a bug on it – camp0 Aug 10 at 10:27

It looks like an instance of Nmap's ARP scan misses alive hosts in some cases · Issue #92 · nmap/nmap - although I'm not certain. Several people have seen similar symptoms, but at the current state of this bug, nobody has a clue as to why.

Perhaps this was introduced between versions 4.11 and 4.53-1~bpo40+1 (debian version number). Perhaps not.

up vote 0 down vote accepted

For my particular case, the problem was the -PE option to nmap. If I run nmap with the -PE option, it finds inconsistent results in about 1/3 of runs, whereas without -PE it is consistent over several 1000s of runs.

So we just stopped using -PE.

Your Answer

 
discard

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.