I'm a security newbie trying to scan a VPN in the range - using nmap on Kali Linux.

The routing table:

route -n

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface         UG    100    0        0 eth0   UG    1      0        0 tun0   UG    0      0        0 tun0   UG    1      0        0 tun0   U     100    0        0 eth0   UG    0      0        0 tun0   U     0      0        0 tun0

I tried to scan the entire private network range at once but this caused nmap to quit after a period of time.

I then tried scanning blocks of 256 IP addresses at a time, beginning with

nmap -sS

Scans in the range - complete quickly, but scans in the range - are exponentially slower and usually do not complete.

Is there something about the routing of the network that is affecting this? Is there something I'm completely missing?

  • Try --min-rate ; --max-rate , this way it won't freeze.
    – tungsten
    Sep 11, 2019 at 13:40
  • Impossible to tell given the information provided. and are routed the same (via so whatever is happening, happens after the packets leave your system.
    – gowenfawr
    Sep 11, 2019 at 13:41
  • This is a N question
    – tungsten
    Sep 11, 2019 at 13:50
  • 1
    See also this question; if the slow networks show 'Filtered' rather than 'Closed' then you're getting a lot more retransmits and timeouts on that network, which might explain it.
    – gowenfawr
    Sep 11, 2019 at 14:23

1 Answer 1


This route:   UG    0      0        0 tun0

With .252.0, you've got a range between and So when you hit IP's in, you'll start using your default route which is a different gateway.

Check me to be sure, but based on that bitmask, I think that's what you're seeing.


Might double-check me though.

Not the answer you're looking for? Browse other questions tagged or ask your own question.