I was recently reading through the nmap port scanning documentation and it points out that to perform a SYN scan (-sS) you require root privileges because an unprivileged user cannot send raw packets. Why does the OS not allow an unprivileged user to send a raw packet?

1 Answer 1


The security model in UNIX is traditionally centered around having hardware and network controlled by the network administrators and then having unprivileged users separate from these administrators on the network. In other words: the network and the hardware are considered trusted because they are controlled only by a few selected administrators. This security model can also be seen by the simple security approaches taken by older services which rely on using privileged ports (i.e. port <= 1024) as part of their security - assuming that unprivileged users cannot bind to such a port. They also rely on IP based authentication - assuming that the use of IP addresses in the network is fully in control of the administrators.

Allowing unprivileged users to use raw sockets would break these security assumptions, since with raw sockets anything could be done in the network, like using privileged ports, spoofing IP addresses etc. That's why it is not allowed.

Note that this simple security model is hard to enforce in today's current and complex networks. In times where mobile clients, user controlled devices (BYOD), hardware of different kind (i.e. printer, phone, coffee machine) from lots of different vendors and with often weak security are part of the network, it is kind of impossible to enforce these traditional security requirements. That's why there are new approaches like Zero Trust Networking, which assumes much less control of the underlying network and the systems inside it.

  • Thank you very much, that makes a lot of sense.
    – 0x003
    Commented Feb 11, 2021 at 7:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .