Re: Weird Crash - "WAITING_TO_RUNNING"

[David Fifield <david () bamsoftware com>]

On Wed, Nov 03, 2010 at 09:40:45PM -0700, David Fifield wrote:
> Try doing your scan with fewer ports at full speed and see if they are
> wrongly marked open. Like this:
>
> /usr/bin/sudo /usr/bin/nmap -sS -sV -T4 --top-ports 100 74.62.92.70 -P0 -v
>
> You should not get more open ports than you got with --scan-delay. If
> you get more open ports, there's something weird going on that we have
> to figure out. Run with the -v option and you'll be notified of open
> ports in real time; that way you'll be able to see if you're getting a
> flood of them.
>
> For what it's worth, I just tried the scan and I am getting a flood of
> them:
>
> Discovered open port 30749/tcp on 74.62.92.70
> Discovered open port 48748/tcp on 74.62.92.70
> Discovered open port 8235/tcp on 74.62.92.70

Putting aside the question of where all the open ports are coming from
(I don't think that's Nmap's fault), we should do something about Nmap
spawning too many scripts at once. I think it is the case that Nmap
allocates memory for all script threads at once and runs them all at
once. We could put a limit on the number of scripts that run at once,
either doing them in batches like Nmap's host groups, or running up to a
certain number and then only starting a new thread after an existing one
has finished.

David Fifield
_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://seclists.org/nmap-dev/