nmap port doesn't run or runs slow as root

[gunnmjk@…]

The nmap port will not perform scans, or performs scans extra slow when run as root. It will run fine under my userspace, but certain scans cannot be run without root. This is on a fresh install of Mac OS X Snow Leopard 10.6.2. After installing from source on their website, I had no problems.

I ran

$ sudo port install nmap

then ran

$ sudo nmap -d 10.0.1.0/24

After the initial output, I didn't not receive any output for 15 minutes before I finally cancelled the process.

I then uninstalled the nmap port, then installed nmap from source. This time, I received the output that I expected.

$ sudo nmap -d 10.0.1.0/24
...
Nmap done: 256 IP addresses (6 hosts up) scanned in 54.73 seconds
           Raw packets sent: 10042 (440.834KB) | Rcvd: 5455 (223.914KB)

[danielluke (Daniel J. Luke)]

I would guess that this is actually a libpcap issue (as your non-macports nmap would have linked with the system libpcap), but I haven't verified that yet.

[gunnmjk@…]

Good guess, "$sudo port deactivate libpcap" resolved the issue! So now the question is, what is going on in the libpcap port?

[danielluke (Daniel J. Luke)]

Not sure exactly, but here's the gdb bt from when nmap is stuck:

(gdb) bt
#0  0x00007fff84f9d424 in read ()
#1  0x000000010012042a in pcap_read_bpf ()
#2  0x0000000100121501 in pcap_next ()
#3  0x0000000100012d0f in readip_pcap ()
#4  0x0000000100036657 in UltraScanInfo::removeCompletedHosts ()
#5  0x0000000100039def in ultra_scan ()
#6  0x000000010000cb54 in load_exclude ()
#7  0x000000010000d1d2 in nexthost ()
#8  0x0000000100008333 in nmap_main ()
#9  0x00000001000038bb in main ()

[gunnmjk@…]

Can we have nmap just use the system libpcap library?

[danielluke (Daniel J. Luke)]

Replying to gunnmjk@…:

Can we have nmap just use the system libpcap library?

We usually avoid that sort of thing per policy:

​http://trac.macports.org/wiki/FAQ#syslibs

It might make sense to link with the system one in this case unless we can get the macports one fixed.

[ghosthound]

resolved in r62830 (tested on 10.6.2 and 10.5.8)