3

I was using nmap to scan the mac addresses of my network.What I found was internet connections and rest of network services badly clogged the users were not able to connect to internet.After messing with different things some times later we noticed on one of machines I was running nmap and stopping it did the trick.

nmap -sP 192.168.1.0/20

Is what I was trying and it basically clogged the entire network. Can some one suggest what can be a remedy for same and why it actually happened?

EDIT

As some people suggested below it generates a lot of ARP traffic
1) is there a way I can measure this ARP traffic?
2) In this case since user applications could not reach internet is there some way I can detect congestion in network.Here nmap was run by me as root so I knew but for future I want to know.

Improve this question
2
  • If you use a poor quality router this might die when you do this kind of scan.
    – Frands Hansen
    Mar 12, 2011 at 12:16
  • Ok I tried the above is ADSL 450 TC1 router.
    – Registered User
    Mar 12, 2011 at 13:31

1 Answer 1

Reset to default
6

There is a difference between running nmap as root, and as a regular user.

Basically, when you run it as a regular user and the target machine blocks ICMP, nmap will do a complete three-way handshake and set up a complete TCP connection. This is more demanding than the "TCP ping" method that is used when you run it as root.

For more info, read part 5 of this tutorial.

As joeqwerty stated in the comments, doing a scan of such a broad spectrum causes a lot of ARP traffic on your network.

I'd like to point you to a another relevant page on nmap.org. It explains some tricks for specifiying scan targets.
Nmap really has excellent documentation.

Improve this answer
3
  • +1. a /20 is 4094 valid ip addresses. that's quite a lot of tcp handshakes to generate if icmp is blocked.
    – petrus
    Mar 12, 2011 at 13:14
  • I read your link I was running as root.
    – Registered User
    Mar 12, 2011 at 13:31
  • 2
    @petrus, only if the OP actually has 4,094 hosts. There's no handshake if there's no host to shake hands with. Nmap, or any other tool, will only make connections to hosts that actually exist. It will ARP for every address in the network though, and that's a lot of ARP traffic.
    – joeqwerty
    Mar 12, 2011 at 16:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .