I was using nmap to scan the mac addresses of my network.What I found was internet connections and rest of network services badly clogged the users were not able to connect to internet.After messing with different things some times later we noticed on one of machines I was running nmap and stopping it did the trick.

nmap -sP

Is what I was trying and it basically clogged the entire network. Can some one suggest what can be a remedy for same and why it actually happened?


As some people suggested below it generates a lot of ARP traffic
1) is there a way I can measure this ARP traffic?
2) In this case since user applications could not reach internet is there some way I can detect congestion in network.Here nmap was run by me as root so I knew but for future I want to know.

  • If you use a poor quality router this might die when you do this kind of scan. – Frands Hansen Mar 12 '11 at 12:16
  • Ok I tried the above is ADSL 450 TC1 router. – Registered User Mar 12 '11 at 13:31

There is a difference between running nmap as root, and as a regular user.

Basically, when you run it as a regular user and the target machine blocks ICMP, nmap will do a complete three-way handshake and set up a complete TCP connection. This is more demanding than the "TCP ping" method that is used when you run it as root.

For more info, read part 5 of this tutorial.

As joeqwerty stated in the comments, doing a scan of such a broad spectrum causes a lot of ARP traffic on your network.

I'd like to point you to a another relevant page on nmap.org. It explains some tricks for specifiying scan targets.
Nmap really has excellent documentation.

  • +1. a /20 is 4094 valid ip addresses. that's quite a lot of tcp handshakes to generate if icmp is blocked. – petrus Mar 12 '11 at 13:14
  • I read your link I was running as root. – Registered User Mar 12 '11 at 13:31
  • 2
    @petrus, only if the OP actually has 4,094 hosts. There's no handshake if there's no host to shake hands with. Nmap, or any other tool, will only make connections to hosts that actually exist. It will ARP for every address in the network though, and that's a lot of ARP traffic. – joeqwerty Mar 12 '11 at 16:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.