Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

High CPU usage ncat on Windows #1688

Open
thomasfaingnaert opened this issue Aug 12, 2019 · 1 comment

Comments

@thomasfaingnaert
Copy link

commented Aug 12, 2019

The following scenario results in high CPU usage in Windows:

  1. Start a server that listens on localhost (IPv4 only):
ncat -lk4 127.0.0.1 6000

2a. Connect to that server, but let ncat try IPv6 connection first:

ncat -v localhost 6000

CPU usage of ncat is extremely high. Oddly enough, this doesn't happen in this alternate scenario:
2b. Connect to that server, but force IPv4:

ncat -v4 localhost 6000

Ncat version (downloaded from https://nmap.org/download.html):

Ncat: Version 7.80 ( https://nmap.org/ncat )

@thomasfaingnaert thomasfaingnaert changed the title High CPU usage netcat on Windows High CPU usage ncat on Windows Aug 12, 2019

@dmiller-nmap

This comment has been minimized.

Copy link

commented Aug 12, 2019

Confirmed. Here's the output with a bit more verbosity:

Without -4, 15% CPU usage:

>ncat -vvvvvv localhost 6000
Ncat: Version 7.80 ( https://nmap.org/ncat )
libnsock nsock_set_loglevel(): Set log level to DEBUG
NCAT DEBUG: Using trusted CA certificates from C:\Program Files (x86)\Nmap\ca-bundle.crt.
libnsock nsock_iod_new2(): nsock_iod_new (IOD #1)
libnsock event_new(): event_new (IOD #1) (EID #8)
libnsock nsock_connect_tcp(): TCP connection requested to ::1:6000 (IOD #1) EID 8
libnsock nsock_pool_add_event(): NSE #8: Adding event (timeout in 10000ms)
libnsock nsock_loop(): nsock_loop() started (no timeout). 1 events pending
libnsock nsock_trace_handler_callback(): Callback: CONNECT ERROR [No connection could be made because the target machine actively refused it.  (10061)] for EID 8 [::1:6000]
Ncat: Connection to ::1 failed: No connection could be made because the target machine actively refused it. .
Ncat: Trying next address...
libnsock event_new(): event_new (IOD #1) (EID #16)
libnsock nsock_connect_tcp(): TCP connection requested to 127.0.0.1:6000 (IOD #1) EID 16
libnsock nsock_pool_add_event(): NSE #16: Adding event (timeout in 10000ms)
libnsock event_delete(): event_delete (IOD #1) (EID #8)
libnsock nsock_trace_handler_callback(): Callback: CONNECT SUCCESS for EID 16 [127.0.0.1:6000]
Ncat: Connected to 127.0.0.1:6000.
libnsock nsock_iod_new2(): nsock_iod_new (IOD #2)
libnsock event_new(): event_new (IOD #1) (EID #26)
libnsock nsock_read(): Read request from IOD #1 [127.0.0.1:6000] (timeout: -1ms) EID 26
libnsock nsock_pool_add_event(): NSE #26: Adding event (timeout in 2024526038ms)
libnsock event_new(): event_new (IOD #2) (EID #34)
libnsock nsock_readbytes(): Read request for 0 bytes from IOD #2 [peer unspecified] EID 34
libnsock nsock_pool_add_event(): NSE #34: Adding event (timeout in 2024526038ms)
libnsock event_delete(): event_delete (IOD #1) (EID #16)
libnsock nsock_trace_handler_callback(): Callback: READ EOF for EID 34 [peer unspecified]

With -4, negligible CPU usage:

C:\Program Files (x86)\Windows Kits\10\Debuggers\x64>ncat -vvvvvv -4 localhost 6000
Ncat: Version 7.80 ( https://nmap.org/ncat )
libnsock nsock_set_loglevel(): Set log level to DEBUG
NCAT DEBUG: Using trusted CA certificates from C:\Program Files (x86)\Nmap\ca-bundle.crt.
libnsock nsock_iod_new2(): nsock_iod_new (IOD #1)
libnsock event_new(): event_new (IOD #1) (EID #8)
libnsock nsock_connect_tcp(): TCP connection requested to 127.0.0.1:6000 (IOD #1) EID 8
libnsock nsock_pool_add_event(): NSE #8: Adding event (timeout in 10000ms)
libnsock nsock_loop(): nsock_loop() started (no timeout). 1 events pending
libnsock nsock_trace_handler_callback(): Callback: CONNECT SUCCESS for EID 8 [127.0.0.1:6000]
Ncat: Connected to 127.0.0.1:6000.
libnsock nsock_iod_new2(): nsock_iod_new (IOD #2)
libnsock event_new(): event_new (IOD #1) (EID #18)
libnsock nsock_read(): Read request from IOD #1 [127.0.0.1:6000] (timeout: -1ms) EID 18
libnsock nsock_pool_add_event(): NSE #18: Adding event (timeout in 2024478101ms)
libnsock event_new(): event_new (IOD #2) (EID #26)
libnsock nsock_readbytes(): Read request for 0 bytes from IOD #2 [peer unspecified] EID 26
libnsock nsock_pool_add_event(): NSE #26: Adding event (timeout in 2024478101ms)
libnsock event_delete(): event_delete (IOD #1) (EID #8)

Tried with --nsock-engine poll and --nsock-engine iocp and the connection did not succeed. That should probably be a separate issue; I forget why only the select engine works in Ncat.

nmap-bot pushed a commit that referenced this issue Aug 15, 2019

Always delete old IOD before attempting reconnect
Trying to connect on the same IOD was leaking sockets, and may have
contributed to high CPU usage on Windows (See #1688)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
2 participants
You can’t perform that action at this time.