Repository navigation
Make Nmap (nsock) more tolerant of disappearing interfaces #3449
Description
We've received some complaints of a scan halting with:
pcap_next_ex() fatal error while reading from pcap: The interface disappeared (error code ERROR_DEVICE_REMOVED/STATUS_DEVICE_REMOVED)
It may just be the network interface temporarily disappearing (like disconnecting from wifi or switching to ethernet when plugging into a docking station). So we may want to try and handle this error more softly, like waiting a bit and trying again, and/or maybe recheck the routing table and switching to the new appropriate interface.
Activity
dmiller-nmap commentedon Sep 3, 2026
The immediate fix was 4f7743e, which removes calls to
fatal()from Nsock operations involving pcap handles. Instead, errors will be propagated the same way that connect and I/O errors are handled with network sockets. This will prevent transient things like NDIS stack pause events from crashing Nmap scans, but it doesn't fully resolve all complications involving disappearing network connections.