Nmap sometimes shows negative latencies #863

Activity

1. dmiller-nmap

   added

   bug

   Nmap

   on Apr 22, 2017
2. szakharchenko commented on Feb 15, 2018

   

   szakharchenko

   on Feb 15, 2018

   Last edited by szakharchenko

   More actions

   1. nmap --version :

   Nmap version 7.40 ( https://nmap.org )
   Platform: x86_64-pc-linux-gnu
   Compiled with: liblua-5.3.3 openssl-1.1.0c libpcre-8.39 libpcap-1.8.1 nmap-libdnet-1.12 ipv6
   Compiled without:
   Available nsock engines: epoll poll select

   2. Options used: nmap -sP --packet-trace 192.168.1.1/24

   3. This is reproducible with high probability on bare hardware; OS Linux 4.9.0-4-amd64 I get this error scanning against my gpsd  #1 SMP Debian 4.9.65-3 (2017-12-03) x86_64 GNU/Linux

   4. Network is fairly generic, e1000e: eth0 NIC Link is Up 100 Mbps Full Duplex, Flow Control: Rx/Tx

   5. Relevant portions of output, with altered IPs/MACs:

   nmap -sP --packet-trace 192.168.1.1/24
   
   Starting Nmap 7.40 ( https://nmap.org ) at 2018-02-15 05:29 UTC
   ...
   SENT (1.6851s) ARP who-has 192.168.1.10 tell 192.168.1.2
   ...
   SENT (1.7859s) ARP who-has 192.168.1.10 tell 192.168.1.2
   SENT (1.8860s) ARP who-has 192.168.1.11 tell 192.168.1.2
   RCVD (1.6859s) ARP reply 192.168.1.10 is-at 40:40:40:40:40:40
   RCVD (1.7866s) ARP reply 192.168.1.10 is-at 40:40:40:40:40:40
   ...
   Nmap scan report for 192.168.1.10
   Host is up (-0.100s latency).
   MAC Address: 40:40:40:40:40:40 (Unknown)
   

   6. Analysis: it seems like the ARP request is sent multiple times, and when performing latency calculation, the first response's and the last request's timestamps are used, which gives -0.1s.

   👍React with 👍2Reacted by Remik and Pablo
3. P4z commented on Feb 26, 2019

   

   P4z

   on Feb 26, 2019

   More actions

   Hi, I wonder why there is no progress here.
   I can see negative latency values on my network when issuing nmap -sn -T5 ... with both versions: 7.40 and 7.70SVN. Isn't @szakharchenko's analysis correct?
4. szakharchenko commented on Feb 26, 2019

   

   szakharchenko

   on Feb 26, 2019

   More actions

   @P4z : nobody seems to care:)

   😄React with 😄2Reacted by Remik and Linbo

   😕React with 😕3Reacted by AbelHo, Antoni Spaanderman and Amarnath Jamale
5. nmap-bot

   closed this as completedin f519e64on Mar 1, 2019
6. GMedian

   added a commit that references this issue on Apr 3, 2024

   Avoid matching ARP/ND response with probes sent after it was received. …

   ...

   This issue will close once commit f519e64 is merged into the 'master' branch.

   f519e64