On Tue, Dec 09, 2003 at 09:34:12AM +1100, Joyce, Matthew wrote: > > I am trying to run 'nmap -sP xxx.xxx.xxx.0/24' and then 'arp -a' on two pcs > on two different networks. > > On one woody box nmap runs as quick as I would expect... > Nmap run completed -- 256 IP addresses (83 hosts up) scanned in 8 seconds > > On another woody box on a different network it takes much much longer to run > and I am only trying to scan half as many. > Nmap run completed -- 128 IP addresses (44 hosts up) scanned in 220 > seconds > > Furthermore, after the nmap ping scan, arp produces lots of mac addresses > for the faster nmap but only 2 mac addresses for the slower one.
Perhaps most of the arp entries have expired after the long scan. > > I'm not sure how to progress this, I'm going over later to change the > physical port, to see if that might help. > Noone on that network has reported any problems. > The slow box has an old Tulip' nic of unknown history. I think you said it yourself. Slow box - old NIC. Possibly old driver - you could try upgrading your kernel. Of course the other network may have different implications - perhaps there is more traffic, or perhaps one or more hosts are running firewalls that stall the nmap probing effort. Why not run the scans again, swapping the network / scanning host relationship? A -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
