Same issue here:

Environment

root@gslab:~/scan# uname -a
Linux gslab 4.15.0-20-generic #21-Ubuntu SMP Tue Apr 24 06:16:15 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux

root@gslab:~/scan# nmap --version

Nmap version 7.60 ( https://nmap.org )
Platform: x86_64-pc-linux-gnu
Compiled with: liblua-5.3.3 openssl-1.1.0g nmap-libssh2-1.8.0 libz-1.2.8 libpcre-8.39 libpcap-1.8.1 nmap-libdnet-1.12 ipv6
Compiled without:
Available nsock engines: epoll poll select

Input files

One file has 10 hosts, the other has 11 hosts:

root@gslab:~/scan# diff -c  11_host.txt 10_host.txt
*** 11_host.txt 2020-02-06 11:35:34.447408421 +0000
--- 10_host.txt 2020-02-06 11:35:45.687494164 +0000
***************
*** 8,11 ****
  10.155.193.19
  10.155.193.20
  10.155.193.21
- 10.155.193.29
--- 8,10 ----

10 hosts

root@gslab:~/scan# nmap  -sS  --top-ports 1 -iL 10_host.txt | grep "report for" -c
10

11 hosts

root@gslab:~/scan# nmap  -sS  --top-ports 1 -iL 11_host.txt | grep "report for" -c
10

When the list contains 11 hosts, the first one is skipped.

tcpdump

We can see an ARP req/resp for both hosts, but we ignore the response for the first one and send a second arp req:

root@gslab:~/scan# tcpdump -veenr /var/tmp/nmap.pcap -s0 arp
reading from file /var/tmp/nmap.pcap, link-type EN10MB (Ethernet)
12:15:32.661573 00:50:56:86:2e:50 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 42: Ethernet (len 6), IPv4 (len 4), Request who-has 10.155.193.11 tell 10.155.193.1, length 28
12:15:32.662294 00:50:56:86:36:64 > 00:50:56:86:2e:50, ethertype ARP (0x0806), length 60: Ethernet (len 6), IPv4 (len 4), Reply 10.155.193.11 is-at 00:50:56:86:36:64, length 46
12:15:32.849134 00:50:56:86:2e:50 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 42: Ethernet (len 6), IPv4 (len 4), Request who-has 10.155.193.10 tell 10.155.193.1, length 28
12:15:32.850265 00:50:56:86:6b:7d > 00:50:56:86:2e:50, ethertype ARP (0x0806), length 60: Ethernet (len 6), IPv4 (len 4), Reply 10.155.193.10 is-at 00:50:56:86:6b:7d, length 46
12:15:32.949309 00:50:56:86:2e:50 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 42: Ethernet (len 6), IPv4 (len 4), Request who-has 10.155.193.10 tell 10.155.193.1, length 28
12:15:32.950463 00:50:56:86:6b:7d > 00:50:56:86:2e:50, ethertype ARP (0x0806), length 60: Ethernet (len 6), IPv4 (len 4), Reply 10.155.193.10 is-at 00:50:56:86:6b:7d, length 46

switching order

If i switch the first two hosts in the file, I get the same result:

root@gslab:~/scan# head -n2 11_host.txt
10.155.193.11
10.155.193.10
root@gslab:~/scan# nmap  -sS  --top-ports 1 -iL 11_host.txt | grep "report for" -c
10
root@gslab:~/scan# nmap  -sS  --top-ports 1 -iL 11_host.txt | grep "report for"
Nmap scan report for 10.155.193.11
Nmap scan report for 10.155.193.12
Nmap scan report for 10.155.193.13
Nmap scan report for 10.155.193.14
Nmap scan report for 10.155.193.15
Nmap scan report for 10.155.193.18
Nmap scan report for 10.155.193.19
Nmap scan report for 10.155.193.20
Nmap scan report for 10.155.193.21
Nmap scan report for 10.155.193.29

Nmap's ARP scan misses alive hosts in some cases #92

Description

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions