Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

[Bug] NMAPDEV (nmap) runs unprivileged under UID 20211 ('You are not root -- using TCP pingscan rather than ICMP'), breaking ARP/ICMP discovery and MAC detection

Abierto
  • ¿Algo no está bien?
#1,852 1 comentario 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
3/5
Tiempo estimado
Medio día
Aptitud para principiantes
57/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
docker, linux, python
Área
backend, networking

Línea de trabajo

Start by reading the NMAPDEV configuration at server/plugins/nmap_dev_scan/config.json and the container Dockerfile; the report identifies both as possible places to address the privilege detection behavior. Reproduce the default scan under UID 20211 with the listed capabilities and compare its output with a scan using --privileged. Done means the configured scan uses raw ARP and ICMP probes and returns real MAC addresses for local hosts.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

bug 🐛 next release/in dev image 🚀 Waiting for reply⏳
What installation are you running?

Production (netalertx) 📦

Is there an existing issue for this?
The issue occurs in the following browsers. Select at least 2.
  • Firefox
  • Chrome
  • Edge
  • Safari (unsupported) - PRs welcome
  • N/A - This is an issue with the backend
Current Behavior

Since the container runs as the non-root user netalertx (UID 20211) with Linux capabilities (CAP_NET_RAW, CAP_NET_ADMIN) and /usr/bin/sudo is a pass-through wrapper (#!/bin/sh / "$@"), running NMAPDEV with its default arguments (sudo nmap -sn -PR -oX - ) causes nmap to check geteuid() == 0, assume it is unprivileged, and print:

Warning:  You are not root -- using TCP pingscan rather than ICMP

As a result:

  1. On local subnets: nmap does not perform raw ARP discovery (-PR is ignored) and does not return MAC addresses in the XML output (mac == ''). Consequently, nmap_dev.py either skips all local hosts (IP or MAC missing) or, if NMAPDEV_FAKE_MAC=True is enabled, generates duplicate fa:ce:... fake MACs for local devices that actually have real MAC addresses.
  2. On routed/remote subnets: nmap cannot send raw ICMP echo probes and falls back to unprivileged TCP connect() on ports 80 and 443 only, missing all hosts (smartphones, tablets, IoT appliances, printers) that do not have port 80/443 open and only reply to ICMP ping.
Expected Behavior

nmap should utilize the container's CAP_NET_RAW / CAP_NET_ADMIN capabilities when running under UID 20211 so that raw ARP (-PR) and ICMP echo (-PE) scans work as intended and local MAC addresses are properly retrieved.

Suggested Fix:
nmap natively supports running with Linux capabilities under non-root UIDs when either:

  1. ENV NMAP_PRIVILEGED=1 is set in the container environment (Dockerfile), or
  2. --privileged is added to the default NMAPDEV_ARGS in server/plugins/nmap_dev_scan/config.json (e.g. sudo nmap --privileged -sn -PR -oX - ).
Steps To Reproduce
  1. Run NetAlertX with the recommended hardened docker-compose.yml (UID 20211, cap_add: NET_RAW, NET_ADMIN).
  2. Enable NMAPDEV with default NMAPDEV_ARGS='sudo nmap -sn -PR -oX - '.
  3. Observe Warning: You are not root -- using TCP pingscan rather than ICMP in stderr and missing MAC addresses / missed ICMP-only hosts in nmap_dev.py output.
  4. Set NMAPDEV_ARGS='sudo nmap --privileged -sn -PR -oX - ' (or NMAP_PRIVILEGED=1) -> nmap immediately uses raw sockets, returns arp-response with real MAC addresses on local subnets, and echo-reply on routed subnets.
Relevant app.conf settings
LOADED_PLUGINS=['ARPSCAN', 'NMAPDEV', ...]
NMAPDEV_RUN='schedule'
NMAPDEV_FAKE_MAC=True
# Default (broken under UID 20211):
NMAPDEV_ARGS='sudo nmap -sn -PR -oX - '
# Working workaround:
NMAPDEV_ARGS='nmap --privileged -sn -PE -oX - '
docker-compose.yml
services:
  netalertx:
    image: ghcr.io/netalertx/netalertx:26.10.0
    network_mode: host
    cap_drop:
      - ALL
    cap_add:
      - NET_ADMIN
      - NET_RAW
      - NET_BIND_SERVICE
Debug or Trace enabled
  • I have read and followed the steps in the wiki link above and provided the required debug logs and the log section covers the time when the issue occurs.
Relevant app.log section
[NMAPDEV] Executing: sudo nmap -sn -PR -oX - 192.168.101.0/24
Warning:  You are not root -- using TCP pingscan rather than ICMP
[NMAPDEV] Found 2 devices
Docker Logs
[NMAPDEV] Executing: sudo nmap -sn -PR -oX - 192.168.101.0/24
Warning:  You are not root -- using TCP pingscan rather than ICMP
Lenguaje dominante
Python
Estrellas
7.2k
Forks
456
Merge medio
16 h 25 min
PR fusionados (30 d)
30

Preparar el entorno

Abrir en Codespaces

Inicia el contenedor de desarrollo del proyecto en tu navegador, con tu propia cuenta de GitHub.

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de netalertx/NetAlertX

Todos los issues de netalertx/NetAlertX

Issues similares

Más issues de Python

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.