Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

[Bug] NMAPDEV (nmap) runs unprivileged under UID 20211 ('You are not root -- using TCP pingscan rather than ICMP'), breaking ARP/ICMP discovery and MAC detection

Open
  • Is something wrong?
#1,852 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
Half a day
Newbie friendliness
57/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
docker, linux, python
Domain
backend, networking

Research direction

Start by reading the NMAPDEV configuration at server/plugins/nmap_dev_scan/config.json and the container Dockerfile; the report identifies both as possible places to address the privilege detection behavior. Reproduce the default scan under UID 20211 with the listed capabilities and compare its output with a scan using --privileged. Done means the configured scan uses raw ARP and ICMP probes and returns real MAC addresses for local hosts.

Written by the indexing model from the issue text.

Description

What installation are you running?

Production (netalertx) 📦

Is there an existing issue for this?
The issue occurs in the following browsers. Select at least 2.
  • Firefox
  • Chrome
  • Edge
  • Safari (unsupported) - PRs welcome
  • N/A - This is an issue with the backend
Current Behavior

Since the container runs as the non-root user netalertx (UID 20211) with Linux capabilities (CAP_NET_RAW, CAP_NET_ADMIN) and /usr/bin/sudo is a pass-through wrapper (#!/bin/sh / "$@"), running NMAPDEV with its default arguments (sudo nmap -sn -PR -oX - ) causes nmap to check geteuid() == 0, assume it is unprivileged, and print:

Warning:  You are not root -- using TCP pingscan rather than ICMP

As a result:

  1. On local subnets: nmap does not perform raw ARP discovery (-PR is ignored) and does not return MAC addresses in the XML output (mac == ''). Consequently, nmap_dev.py either skips all local hosts (IP or MAC missing) or, if NMAPDEV_FAKE_MAC=True is enabled, generates duplicate fa:ce:... fake MACs for local devices that actually have real MAC addresses.
  2. On routed/remote subnets: nmap cannot send raw ICMP echo probes and falls back to unprivileged TCP connect() on ports 80 and 443 only, missing all hosts (smartphones, tablets, IoT appliances, printers) that do not have port 80/443 open and only reply to ICMP ping.
Expected Behavior

nmap should utilize the container's CAP_NET_RAW / CAP_NET_ADMIN capabilities when running under UID 20211 so that raw ARP (-PR) and ICMP echo (-PE) scans work as intended and local MAC addresses are properly retrieved.

Suggested Fix:
nmap natively supports running with Linux capabilities under non-root UIDs when either:

  1. ENV NMAP_PRIVILEGED=1 is set in the container environment (Dockerfile), or
  2. --privileged is added to the default NMAPDEV_ARGS in server/plugins/nmap_dev_scan/config.json (e.g. sudo nmap --privileged -sn -PR -oX - ).
Steps To Reproduce
  1. Run NetAlertX with the recommended hardened docker-compose.yml (UID 20211, cap_add: NET_RAW, NET_ADMIN).
  2. Enable NMAPDEV with default NMAPDEV_ARGS='sudo nmap -sn -PR -oX - '.
  3. Observe Warning: You are not root -- using TCP pingscan rather than ICMP in stderr and missing MAC addresses / missed ICMP-only hosts in nmap_dev.py output.
  4. Set NMAPDEV_ARGS='sudo nmap --privileged -sn -PR -oX - ' (or NMAP_PRIVILEGED=1) -> nmap immediately uses raw sockets, returns arp-response with real MAC addresses on local subnets, and echo-reply on routed subnets.
Relevant app.conf settings
LOADED_PLUGINS=['ARPSCAN', 'NMAPDEV', ...]
NMAPDEV_RUN='schedule'
NMAPDEV_FAKE_MAC=True
# Default (broken under UID 20211):
NMAPDEV_ARGS='sudo nmap -sn -PR -oX - '
# Working workaround:
NMAPDEV_ARGS='nmap --privileged -sn -PE -oX - '
docker-compose.yml
services:
  netalertx:
    image: ghcr.io/netalertx/netalertx:26.10.0
    network_mode: host
    cap_drop:
      - ALL
    cap_add:
      - NET_ADMIN
      - NET_RAW
      - NET_BIND_SERVICE
Debug or Trace enabled
  • I have read and followed the steps in the wiki link above and provided the required debug logs and the log section covers the time when the issue occurs.
Relevant app.log section
[NMAPDEV] Executing: sudo nmap -sn -PR -oX - 192.168.101.0/24
Warning:  You are not root -- using TCP pingscan rather than ICMP
[NMAPDEV] Found 2 devices
Docker Logs
[NMAPDEV] Executing: sudo nmap -sn -PR -oX - 192.168.101.0/24
Warning:  You are not root -- using TCP pingscan rather than ICMP
Dominant language
Python
Stars
7.2k
Forks
456
Avg merge
17h 59m
Merged PRs (30d)
26

Getting set up

Open in Codespaces

Starts the project's dev container in your browser, under your own GitHub account.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from netalertx/NetAlertX

All issues in netalertx/NetAlertX

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.