May 14, 2007

Nmap getinterfaces failure on OS X with VMware installed

There was a recent post on the Nmap Development mailing list about an nmap/vmware osx bug.  I recently experienced the same thing and after brief mention from a co-worker about VMware Fusion’s network interfaces not being “real” interfaces, and confirming this by opening up the Network Preference pane and not having the vmnet interfaces be listed under Network Port Configuration - I dug into the problem a little bit deeper.  The specific error I was getting was the following:

$ sudo nmap –iflist
Starting Nmap 4.20 ( http://insecure.org ) at 2007-05-14 14:09 PDT
getinterfaces: Failed to open ethernet interface (vmnet8). A possible cause on BSD operating systems is running out of BPF devices (see http://seclists.org/lists/nmap-dev/2006/Jan-Mar/0014.html).
QUITTING!

A quick look at my process list for vmware stuff (ps -aux | grep -i vmw) showed the following processes:

root 108 0.0 -0.0 27296 56 ?? Ss Wed01AM 0:00.00 /Library/Application Support/VMware Fusion/vmnet-netifup -d /var/run/vmnet-netif-vmnet8.pid vmnet8 vmnet8
root 111 0.0 -0.0 27296 56 ?? Ss Wed01AM 0:00.00 /Library/Application Support/VMware Fusion/vmnet-netifup -d /var/run/vmnet-netif-vmnet1.pid vmnet1 vmnet1

Ahh, so they aren’t “real” interfaces.  A quick `kill -9 108 111` and Nmap was again able to run successfully.

4 Comments so far
Leave a comment

Nice, I just ran into this last night after installing vmware.

The dreaded kill -9!!

I can’t use it anymore without thinking of Hans Reiser: http://www.wired.com/politics/law/news/2007/05/reiser

Oh, the irony!

For what its worth…. I created a quick little script to make nmap work on my mac while VMware Fusion is installed.
#!/bin/sh
/Library/Application\ Support/VMware\ Fusion/boot.sh –stop &> /dev/null
/opt/local/bin/nmap $@
/Library/Application\ Support/VMware\ Fusion/boot.sh –start &> /dev/null
~

@Damon: Thanks for the tip, this was a life saver. @jlaroffon: thanks for the script. :)



Leave a comment
Line and paragraph breaks automatic, e-mail address never displayed, HTML allowed: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>