Need for CAP_NET_ADMIN on Linux

SecWiki entry Running nmap as an unprivileged user states:

Nmap requires the following capabilities: CAP_NET_RAW, CAP_NET_ADMIN, CAP_NET_BIND_SERVICE.

I was unable to find any need for CAP_NET_ADMIN. Specifically:

• Libpcap activates promiscuous mode in a way that requires only CAP_NET_RAW. It favors PACKET_MR_PROMISC over SIOCSIFFLAGS.
• Libdnet contains a bunch of ioctl() calls that require CAP_NET_ADMIN, such as inside intf_set() or route_add(), but Nmap does not seem to consume them.
• No other offending ioctl() calls found.

Could somebody please provide any insights what I have missed?