#3510·nmap

Nping: wrong sockaddr length passed to nsock_iod_set_localaddr breaks --tcp-connect and unprivileged --udp on macOS/BSD

Author: MRX-72Created Sep 22, 2026Updated Sep 22, 2026

Describe the bug

On macOS and the BSDs nping --tcp-connect fails on every single probe, and unprivileged nping --udp has the same problem. Nothing ever gets sent.

Both probe handlers in nping/ProbeMode.cc pass sizeof(sockaddr_storage), i.e. 128, as the length of the local address:

nping/ProbeMode.cc:1874   nsock_iod_set_localaddr(fds[packetno%max_iods], o.getSourceSockAddr(&ss), sizeof(sockaddr_storage));
nping/ProbeMode.cc:2083   nsock_iod_set_localaddr(fds[packetno%max_iods], o.getSourceSockAddr(&ss), sizeof(sockaddr_storage));

The address itself is only a sockaddr_in or a sockaddr_in6. nsock_iod_set_localaddr() copies that length into nsi->locallen as given (nsock/src/nsock_iod.c:392) and mksock_bind_addr() hands it to bind() unchanged. Linux doesn't mind the oversized length, but the BSD stacks validate it and return EINVAL, so the bind fails and the connection attempt goes nowhere.

This looks like the same defect as #3438. 84420aa3 corrected the length in NmapOps::setSourceSockAddr(), Target::setSourceSockAddr() and NpingTarget::setSourceSockAddr(), but these two call sites pass the length straight into nsock, so none of those three apply to them.

To Reproduce

Have something listening on 18080, then:

$ nping --tcp-connect -p 18080 127.0.0.1 -c 5 --rate 5

Starting Nping 7.991SVN ( https://nmap.org/nping )
libnsock mksock_bind_addr(): Bind to 0.0.0.0:0 failed (IOD #1): Invalid argument (22)
RCVD (0.0012s) Possible TCP RST received from 0.0.0.0:0 --> Invalid argument
SENT (0.0013s) Starting TCP Handshake > 127.0.0.1:18080
...
TCP connection attempts: 5 | Successful connections: 0 | Failed: 5 (100.00%)

nping --udp -p 18080 127.0.0.1 without root hits the same bind failure.

Expected behavior

The handshakes should complete. Both handlers already work out the correct length into sslen a few lines earlier for the destination sockaddr, and using that gives:

TCP connection attempts: 5 | Successful connections: 5 | Failed: 0 (0.00%)

I also checked that --source-port still binds where you ask it to afterwards, using a listener that prints the client's source port, and that IPv6 works against an ::1 listener.

Version info (please complete the following information):

  • OS: macOS 26.3 (Darwin 25.3.0, arm64)
  • Output of nping --version: Nping version 7.991SVN ( https://nmap.org/nping ), built from master at d70c2d9
  • Output of nmap --version: n/a, I only built nping out of the tree
  • Output of nmap --iflist: n/a

Additional context

This is easy to miss because the bind error only appears in the nsock log line. At normal verbosity you just see every connect fail, which reads like the target refusing you rather than something going wrong locally. #1939 covers that side of it.

I have a patch and will send a PR.