# Weird things happening with \`nmap -sP\`
**URL:** https://discourse.nodered.org/t/weird-things-happening-with-nmap-sp/88277
**Category:** General
**Created:** [26 May 2024 10:37 UTC](https://discourse.nodered.org/t/weird-things-happening-with-nmap-sp/88277 "2024-05-26T10:37:46Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@Trying\_to\_learn](https://discourse.nodered.org/u/Trying_to_learn)
#### Post date: [26 May 2024 10:37 UTC](https://discourse.nodered.org/t/weird-things-happening-with-nmap-sp/88277/1 "2024-05-26T10:37:46Z")
Folks,
I'm doing a command `nmap -sP /24` every 20 seconds.
Then filtering out for the devices via a `switch` node.
This (filtered) message then goes into a `trigger` node with a 60 seconds timeout.
The 60 is what it has been increased to recently for the reason I shall now explain.
And then another couple of nodes before displaying the status.
One of the nodes is a `function` node that can change the _name_ displayed.
By default it shows the IP address (last digit) and if a special message is sent to the devices they broadcast their _name_ and the name is displayed rather than the IP number.
_(Side note)_
The device is an arduino `node MCU` via wifi.
I've been told/heard that that kind of chip is not reliable on WiFi connections.
_(end side note)_
Time and time again I force the _name_ to be displayed and in a shortish amount of time, it falls back to the IP number.
This happens if the `trigger` times out and shows the device as not connected.
Sod's law has it that as I am typing this: things won't go wrong.
But what I've seen is that the `nmap` command is sent but ONLY the WAP replies and not the device.
So is this because of the poor WiFi on the `node MCU` or ...... something else?
Yeah, kinda rhetorical, but if I don't ask...... Sod's other law will apply.
Thoughts?
---
### Author:  [@bakman2](https://discourse.nodered.org/u/bakman2)
#### Post date: [26 May 2024 10:48 UTC](https://discourse.nodered.org/t/weird-things-happening-with-nmap-sp/88277/2 "2024-05-26T10:48:44Z")
Note that nmap will only show hostnames with sudo.
see difference on commandline between with and without sudo.
---
### Author:  [@Trying\_to\_learn](https://discourse.nodered.org/u/Trying_to_learn)
#### Post date: [26 May 2024 10:54 UTC](https://discourse.nodered.org/t/weird-things-happening-with-nmap-sp/88277/3 "2024-05-26T10:54:59Z")
Thanks.
Yeah, I _got around_ that problem - to call it a problem - a different way.
Originally I didn't use `nmap`. It was more a complicated `ping` and the `ping response` was used.
But as my network grew and other things, adding to the `ping list` became too tedious.
Though I do have to do a similar thing with `nmap` at least it is a bit more _structured_ and is easily expanded as I add new devices.
So I send a _command_ via MQTT and the device broadcasts its _name_ and that is detected, stored in the `function` node and so when the device is saying _I'm alive_ rather than sending the last bit of the IP address, the name is sent.
But once/if the `trigger` node times out, the device is marked as OFF LINE and so subsequent times when it is _back on line_ it falls back to the IP address.
I am still not sure why I am doing this, but if the network needs to be ... rescanned (?) or the machine that is doing this is restarted all things are set back to _default_.
It just interests me why this is happening.
I've seen a few replies after sending the MQTT command to tell the device to broadcast it's name only return the WAP IP address from the `nmap` command and then some time later, the device does show up.
So I'm just not sure what is going on.
# UPDATE
(Gotta be lucky)
With no known things happening this shows how it _fails_.
`9:01:01` has a few _hits_ for multiple messages received.
Not sure that is of importance, but thought I would share that observation.
---
### Author:  [@system](https://discourse.nodered.org/u/system)
#### Post date: [24 August 2024 10:55 UTC](https://discourse.nodered.org/t/weird-things-happening-with-nmap-sp/88277/4 "2024-08-24T10:55:03Z")
This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.