nmap "QUITTING!" error during SYN scan of in-scope authorized subnet
Fixes nmap's QUITTING! abort on SYN scans during an authorized engagement: getting raw-socket privilege with root or setcap, or falling back to a connect scan. Use when -sS dies instantly on Linux. Not for scans that fail after packets go out.
TL;DR
QUITTING! during a SYN scan means nmap could not get the raw-socket access a stealth scan needs. You are almost certainly running as a non-root user without the right capabilities. Run the scan as root, grant the capability with setcap, or switch to a connect scan (-sT) that does not need raw sockets.
QUITTING!Use this when
- The scan aborts immediately with just the word QUITTING!.
- You passed -sS (or the default root scan) on Linux.
- The targets are inside your authorized scope.
Not for this skill when
- The scan starts and then fails partway. That is a network problem, not privilege.
- You already run as root. Look at interface or pcap issues instead.
Steps
- Check who you are:
id -u. If it prints anything other than 0, you lack root. Verify: you know whether privilege is the gap. - Simplest fix on your own test box: re-run with sudo:
sudo nmap -sS 192.0.2.0/24. Verify: the scan starts instead of quitting. - If you cannot run as root but own the box, grant the capability once:
sudo setcap cap_net_raw,cap_net_admin,cap_net_bind_service+eip $(which nmap). Verify:nmap -sS 192.0.2.1runs as your normal user. - If neither option exists, fall back to a connect scan:
nmap -sT 192.0.2.0/24. It is louder and slower, but needs no special privilege. Verify: the scan completes and reports ports. - Confirm the target list matches your written authorization before any full-subnet run. Verify: the scan range equals the approved scope.
Compatibility: nmap 7.x on Linux. On macOS and Windows the privilege model differs; -sT fallback applies everywhere.
Variant phrasings
nmap quitting syn scan
Same fix path, common phrasing.
nmap -sS quitting immediately
Symptom-level search.
nmap raw socket permission denied scan abort
The underlying cause phrased differently.
Why it happens
A SYN scan crafts raw IP packets, which requires CAPNETRAW on Linux. Without root or the capability, nmap's packet path fails to initialize and the program aborts with QUITTING! before touching the network. Docker containers and locked-down test boxes hit this constantly.
Edge cases / pitfalls
- setcap breaks if the nmap binary is replaced by an update. Re-apply after upgrades.
- In containers you may need --cap-add=NET_RAW on the container itself, not just inside it.
- -sT connect scans leave full TCP handshakes in target logs. Confirm the engagement rules allow that noise before switching.
- Never escalate privilege on a box you do not own. QUITTING! on someone else's host is a stop sign.
Provenance
Resolved from the public thread: https://vectle.com/posts/pstIFSJxGXTi6j1GgQ0i3W6A