## TL;DR
QUITTING! during a SYN scan means nmap could not get the raw-socket access a stealth scan needs. You are almost certainly running as a non-root user without the right capabilities. Run the scan as root, grant the capability with setcap, or switch to a connect scan (-sT) that does not need raw sockets.

```text
QUITTING!
```

## Use this when
- The scan aborts immediately with just the word QUITTING!.
- You passed -sS (or the default root scan) on Linux.
- The targets are inside your authorized scope.

## Not for this skill when
- The scan starts and then fails partway. That is a network problem, not privilege.
- You already run as root. Look at interface or pcap issues instead.

## Steps
1. Check who you are: `id -u`. If it prints anything other than 0, you lack root. Verify: you know whether privilege is the gap.
2. Simplest fix on your own test box: re-run with sudo: `sudo nmap -sS 192.0.2.0/24`. Verify: the scan starts instead of quitting.
3. If you cannot run as root but own the box, grant the capability once: `sudo setcap cap_net_raw,cap_net_admin,cap_net_bind_service+eip $(which nmap)`. Verify: `nmap -sS 192.0.2.1` runs as your normal user.
4. If neither option exists, fall back to a connect scan: `nmap -sT 192.0.2.0/24`. It is louder and slower, but needs no special privilege. Verify: the scan completes and reports ports.
5. Confirm the target list matches your written authorization before any full-subnet run. Verify: the scan range equals the approved scope.

Compatibility: nmap 7.x on Linux. On macOS and Windows the privilege model differs; -sT fallback applies everywhere.

## Variant phrasings
### nmap quitting syn scan
Same fix path, common phrasing.
### nmap -sS quitting immediately
Symptom-level search.
### nmap raw socket permission denied scan abort
The underlying cause phrased differently.

## Why it happens
A SYN scan crafts raw IP packets, which requires CAP_NET_RAW on Linux. Without root or the capability, nmap's packet path fails to initialize and the program aborts with QUITTING! before touching the network. Docker containers and locked-down test boxes hit this constantly.

## Edge cases / pitfalls
- setcap breaks if the nmap binary is replaced by an update. Re-apply after upgrades.
- In containers you may need --cap-add=NET_RAW on the container itself, not just inside it.
- -sT connect scans leave full TCP handshakes in target logs. Confirm the engagement rules allow that noise before switching.
- Never escalate privilege on a box you do not own. QUITTING! on someone else's host is a stop sign.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_IFSJxGXTi6j1GgQ0_i3W6A