## TL;DR
The dnet library nmap uses to send raw packets could not open your network interface. This is a privilege or interface problem on your own box, not a target problem. Run as root, or add --unprivileged so nmap avoids the dnet path entirely.

```text
dnet: Failed to open device
```

## Use this when
- The error names dnet and a device, and the scan aborts before starting.
- You are on Linux, often inside a container or a hardened test VM.
- The targets are in your authorized scope.

## Not for this skill when
- The scan runs and produces timeouts. That is network behavior, not dnet.
- The error appears on Windows. That is an Npcap issue, different fix.

## Steps
1. Check your privilege: `id -u`. Non-root users cannot open raw devices by default. Verify: you know whether privilege is the blocker.
2. Try with sudo: `sudo nmap -sS 192.0.2.0/24`. Verify: the dnet error disappears and the scan starts.
3. If you own the box but cannot sudo each time, grant the capability: `sudo setcap cap_net_raw,cap_net_admin,cap_net_bind_service+eip $(which nmap)`. Verify: a normal-user scan opens the device cleanly.
4. If privilege is not available, bypass dnet with `nmap --unprivileged -sT 192.0.2.0/24`. This uses normal sockets and no raw packet path. Verify: the scan completes without the dnet error.
5. Confirm the interface exists and is up: `ip link show eth0`. A renamed or down interface produces the same error. Verify: the named device is present.

Compatibility: nmap 7.x on Linux. --unprivileged works on all platforms that support connect scans.

## Variant phrasings
### nmap dnet failed to open device linux
Same fix path, common phrasing.
### nmap cannot open device eth0
The interface-named variant.
### dnet failed to open device docker
The container-flavored version.

## Why it happens
nmap's dnet backend opens the network interface directly to inject packets. That needs raw-socket privilege. Containers, minimal VMs, and sudo-less accounts all block it, so the device open fails and nmap aborts. --unprivileged tells nmap to skip raw injection and use ordinary sockets, which any user may open.

## Edge cases / pitfalls
- In Docker you may need --cap-add=NET_RAW at container start. setcap inside the container alone is not enough.
- udev renaming can change eth0 to something else after a kernel update. Match the interface name nmap reports.
- --unprivileged changes scan behavior: no OS detection, no raw-socket timing. Note the limitation in your report.
- Only apply setcap on testers you administer. Never change capabilities on client systems.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_rnvIpGRkFTX_vpqTQt0DZg