After a big debugging session, I finally got the root cause.
When packets are retrieved with pcap_next(), they are quite "old", between 0 and 200ms.
This means that incoming packets are buffered for some time, and that nmap can't see the response to ping probes early enough.
That's why it assumes those requests are dropped.

If we follow the trace, we find that the buffer time is specified as the last parameter to my_pcap_open_live() (scan_engine_raw.cc) :

if ((USI->pd = my_pcap_open_live(Targets[0]->deviceName(), 256,  (o.spoofsource) ? 1 : 0, pcap_selectable_fd_valid() ? 200 : 2)) == NULL)

In my case, I get 200ms which is of course too much given that the default rtt timeout is 100ms.
I hardcoded a value of 2 and it solved the problem for me. However, I'm not sure this is a proper fix.
Also, I don't know if this should also be fixed in other parts of the code.

Anyway, I hope this has been useful.

Regards.

Thanks for this detailed report! Can you please include the output of nmap --version when you make a bug report? This helps us see what versions of libraries are linked with your version. I suspect that this might be related to #34, which was eventually corrected by fixes to libpcap and the Linux kernel. You could easily test for this by using the latest Nmap from github master and configuring --with-libpcap=included.

Thanks for your answer.

Here is the full version :

Nmap version 7.70SVN ( https://nmap.org )
Platform: x86_64-unknown-linux-gnu
Compiled with: nmap-liblua-5.3.4 openssl-1.0.2n nmap-libssh2-1.8.0 libz-1.2.11 libpcre-8.39 libpcap-1.8.1 nmap-libdnet-1.12 ipv6
Compiled without:
Available nsock engines: epoll poll select

I can confirm that using --with-libpcap=included fixed the problem. Thanks !

However, I tried once more with the system-wide version of libpcap to see why it didn't work :

configure gives me this :

checking for pcap_set_immediate_mode... no

config.log tells me more :

configure:6460: checking for pcap_set_immediate_mode
configure:6460: gcc -o conftest -g -O2 -Wall  -Wl,-E  conftest.c  >&5
/tmp/ccBfM6a7.o: In function `main':
/home/tim/soft/nmap/conftest.c:64: undefined reference to `pcap_set_immediate_mode'

Obviously, we see that we miss "-lpcap" in the gcc flags.
This means that the $LIBS variable is empty, probably because we miss a call to AC_CHECK_LIB.

The culprit is here :

[  case "$with_libpcap" in
  yes)
    AC_CHECK_HEADER(pcap.h,[
      AC_CHECK_LIB(pcap, pcap_create,
      [have_libpcap=yes ])])
    ;;

The default action of AC_CHECK_LIB is to updates $LIBS if the library is found.
However, since we specify an explicit action, it does not update $LIBS.

As a quick and dirty fix, I added -lpcap to LIBS and I can confirm that it works great with the system-wide version of libpcap !

Oh, I see! Yeah, when using system-provided libpcap, we need to check if immediate mode is available, but for the purposes of the test it's not even linking with libpcap, so that test will always be false. It's not "breaking" our build because it's semi-functional without that, but obviously it's not working properly. I'll get a fix in right away! Thanks!

Fixed in e483615.