# CLEAN — Nmap Network Scanner
Scanned 2026-03-29 for CWE-407 (algorithmic complexity: O(N²) linear membership tests, O(2^D) diamond recursion).

## Scope
- `service_scan.cc` — service/version detection probe selection
- `osscan2.cc` — OS fingerprinting
- `traceroute.cc` — traceroute probe tracking
- `scan_engine.cc` — core scan engine
- `TargetGroup.cc` — target specification and dedup

## Findings
- **`ServiceProbe::portIsProbable`** — `std::find` on `probableports` / `probablesslports`. These vectors hold port numbers declared in the nmap-service-probes file per probe — typically 1–50 ports. Outer probe loop is over ~200 probes but inner find is O(constant). Not scalable O(N²). CLEAN.
- **`ServiceProbe::serviceIsPossible`** — linear scan of `detectedServices` with `strcmp`. List is small (services a probe can detect, typically 1–10). CLEAN.
- **`end_svcprobe`** — `std::find` on `services_in_progress` and `services_remaining` lists. Called once per completed probe to remove it; not a membership test in an accumulation loop. CLEAN.
- **`traceroute.cc`** — `std::find` on `unanswered_probes` to locate a probe upon reply receipt. List bounded by max TTL (≤30). CLEAN.
- **Target dedup** — `TargetGroup` uses netblock iteration; no linear dedup over large address sets.

**Result: No actionable CWE-407 defects. Nmap's scan data structures use small bounded lists for probe metadata; all scalable target/service tracking uses sorted or hash-based containers.**