Scanning Performance
Introduction
Scanning performance plays a significant role when we need to scan an extensive network or are dealing with low network bandwidth.
We can use various options to tell Nmap
How fast (
-T <0-5>)With which frequency (
--min-parallelism <Number>)Which timeouts (
--max-rtt-timeout <Time>) the test packets should haveHow many packets should be sent simultaneously (
--min-rate <Number>)Number of retries (
--max-retries <Number>) for the scanned ports the targets should be scanned.
Time-outs
When Nmap sends a packet, it takes some time (Round-Trip-Time -
RTT) to receive a response from the scanned port. Generally, Nmap starts with a high timeout (--min-RTT-timeout) of 100ms.The less the RTT, the faster the scan.
Example:
sudo nmap 10.129.2.0/24 -F --initial-rtt-timeout 50ms --max-rtt-timeout 100msHowever, we must take care that that setting the initial RTT timeout (
--initial-rtt-timeout) to too short a time period may cause us to overlook hosts.
Max Retries
Another way to increase the scans' speed is to specify the retry rate of the sent packets (
--max-retries).The default value for the retry rate is 10, so if Nmap does not receive a response for a port, it will not send any more packets to the port and will be skipped.
Example:
sudo nmap 10.129.2.0/24 -F --max-retries 0
Rate
If we know the network bandwidth, we can work with the rate of packets sent, which significantly speeds up our scans with Nmap.
When setting the minimum rate (
--min-rate) for sending packets, we tell Nmap to simultaneously send the specified number of packets.Example:
sudo nmap 10.129.2.0/24 -F -oN tnet.minrate300 --min-rate 300
Timing
Nmap offers six different timing templates (
-T <0-5>) for us to use.The timing templates adjust the values discussed earlier alongside other values to provide us with a timing template (Details: https://nmap.org/book/performance-timing-templates.html)
These values (0-5) determine the aggressiveness of our scans.
The default timing template used when we have defined nothing else is the normal (
-T 3).Timing options:
-T 0/-T paranoid-T 1/-T sneaky-T 2/-T polite-T 3/-T normal-T 4/-T aggressive-T 5/-T insane
Last updated