I ran nmap -Pn on all possible addresses for the local network and it took 50 minutes. If I limit the range to 100-200, for example, the same scan takes 3-4 minutes.
Why is the "full" nmap scan taking so long and how can I make it quicker?
-
what's your local network's netmask? i.e. how big is your local network? if you're at, say, a university with a /16 network, it'll take a lot longer than on, say, a /24 network.– casOct 11, 2015 at 4:05
-
just a regular home /24 network– cfye14Oct 11, 2015 at 4:25
-
Have you checked out the "TIMING AND PERFORMANCE" section of the manpage?– jordanmOct 11, 2015 at 5:01
Add a comment
|
2 Answers
You are scanning empty space. The -Pn option (formerly -PN or -P0) tells Nmap to skip the host discovery step (colloquially called the "ping scan") and assume that every target address has a host listening on it. For the default TCP scan, that means that Nmap will scan 1000 different ports on every target address, regardless of whether any replies are received. When no reply is received for a probe, Nmap will wait a full timeout period (default starts at 1 second) and then retry a few times to ensure the packet was not dropped. Your valuable bandwidth (and therefore time) is wasted sending probes that will never get a response.
The other important part that host discovery plays is in giving Nmap a baseline for how fast and responsive your network connection is. In doing a "ping sweep," Nmap discovers the round-trip time for each target. It can then more accurately determine when a packet was dropped and should be retried, or when you are sending too many packets at once. Without this information, Nmap has to play it safe, slowing down its sending rate and making extra retransmissions to make sure no packets are lost.
In short, the -Pn option is not usually useful, though it is one of the most commonly used and recommended ones.
-
an nmap scan with an
sSflag on all possible local hosts just took over 2 hours, while the scan with ansnflag took 8 seconds.– cfye14Oct 12, 2015 at 21:41 -
@cfye14
-sngoes fast because it doesn't do a port scan, only host discovery. There's a small chance you're experiencing this bug, too: github.com/nmap/nmap/issues/34 Oct 13, 2015 at 2:02 -
eh my version of
libpcapand the linux kernel don't match what's mentioned via the link. In fact I only noticed this problem after a recent upgrade to 15.04.– cfye14Oct 13, 2015 at 3:56 -
Nmap uses host discovery techniques to minimize the amount of time that it spends scanning addresses. Host discovery attempts to figure out whether an address is active before scanning ports on the system. By default nmap performs host dicovery on remote system using a combination of techniques.
First it sends an ICMP Echo request to the system. This is the same approach used by the ping. It is to determine if an ip addres is active. If the scanner receives an ICMP Echo reply. it knows that there is a system at the address and then launches into a port scan. However many systems dont answer ICMP requests in those cases nmap next moves to sending connection request directly to port 80 and 443. 2 tcp ports that commonly used for public services. If the scanner receives a reply then it launches into the port scan. Finally nmap tries a technique known as ICMP timestamp request to see if it can probe a host. If the scanner does not receive a response to any of those requests,it assumes that there is no system present.
ARP discovery: it uses address Resolution Protocol to check the ethernet of the target system. this is a much faster technique.
-Pn flag;nmap skips the host discovery and performs a full scan of the target system.
-PR to specify ARP scan.
nmap -F ipAdress this will scans top 100 port
you can also use timing templates flags. timing templates are those are collections of predefined values that come together in a package allowing you to adjust the speed of the scan.numbered from 0, the slowest timing template through 5 fastest template. -T5 is called insane template.
-T4 is aggresive template.
-T3 is normal template. Default one.
-T2 is polite. Unlikely to affect the target.
-T1 sneaky. Avoids detection.
-T0 paranoid. Almost useless
