Nmap Timing and Performance
Here we are in Nmap. Help again.
One of the highest Nmap development priorities is performance.
A default scan of a host on a standard local network can take as little as a fifth of a second.
This is extremely quick, but time to scan adds up when you're scanning hundreds or thousands of host.
Plus certain scan options such as UDP scanning and version detection can increase scan time substantially.
So can certain firewall and OS configurations on your targets, particularly response rate, limiting Nmap has a number of timing options.
But one of the smartest ways to speed up scans is to admit non-critical tests in the first instance, and also to upgrade to the latest version of N map.
So you should always do those first admit non-critical tests and also make sure you're on the latest version of N map.
It is possible to optimize timing options, which can also make a substantial difference to the scan time.
The main tiring option that I recommend for you to use is the -T option.
Which you can see here, my pop over to here.
We can see the -T been in use and then a number after it.
In this case, we've got 0-TS 6 timing templates.
You can specify them with this -T and then a template number from zero through to five or their equivalent name.
And the template names are paranoid, which is zero, which is this one.
You've also got one, which is sneaky.
You've got two, which is polite.
You've got three, which is normal and default.
You've got four, which is aggressive and five, which is insane.
The first two, zero and one.
So zero one are for intrusion detection system evasion.
So if you're wanting to be discreet in your scanning, then -T 0 or 1, or your best timing options to evade detection, but the scanning will be slow.
Two or polite slows down the scan to use less bandwidth and use less target machine resources.
Three is normal or the default so effectively, this will do nothing aggressive mode four speed scans up by making the assumption that you are a reasonably fast and reliable network.
You can use this on a local network that you know is fast.
It's a good option for them.
And then finally we changed it there to five.
This is insane mode, which assumes you are an extraordinarily fast network or are willing to sacrifice some accuracy for speed.
These templates allow you to specify how aggressive you wish to be while leaving Nmap to pick the exact timing value.
Well, Nmap utilizes parallelism and many advanced algorithms to accelerate these scans.
The user has ultimate control over how Nmap runs.
If we pop over to here, there are other timing options available, but I recommend for most people to simply use the -T option because one of that's highest development priorities is speed.
As default to the -T, T option is enough in most cases.
It is easy with some of these other options to make matters worse and actually slow things down.
We can see here, we've got --min - host group, and also max two, which is parallel hosts, scan group sizes.
And the next one we can change the parallelism, the minimum and the maximum with this one, we can specify probe round trip time.
Max retries. We can do a capping of the number of ports scan probe retransmissions host timeout.
So you can give up on targets after the number you specify, which we've already discussed.
You can adjust the delay between probes et cetera, et cetera.
If you really do want to know more about those and you can check out the Nmap reference or the Nmap mim page.
But as I said, generally, almost all cases I recommend using the -T option as if you specify any of these incorrectly, it can slow things down Nmap as default is pretty speedy.