How to improve Nmap scan times
Your objectives for running an Nmap scan will determine how you want it to run: slow and quietly, fast and furious, or somewhere in between. Therefore, Nmap includes a variety of timing options that allow you to affect almost every aspect of a scan.
By default, Nmap is set to not abort a scan due to time -- no matter how long it may take to complete. This can be overridden with the Host Timeout option (--host_timeout), which sets the amount of time a scan will wait before giving up on an IP address. This can be useful when scanning network devices over a slow connection or when the scan comes across a device that is slow in responding.
Nmap's other timing options can basically be split into four categories: round trip time, delay, parallel host scanning and parallel port scanning. Round trip time is the number of milliseconds required to receive a response to an Nmap request. Nmap automatically adjusts its response time timeout during a scan. However, you can force it to use a larger timeout value using the Minimum Round Trip Time Timeout option (--min_rtt_timeout) if, for example, your network is experiencing dropped packets. The Maximum Round Trip Time Timeout (--max_rtt_timeout) is useful for ensuring an accurate scan across slow or problematic networks.
Read more on custom scans using Nmap security scanner.
Michael Cobb, CISSP-ISSAP is the founder and managing director of Cobweb Applications Ltd., a consultancy that offers IT training and support in data security and analysis. He co-authored the book IIS Security and has written numerous technical articles for leading IT publications. Mike is the guest instructor for SearchSecurity's Web Security School and, as a SearchSecurity.com site expert, answers user questions on application and platform security.
This tip originally appeared on SearchSecurity.com.
This was first published in December 2006