I have a few anecdotes I’d like to share pertaining to the
“A network vulnerability scanner in a special way?” question above.
Before jumping in though I’d like to note that for most scanning tools speed is the antithesis of accuracy. Speed kills.
Tweaking nmap for balls out speed
(a la –min-hostgroup, --min-parallelism, and friends) is awesome for watching the packet counters on iptraf go blurry, but you can be assured accuracy will suffer.
My typical hedge on going fast is to run multiple rounds of nmap scans: Preferably on different days and at different times. This helps to minimize accuracy-killing hazards like scheduled backups that saturate bandwidth.
For really big scans try unicornscan. It has been awhile, but I took notes that last time I did a respectably large Internet based port scan:
To recap: We performed a sweep of 400,000+ public IPs across multiple continents by configuring the scans to do a full TCP port scan of each IP, sustained ~55 Mbits/s using between 3 and 5 systems, and completed it in a matter of days.
This is pretty good considering by sending two SYN probes per port it meant sending ~52.5 billion packets and producing some 3 Terabytes of data.
This may not be true so much today, but a few years back popular commercial vuln. scanners would optimize their scans out of the box for speed. Marketing and sales pushed for it because customers tie quality to how fast they get scan results.
So as a vendor (disclosure: I used to work for one) the game was to reduce the number of checks in favor of speed. Full TCP or UDP scans? No way. Individual vulnerability checks that take time? Bury them.
You can see where this is going - if you want accuracy then spend a few minutes and customize your preferred vulnerability scanner(s) for accuracy (and coverage). If you want speed then know you are sacrificing those properties.
Combining the above:
I’m bored with how often port scan results differ from tool to tool on the same engagements. I hate it when I pay for a per IP vulnerability scan (e.g. Qualys) and the tool repeatedly misses open ports that I verified to be open. I like to take the results from my port scans (see above) and customize every vulnerability scan tool I’m using to only hit those ports my custom scans discovered to be open. This can save TONs of time.
For Internet based scans I now almost exclusively use cloud VMs. My favorite is linode.com. Linode’s AUP so far doesn’t forbid port scanning (Amazon’s does). Spinning up 30 VMs to distribute scanning efforts across non-regional data centers can put the fun back into port scanning. It’s easier to get aggressive with tuning as well given the favorable latency and bandwidth conditions. My point here is cloud VMs are awesome for boosting scanning capacity.