nmap --top-ports range selection

Question

I'm trying to find out if it is possible to select a range from within the --top-ports when scanning with nmap. I'm performing scans which are progressive in nature, for example, scanning the top 100, then 1000 then 3647 TCP ports. However as the 2nd and 3rd scans are performed they repeat the scan on the previous top ports which were selected, therefore increasing the overall time of the scan performing a redundant scan.

My question, is there a way to select a range from within the --top-ports list for example:

--top-ports 1-100
--top-ports 101-1000
--top-ports 1001-3647

Therefore stopping the ports from being scanned twice?

Answer 1

No, there is not.

You can find out the top ports from /usr/share/nmap/nmap-services then use the -p switch to slice and dice as many chunks you see fit.

Answer 2

I don't think this is necessarily the best approach to network scanning, but there is a way to do it by excluding certain ports from scanning (requires Nmap 7.00 or newer).

1. Extract the list of the top 100 ports: nmap -oG - -v --top-ports 100 | awk -F'[);]' '/Ports/{print $2}' > top-100
2. Extract list of the top 1000 ports: nmap -oG - -v --top-ports 1000 | awk -F'[);]' '/Ports/{print $2}' > top-1000

3. Scan, using --exclude-ports when needed:

   nmap --top-ports 100 <targets>
   nmap --top-ports 1000 --exclude-ports $(cat top-100) <targets>
   nmap --top-ports 3647 --exclude-ports $(cat top-1000) <targets>
   

This is for TCP. For UDP, use $4 instead of $2 in the awk command, and add -sU to all Nmap commands.