2

I am running a simple SYN scan of all ports on all hosts that I found on a previous ping scan saved to a file: targets like this: 

nmap -sS -p- -v -T5 -oN puzzling.txt -iL targets

As the scan runs it shows results like: 

Discovered open port 23/tcp on xxx.xxx.xx.xx

But when the scan is done and I check the output file: puzzling.txt, I find this: 

# Nmap 6.49BETA5 scan initiated Sun Oct 11 13:46:11 2015 as: nmap -sS -p- -v -T5 -oN puzzling.txt -iL targets
Nmap scan report for something.net (xx.xxx.xx.x)
Host is up (0.16s latency).
Skipping host something.net (xx.xxx.xx.x) due to host timeout
Nmap scan report for something.net (xx.xxx.xx.x)
Host is up (0.17s latency).

no mention of the open ports found, and seen in the interactive output! What am I missing here?

Improve this question

2 Answers 2

Reset to default
4

You used the -T5 option, which according to the documentation does the following (emphasis mine):

T5 does the equivalent of --max-rtt-timeout 300ms --min-rtt-timeout 50ms --initial-rtt-timeout 250ms --max-retries 2--host-timeout 15m as well as setting the maximum TCP scan delay to 5 ms.

The important point is that host timeout. That says, "If you spend more than 15 minutes on a host, stop and give up on that host without showing output." Several users have requested that Nmap show partial results in this case, but nobody has contributed code to do so.

You have a couple of options if you want to get output from these hosts:

  1. Use a less-aggressive timing option. You could use -T4 which has no host timeout, or use -T5 and override the host timeout: --host-timeout 24h for example. There is not currently a way to turn off the host timeout entirely once a timing template sets it.

  2. Scan less stuff. You are using -p - which scans 65535 ports. For a host on a LAN, that's not too much. But your output says the latency is 0.17s, which is slower than I get from the middle of the USA to London. It is reasonable to expect that hosts at that distance may drop a packet or several, leading to slower scan times.

Improve this answer
2
  • Yes! That was it, amazing that you picked up on the nuances of the timing. I was focusing on the discrepancies on the output, and had just cranked the timing to what I though was fastest possible. And your observations are correct once the host times out it dumps all interactive output. Thank you for your sleuthing, bonsaiviking
    – Zenji Agamotto
    Oct 12, 2015 at 20:35
  • @ZenjiAgamotto Upvote and accept answer is all the thanks I need. I enjoy helping.
    – bonsaiviking
    Oct 12, 2015 at 20:50
0

Use this "nmap -n -PN -sT -sU -p- Host > output-nmap.txt" This will scan for every TCP and UDP open port and give you the output you're looking for. Please tell me if this helped you in anyway!

Improve this answer
1
  • 3
    This does not address the question and suggests several unneeded or harmful options: -PN (or -Pn, as we've called it since 2010) skips host discovery, which is needed to set up initial timing values and is important for exhaustive scans like -p-; -sU scans UDP, which was not mentioned in the question at all; and you use shell redirection instead of proper file output, which eliminates scan progress feedback and interaction options.
    – bonsaiviking
    Oct 12, 2015 at 3:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .