I read on a book that the SYN scan in nmap is usually a lot faster than the TCP connect scan, because it doesn't go through all the three way handshake connection. But when i try both scans on the same target, the TCP connect scan takes 2 seconds, while the SYN scan takes 7 minutes at least.

Can anyone tell me what's wrong here ?


While the SYN scan method itself is theoretically quicker, it doesn't mean that it will always be the best or fastest scan to use. It is possible that a firewall or IPS has detected the scan and is slowing you down (nearly every NIDS in the world knows about SYN scans and will alert on sight).

You can also try adjusting the timing settings (-T[0-5], higher is faster/more aggressive).

In short, there is no one scan mode or setting that will always be fastest, and you should experiment to find what works best for the target.

  • thanks for the answer man, but is it really normal that SYN scan takes more than 100 times more time than TCP Connect scan ?? – Sidahmed Jan 23 '16 at 19:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.