4

I was scanning an IP using this command: nmap -sT -p- -Pn <Ip_Address>, but is very slow scanning. To reach 100%, the command line said 3 hours remaining. Why is it so slow?

5
  • What research have you done so far? – cremefraiche Feb 15 '16 at 2:29
  • @cremefraiche before i asked here , e google it , but i didnt find a solid infomation about this question and i am reading a book , this one:"The basics of Hacking and Penetration Testing " and in the book dont have nothink about that only have a exemple of using this command and how it is when reach 100 % , but is that normal taking so long time reaching 100% , why take that long? – R.O.O.T Feb 15 '16 at 2:35
  • 1
    Try reading the manual, or searching for questions on here before posting. – cremefraiche Feb 15 '16 at 2:42
  • Is it just one IP address or many? Where is this IP? On the Internet or in your lab? We need to understand the context before we can help you. – schroeder Feb 15 '16 at 4:31
  • If you like reading 📚, this one is complete: nmap.org/book/cover/nns-cover.pdf (it has been written by nmap's author). It's down to packet level so it is not obsolete. Some new scan are not part of the book tho (-sY for instance) – Florian Bidabe Feb 25 '16 at 22:16
6

bonsaiviking's answer is valid, but here are a few more points:

  1. -sT scan realise a full TCP handshake, it takes significantly longer than a -sS (SYN Stealth Scan): Basically,
    • You send a Syn, Receive a
    • Syn/Ack(Opened) or a RST packet(Closed) or nothing(filtered)
    • If you get a Syn/Ack, you complete the connection with Ack: the connection is established.

With a Syn Stealth Scan, You do not establish a full connection, therefore do not have to complete it with an Ack packet and this is much faster.

  1. You perform DNS resolution, if you scan multiple IPs or CIDR segment this would take long. you can skip this with -n

  2. You do not use Timing Optimization: Refer to https://nmap.org/book/man-performance.html ; Slow scans are annoying but reliable, fast scan can be noisy and unreliable: Nmap doesn't have time to check properly a port so gives up :(

  3. You can check why the scan is taking forever by analyzing the process in debug or verbose mode: When verbose mode doesn't provide sufficient data for you, debugging is available to flood you with much more! As with the verbosity option (-v), debugging is enabled with a command-line flag (-d) and the debug level can be increased by specifying it multiple times. Alternatively, you can set a debug level by giving an argument to -d. For example, -d9 sets level nine. That is the highest effective level and will produce thousands of lines unless you run a very simple scan with very few ports and targets.

This is what I would suggest:

sudo nmap --min-hostgroup 100 -F -sS -n -T4 <Target_IP>
14

Possibilities:

  1. You are using a VM with a virtual NAT (Network Address Translation) network adapter. I have experienced profound slowdown under VirtualBox, for instance, when using NAT instead of a bridged network adapter.
  2. You are scanning something that isn't there. The -Pn option means "don't bother trying to find out if anything is listening at this address, just start port scanning it." If the target is not actually there, you'll waste a lot of time sending packets into nowhere.
  3. Your network (or your connection to the target) is slow. What is the latency to the target as measured by nmap -sn or ping? How far away is the target? What kind of network speed do you have? Any of these can impact total scan times.
  4. You are performing a lot of work. The -p- option means to scan 65535 TCP ports. Depending on network conditions and host behavior, this can be a significant amount of traffic.
4
  • ,hi . I only want scan 1 ip , thats why i didnt use -Pn and the ip is from my laptop and is right next to me.i use ping command and send 7 packets he received 7 and the time =6012 ms. – R.O.O.T Feb 15 '16 at 11:28
  • 1
    @R.O.O.T that's 6 seconds per ping packet?? You have a massive networking problem. – schroeder Feb 15 '16 at 17:51
  • @schroeder but i have a nice download speed ... i don have lag on internet , it could happend only on VM ?( i am connected via wifi =$) – R.O.O.T Feb 15 '16 at 23:53
  • connecting to the internet and connecting to other machines on your network are 2 very different situations - we cannot help you with that – schroeder Feb 16 '16 at 0:11
1

One possibility could be that you have not disabled DNS resolution and nmap is then "sometimes" trying to resolve the IP. From (nmap.org/book/man-host-discovery.html) -n (No DNS resolution) Tells Nmap to never do reverse DNS resolution on the active IP addresses it finds. Since DNS can be slow even with Nmap's built-in parallel stub resolver, this option can slash scanning times. The option describes that it is set to "sometimes" lookup - even on IP addr. only host.

1
  • 2
    WElcome to S.E. can, you expand this awnser with sources? or with reasining on why this would sow down the NMAP process? (this helps to get a better awnser ;) ) – LvB Feb 15 '16 at 10:57

Not the answer you're looking for? Browse other questions tagged or ask your own question.