I've read, that the ZMap creators recommend to send three probes for each (ip,port) tuple when scanning. Let's say, we scan port 443 port with a TCP SYN scan. One reason, I can imagine is packet loss. Do you know any other reasons for sending multiple probes instead of sending only one?
Could you link your source?– ArminiusDec 23, 2016 at 12:02
The main reason is the one you've stated, which is that there's a risk of packet loss on any connection and as a result it's prudent to send more probes to reduce the risk of missing an open service.
With scanners like nmap it's possible to over-ride the default configuration and reduce or increase the number of retries it will make. This can be handy to either reduce the time the scan will take (with a larger risk of missed services) or increase the service detection likelihood when scanning over flaky networks.
You said "main reason". Are there other imagnable reasons like NAT-Hole-punching (although this works different) or any packet filters that would drop the first packet. (Those are just arbitrary guesses)– HansiDec 26, 2016 at 9:48