1

I've read, that the ZMap creators recommend to send three probes for each (ip,port) tuple when scanning. Let's say, we scan port 443 port with a TCP SYN scan. One reason, I can imagine is packet loss. Do you know any other reasons for sending multiple probes instead of sending only one?

Improve this question
1
  • Could you link your source?
    – Arminius
    Dec 23, 2016 at 12:02

1 Answer 1

Reset to default
2

The main reason is the one you've stated, which is that there's a risk of packet loss on any connection and as a result it's prudent to send more probes to reduce the risk of missing an open service.

With scanners like nmap it's possible to over-ride the default configuration and reduce or increase the number of retries it will make. This can be handy to either reduce the time the scan will take (with a larger risk of missed services) or increase the service detection likelihood when scanning over flaky networks.

Improve this answer
1
  • You said "main reason". Are there other imagnable reasons like NAT-Hole-punching (although this works different) or any packet filters that would drop the first packet. (Those are just arbitrary guesses)
    – Hansi
    Dec 26, 2016 at 9:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .