I've been scanning my network for new hosts using this command:

nmap -v -sn

I have a lot of users in my network. Does the nmap scan slow down my network traffic or do I just have a load due to users?

  • Why are you scanning the class a and b subnets together like this? Are you not using a class c network? – Trickycm Oct 22 '17 at 7:28
  • I have access to another network with a different subnet that's why – mrashid Oct 22 '17 at 7:41
  • That does not make sense. What is your primary LAN setup? For host discovery you need to map out each LAN. If you are using class a and b for internal networking it suggests you have hundreds of thousands of users. – Trickycm Oct 22 '17 at 7:48
  • actually its type of a classification, where DMZ servers has a separate subnet and my user's subnet and a router in between – mrashid Oct 22 '17 at 9:25

Since nmap will be performing a ping scan in chunks of 4096 host addresses at, at least, 2 ports per host address, (corrected thanks to @Trickycm), it will be generating quite a lot of traffic so yes it will be impacting your other network traffic to some degree but depending on the number of pings and the rate pinged at I would expect the impact to be moderate.

You can add options to reduce the impact:

  --max-retries <tries>: Caps number of port scan probe retransmissions.
  --host-timeout <time>: Give up on target after this long
  --scan-delay/--max-scan-delay <time>: Adjust delay between probes
  --min-rate <number>: Send packets no slower than <number> per second
  --max-rate <number>: Send packets no faster than <number> per second
  • Where are you getting the 4096 from? Also -sn will send at least 4 probes. – Trickycm Oct 22 '17 at 7:32
  • @Trickycm on my Windows 10 machine running nmap -vvvv -sn --unprivileged tells me: Scanning 4096 hosts [2 ports/host] – Steve Barnes Oct 22 '17 at 7:37
  • 2
    @Steve Barnes nmap will split the scan in to chunks if it is massive. In your case 4096 chunks. This scan though is a full class a and b so 65000+ hosts. If ran your scan it would up update after each 4096 block. Also the 2 probes is technically correct, but it also sends 2 ICMP requests. – Trickycm Oct 22 '17 at 7:45
  • 1
    @Trickycm - answer edited thank-you for the clarification. – Steve Barnes Oct 22 '17 at 7:50
  • 1
    @mrashid will scan 16777214 hosts and 65534 more so lots pantz.org/software/tcpip/subnetchart.html for more. – Steve Barnes Oct 22 '17 at 7:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.