0

I've been scanning my network for new hosts using this command:

nmap -v -sn 192.168.0.0/16 10.0.0.0/8

I have a lot of users in my network. Does the nmap scan slow down my network traffic or do I just have a load due to users?

4
  • Why are you scanning the class a and b subnets together like this? Are you not using a class c network? Oct 22, 2017 at 7:28
  • I have access to another network with a different subnet that's why
    – mrashid
    Oct 22, 2017 at 7:41
  • That does not make sense. What is your primary LAN setup? For host discovery you need to map out each LAN. If you are using class a and b for internal networking it suggests you have hundreds of thousands of users. Oct 22, 2017 at 7:48
  • actually its type of a classification, where DMZ servers has a separate subnet and my user's subnet and a router in between
    – mrashid
    Oct 22, 2017 at 9:25

1 Answer 1

4

Since nmap will be performing a ping scan in chunks of 4096 host addresses at, at least, 2 ports per host address, (corrected thanks to @Trickycm), it will be generating quite a lot of traffic so yes it will be impacting your other network traffic to some degree but depending on the number of pings and the rate pinged at I would expect the impact to be moderate.

You can add options to reduce the impact:

  --max-retries <tries>: Caps number of port scan probe retransmissions.
  --host-timeout <time>: Give up on target after this long
  --scan-delay/--max-scan-delay <time>: Adjust delay between probes
  --min-rate <number>: Send packets no slower than <number> per second
  --max-rate <number>: Send packets no faster than <number> per second
10
  • Where are you getting the 4096 from? Also -sn will send at least 4 probes. Oct 22, 2017 at 7:32
  • @Trickycm on my Windows 10 machine running nmap -vvvv -sn --unprivileged 192.168.0.0/16 10.0.0.0/8 tells me: Scanning 4096 hosts [2 ports/host] Oct 22, 2017 at 7:37
  • 2
    @Steve Barnes nmap will split the scan in to chunks if it is massive. In your case 4096 chunks. This scan though is a full class a and b so 65000+ hosts. If ran your scan it would up update after each 4096 block. Also the 2 probes is technically correct, but it also sends 2 ICMP requests. Oct 22, 2017 at 7:45
  • 1
    @Trickycm - answer edited thank-you for the clarification. Oct 22, 2017 at 7:50
  • 1
    @mrashid 10.0.0.0/8 will scan 16777214 hosts and 192.168.0.0/16 65534 more so lots pantz.org/software/tcpip/subnetchart.html for more. Oct 22, 2017 at 7:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .