I'm trying to find the most efficient way to find open ports on target then find banner of running services on them. As I have read and experienced before, syn stealth scan gives the best outcome. But I'm not sure how -sV finds open ports.

For grabbing version information, does the -sV option give the same performance with -sS or should I first scan the target with -sS after then I scan open ports with -sV?

  • are you wanting better performance for one target or for a large collection of targets
    – schroeder
    Oct 31, 2017 at 10:08

3 Answers 3


Nmap does its scanning in phases, with each phase feeding into the next one. When you do nmap -sV example.com, Nmap performs 7 scan phases. The ones you are asking about are 4 and 5 below:

  1. Target enumeration. Nmap resolves the name example.com to some IP address like
  2. Host discovery. Nmap sends some probes like ICMP Echo Request, TCP SYN to port 443, TCP ACK to port 80, etc. If any of them get a response, the host is "up" and scanning continues.
  3. Reverse-DNS resolution. Nmap sends a DNS PTR query for the IP address to see if a name is associated with it.
  4. Port scanning. You didn't request a particular port scan type, so the default is TCP SYN scan (-sS) if you have privileges, or TCP Connect scan (-sT) if not.
  5. Version detection. This is the "banner grab" that you requested with -sV, though it is much more complex than that.
  6. Script scanning. When you do -sV, some NSE scripts may run to do further version detection. This is the same as specifying --script version
  7. Output. The results are printed after all scan phases are done.

So you can see that there is no difference in port scanning between -sS and -sV, but in fact the exact same port scan is done for both. Optimizing the scan can be done with the -T timing template options or any of the more fine-grained controls.

You can also speed up your scan by eliminating unused scan phases. Host discovery can be skipped with -Pn if you know the target is up. Reverse-DNS can be skipped with -n. Port scanning can be altered with -p or --top-ports to scan more (slower) or fewer (faster) ports. You can eliminate the NSE script scanning part of version detection by adding --script-args script-intensity=0


The fastest way I know of to port scan (and would be surprised if there is anything faster) is massscan with an Intel 10-gbps Ethernet adapter and the PF_RING driver. To quote the github page "This is the fastest Internet port scanner. It can scan the entire Internet in under 6 minutes, transmitting 10 million packets per second.". This is dangerously fast - take down your local network if you aren't careful fast.

For version information you would need to use the banners option. See usage here. I don't think this is quite as advanced as nmaps version detection - you may have more cleanup work on the returned data.

If you'd rather stick to nmap there are several ways to speed it up. -Pn would avoid sending a ping. -n avoids DNS resolution. --send-eth sends directly on the ethernet interface - although you need to fully understand the consequences of this and how to set up your machine appropriately first.

For grabbing version information, does the -sV option give the same performance with -sS or should I first scan the target with -sS after then I scan open ports with -sV?

Technically there is no reason why they couldn't be as efficient (and possibly more efficient to run them together). Without profiling or reviewing the source code of nmap I can't answer this conclusively. Google isn't immediately showing anything obvious.

  • I agree, I use masscan as well. @kjslaa I usually keep the --max-rate around 10,000. I've seen 30,000 melt a firewall so if you use this just know your network. Sometimes I'll use a combination of masscan and nmap. Masscan to sweep a large subnet for active hosts then use nmap for -sV -sC on the list I gathered from masscan
    – nd510
    Oct 31, 2017 at 12:04

For what you're doing, Zmap or Masscan are probably the fastest way. Zmap's about as fast as masscan, but it has way more functionality. Another cool thing about Zmap is that you can pipe the results from the fast scanner into a slower, more intensive scanner, such as application layer with Zgrab. You should first scan with those tools and then use Nmap. It's way faster that way, and even better if you can do it just-in-time.

With Nmap, you want to add the -T5 flag (0-5, where 0 is slowest, and 5 is fastest). If you've already scanned with masscan or zmap and know that they're online, you can use -Pn to not send a ping.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .