Increase speed in nmap UDP scan?

Question

How can I get nmap quicker in scanning UDP ports? This kind of scan is incredibly more slow than TCP ports (at least 2-3 times)

Answer 1

UDP scanning is likely to be slower than TCP due to the differences in how the protocol works (i.e. with TCP it's easier to establish that a port is open due to the three-way handshake).

That said it's possible to increase the speed of UDP scans in a couple of ways. one thing to watch for here is that if you apply too many timing options you risk reducing the accuracy of your scan (i.e. nmap will miss things). Depending on your goal this may or may not be a problem.

One of the best places to get information about these is in the timing & performance section of the nmap book

From that, ones I tend to use

--max-rtt-timeout 

This controls the time that nmap will wait for responses and is pretty key for scanning speed. What you can do here is measure the typical round trip time of a request using ping or something similar and use that as a base for this.

--max-retries

As mentioned in another answer this is useful. I wouldn't set 0 or you could miss things but setting 1 or 2 if you're really keen to see a speed-up will help

--max-scan-delay

If nmap things that a host is slow responding it'll start adding this in, and it can really slow the scan down. Set this low around 10ms and it'll speed things up, but if you have flaky/slow hosts it'll likely miss things

--min-hostgroup

If you're not too concerned about getting results as you go and you have a lot of hosts to do ramping this up will improve things. Something like 32 or 64 will speed up the overall scan.

Another key point to remember is that for UDP you'll likely only get good results if you use version scanning. this is because a lot of UDP services only respond if the packet they receive is in the right format. However version scanning will slow things down so if you're in a hurry set

--version-intensity 0

when using version scanning.

Answer 2

Try using the min-rate command line option:

When the --min-rate option is given Nmap will do its best to send packets as fast as or faster than the given rate. The argument is a positive real number representing a packet rate in packets per second. For example, specifying --min-rate 300 means that Nmap will try to keep the sending rate at or above 300 packets per second.

Example: nmap -sU --min-rate 5000 <targets>

Answer 3

There's a fundamental reason why UDP scans are slower than TCP scans: UDP is connectionless. This means that Nmap cannot tell the difference between an open port with a program that's silently eating the scan packets, a port blocked by a firewall that's silently dropping the packets, or packets being lost in transit due to network congestion. In the closed-port case, Nmap cannot tell the difference between a port that's firewalled, a lost packet, or rate-limiting of ICMP Unreachable messages. Consequently, unless a port returns either data or an ICMP Unreachable message, Nmap needs to send multiple packets to eliminate the possibility of rate-limiting or lost packets.

Answer 4

In addition to what @Tate Hansen suggested consider using --max-retries 0. You'll also need to consider the target. [Some] Linux, for example, limits ICMP Port Unreachable responses so no matter what you do with your scanner the target is still a speed factor. You could also -F and re-scan the full port range if deemed necessary based on the results of the -F scan.

Hopefully that helps.

Answer 5

To begin with, don't use something like 'nmap -sUVC' especially when scanning a large port range. For if you do this, the result is most likely that many ports are marked as open|filtered, and nmap will pound on each of them in the actual UDP-scan and in the service version detection - each up to max-retries many times and with nmap's progressively slower scanning.

Instead, you need to portscan UDP in two or more stages, where stage 1 looks like

nmap -n -sU -p[...] --max-retries 1 targets

and possibly further tuning parameters as mentioned by Rory McCune above.

If a host shows that all ports are open|filtered (or some closed and almost all open|filtered), then skip this host.

If a host shows many closed ports and only a few that are open or open|filtered, then investigate on those ports with nmap -sUV -pLIST target where LIST is the list of ports that are (possibly) open.

Depending on the context of the scan a quick sweep on very few ports like 53, 123, 161, and possibly others is often feasible.