0

I need to scan large network which has 5000 IPs. I have limited time duration. I have done initial maths and concluded that, in a group of 4 individual has to perform 70 IP nmap scan.

Consider that I want more out of nmap. Which method will be effective for me?

Initially I thought of running top 1000 ports scan and then to perform all 65535 port scan in the range where I got some results after performing initial 1000 ports scan. Assume that rest all hosts are dead in which I have not got the result. Also I want to check those even roughly.

What would you recommend? Which scan type and methodology shall I follow to achieve my target?

Improve this question
5
  • 1
    What do you want to get out of that scan ?
    – Stephane
    Jun 2, 2015 at 12:56
  • I would run scans in parallel from different points.
    – schroeder ♦
    Jun 2, 2015 at 16:22
  • Hey @schroeder, that sounds interesting, how does that work? Could you please share some code or command line examples? :)
    – voices
    Dec 11, 2015 at 12:03
  • 1
    @tjt263 it's not a code-based suggestion. I literally mean to run nmap from different machines in the network, splitting up the work. "Divide-and-Conquer"
    – schroeder ♦
    Dec 11, 2015 at 15:12
  • @schroeder Ah.. I see.. I thought you were implying bulk threads via a single host or something.
    – voices
    Dec 12, 2015 at 3:43

2 Answers 2

Reset to default
1

NMap scan can take a long time, try a small number of ports over a large IP range first.

Select a few of the most important ports to you and try those first.

Have you considered MassScan https://github.com/robertdavidgraham/masscan instead of NMap.

Improve this answer
4
  • Thanks for your valuable suggestion but it sends 10000 million packets per second. It will be too much agressive for my client.
    – FrOgY
    Jun 2, 2015 at 19:04
  • 1
    From masscans documentation By default, the rate is set to 100 packets/second. To increase the rate to a million use something like --rate 1000000. github.com/robertdavidgraham/masscan/blob/master/README.md
    – David Waters
    Jun 3, 2015 at 1:19
  • I would second the recommendation for MassScan. It is specifically designed to scan huge numbers of hosts in a short amount of time and its speed is configurable.
    – tlng05
    Jun 3, 2015 at 16:21
  • "It can scan the entire Internet in under 6 minutes." Surely, this can't be accurate?
    – voices
    Dec 12, 2015 at 15:52
1

Since your question is about nmap, I'd recommend the following command:

$ sudo nmap -O -T5 -PE -F --osscan-limit --max-rtt-timeout 100ms
--max-parallelism 100 --min-hostgroup 100 - oX results.xml

You will find here : http://nmap.org/book/man-performance.html the detailed explaination of those options.

To save time you can define specific subnets to scan using -iL a input files, and exclude some IP/subnet. More details here: http://nmap.org/book/man-target-specification.html

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .