I need to scan large network which has 5000 IPs. I have limited time duration. I have done initial maths and concluded that, in a group of 4 individual has to perform 70 IP nmap scan.

Consider that I want more out of nmap. Which method will be effective for me?

Initially I thought of running top 1000 ports scan and then to perform all 65535 port scan in the range where I got some results after performing initial 1000 ports scan. Assume that rest all hosts are dead in which I have not got the result. Also I want to check those even roughly.

What would you recommend? Which scan type and methodology shall I follow to achieve my target?

  • 1
    What do you want to get out of that scan ?
    – Stephane
    Jun 2 '15 at 12:56
  • I would run scans in parallel from different points.
    – schroeder
    Jun 2 '15 at 16:22
  • Hey @schroeder, that sounds interesting, how does that work? Could you please share some code or command line examples? :)
    – voices
    Dec 11 '15 at 12:03
  • 1
    @tjt263 it's not a code-based suggestion. I literally mean to run nmap from different machines in the network, splitting up the work. "Divide-and-Conquer"
    – schroeder
    Dec 11 '15 at 15:12
  • @schroeder Ah.. I see.. I thought you were implying bulk threads via a single host or something.
    – voices
    Dec 12 '15 at 3:43

NMap scan can take a long time, try a small number of ports over a large IP range first.

Select a few of the most important ports to you and try those first.

Have you considered MassScan https://github.com/robertdavidgraham/masscan instead of NMap.

  • Thanks for your valuable suggestion but it sends 10000 million packets per second. It will be too much agressive for my client.
    – FrOgY
    Jun 2 '15 at 19:04
  • 1
    From masscans documentation By default, the rate is set to 100 packets/second. To increase the rate to a million use something like --rate 1000000. github.com/robertdavidgraham/masscan/blob/master/README.md Jun 3 '15 at 1:19
  • I would second the recommendation for MassScan. It is specifically designed to scan huge numbers of hosts in a short amount of time and its speed is configurable.
    – tlng05
    Jun 3 '15 at 16:21
  • "It can scan the entire Internet in under 6 minutes." Surely, this can't be accurate?
    – voices
    Dec 12 '15 at 15:52

Since your question is about nmap, I'd recommend the following command:

$ sudo nmap -O -T5 -PE -F --osscan-limit --max-rtt-timeout 100ms
--max-parallelism 100 --min-hostgroup 100 - oX results.xml

You will find here : http://nmap.org/book/man-performance.html the detailed explaination of those options.

To save time you can define specific subnets to scan using -iL a input files, and exclude some IP/subnet. More details here: http://nmap.org/book/man-target-specification.html

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.