Correct timing in Nmap scans is important for the accuracy and effectiveness of the scan. In the
case of outside scans, it is usually preferable to use slow scans to avoid devices such as IPS / IDS,
whereas in a scan from an internal network, quick scan options will be preferred. Qhile a fine grained
timing controls are powerful and effective.
Fortunately Nmap offers a simple approach with six timing templates.
You can specify them with "-T" option and their number (0–5) or their name. The template
names are paranoid (0),
sneaky (1), polite (2) , normal (3), aggressive (4) and insane (5).
The first two are for IDS evasion. Polite mode,
slows down the scan to use less bandwidth and target machine resources. Normal mode is the default,
And so T3 does nothing.
Aggressive mode speed scans up by making the assumption that you are on a reasonably fast and reliable
network.
Finally insane mode assumes that you're on an extraordinarily fast network or you're willing to sacrifice
accuracy for speed.
--max-retries option is to specify the maximum number of port scan probe retransmissions.
When and Nmap receives no response to a port scan probe it could mean that the port is filltered or maybe
the probe or response was simply lost on the network.
It's also possible that the target host as rate limiting enable that temporarily block the response.
So Nmap tries again by retransmitting the initial probe. If Nmap detects poor network reliability,
it may try many more times before giving up on report.
Now while this benefits accuracy it also lengthens scan times. So, when performance is critical,
scans may be sped up by limiting the number of retransmissions allowed.
You can even specify --max-retries 0 to prevent any retransmissions. Though that's only recommended for
situations such as informal surveys where occasional missed ports and hosts are acceptable.
The default (with no -­T template) template is to allow ten retransmissions. -­host­timeout is used to give
up slow targets.
Some hosts simply take a long time to scan.
This may be due to poorly performing or unreliable networking hardware or software,
packet rate limiting or restricted firewall. The slowest few percent of the scanned hosts can eat up
a majority of the scan time.
Sometimes it's best to cut your losses and skip to those hosts initially.
Specify -­host­timeout with a maximum amount of time you are willing to wait.
For example specify 30 minutes to ensure that Nmap doesn't waste more than half an hour on a single host.
Note that Nmap may be scanning other hosts at the same time during that half an hour so it's not a complete
loss.
Nmap utilizes parallelism and many advanced algorithms to accelerate the scans. Especially in the
case of external scans,
it may be necessary to close the parallel scan. That is to send a single packet to a server at the same time.
Nmap utilizes different options for this purpose:
As we saw just a few minutes ago you can manage the timing using -T option.
If you use the templates (0) paranoid (1) sneaky or (2) polite parallelisation is closed. That means these
template serialises the scan. So only one port is scanned at a time. --scan-delay option causes Nmap
to wait at least the given amount of time between each probe it sends to a given host.
This is particularly useful in the case of rate limiting. Solaris machines (among many others) will usually
respond to UDP scan probe packets with only one ICMP message per second.
Any more than that sent by Nmap will be wasteful.
--scan-delay of 1 second will keep Nmap at that slow rate. Nmap tries to detect rate limiting and
adjust the scan delay accordingly.
But it doesn't hurt to specify it explicitly if you already know what rate works best.
OK so by default and map calculates an ever-changing ideal parallelism based on network performance
the --max-parallelism option is sometimes set to 1 to prevent Nmap from sending more than one probe
at a time to hosts. Nmap has the ability to port scan or version scan multiple hosts in parallel.
Nmap does this by dividing the target IP space into groups and then scanning one group at a time.
When a maximum group size is specified with --max-hostgroup Nmap will never exceed that size.
So if you specify maximum number of hosts in a group as 1 using -­max-hostgroup option, there will be
only 1 host in the group and only 1 host will be scanned at a time.
So what do you reckon the difference is between the --max-parallelism and the --max-hostgroup.
Do you see it when you set --max-parallelism to 1 Nmap sends only 1 packet to a host a time. When
you set --max-hostgroup to 1 Nmap scans only one host at a time.