>> Welcome to the Nmap lesson on timing and performance.
At first glance, this lesson may seem like an
unimportant add onto our Nmap training series.
But I think you'll find that making use of
>> Nmap's timing and performance options can
>> really help you in two key ways.
First, it can help you tweak your scan so that they
provide you with intended results very quickly.
Second, it can help you to adjust
timing and performance of scans and
their probes in such a way that they can
evade detection from intrusion detection systems.
I'm sure you can see the value of
that functionality. Let's get started.
>> Here are the learning objectives for this lesson.
First, I'll give you an overview of
Nmap's performance related issues.
Next, we'll discuss some basic techniques to
improve the performance of Nmap scans.
Then we'll talk about Nmap's built-in timing templates
>> and finally, we'll run through some fine-grain timing control options.
>> Let's talk about some general
Nmap performance considerations.
First, I need to mention that performance is and
always has been a big priority for Nmap developers.
With every default scan that you run in Nmap,
the developers have tried to take into
consideration both speed and accuracy.
You can feel reasonably certain
that even when timing options are not set,
the Nmap developers have tried their
best to provide you with great performance.
With that said though,
they've also set out to provide
the user with accurate results.
In general, these two stated goals
may sometimes be at odds with one another.
Additionally, scanning large networks
with default scans can become slow.
For example, it is certainly possible to run
a default Nmap scan against /16 network.
But leaving all timing options
at their default value will probably
take a really long time to provide
you with the information you really care about.
Several obvious ways to deal with this
are to scan smaller network segments at a time,
limit the number of ports or
probes to only those that are important to you,
or fine-tune timing and performance options like
>> the ones provided to you in the rest of this lesson.
>> There are several types of scans that are
pretty slow in almost every case.
Even when you do adjust timing options,
for example, UDP scanning and version detection scans.
When you run these types of scans,
take some of the things I mentioned into account,
or if the information they
provide really doesn't align with your goals,
just leave them out entirely.
Also, firewalls with response
rate-limiting can slow down scans.
When you determine that some of your targets are
either firewalls or sitting
on the other side of a firewall,
you should either be willing to wait to get
your scan results or should
adjust timing options in such a way that
the firewalls response rate limiting is not activated.
One really powerful tool that Nmap uses by default is
parallelism and advanced algorithms to speed up scans.
This basically means that Nmap can send out
multiple probes to multiple hosts at the same time.
Then it can dynamically calculate the best way
>> to adjust its timing options in order to both
>> retrieve results quickly and accurately.
The point here is that sometimes it is
best to simply allow Nmap to make
adjustments to it scans dynamically and
skip manual adjustments to timing altogether.
Ultimately, Nmap places performance optimization
in the hands of the user though.
You can feel confident that performance and
accuracy are at the heart of
Nmap's default scans, however,
sometimes performance may be more important to you than
extreme accuracy and the opposite is also true.
Sometimes accuracy of results and
the desire to be very quiet
>> from a scanning perspective,
>> maybe the most important.
The rest of this lesson will be devoted to helping you
learn how to make those adjustments
>> based on your goals.
>> Great Nmap scanning in Nmap is a result of
careful scan construction that takes into
account your goals and your time constraints.
Here are the most basic things you should
consider regarding timing and performance in Nmap.
First, like I mentioned before
and will probably mention again,
start with a clear goal with
every one of your Nmap scans.
Ask yourself, what information do I need to know?
How important is 100 percent accuracy
and how fast do I need it?
Second, leave out unnecessary tests.
For example, if you don't really care
about UDP ports or if you
don't need service and application versions
at the moment of your scan,
just leave those things out since they have
very clear performance ramifications.
Also consider adjusting the ports you're interested in
by scanning using the -P command line switch.
Remember that a default Nmap scan
>> will scan a thousand ports.
>> Simply adding the -F option will drop
>> that down to a hundred.
>> But if you're only interested in TCP ports 21,
23, 25, and 80,
then use the -P switch to make that change.
Third, ensure you have the latest version of Nmap.
Though Nmap has been around and
has been adjusted as network,
the network landscape has changed.
Enhancements are made very often.
I'd suggest that you check your version of Nmap about
once a month using the -V command line switch,
then compare it to the most recent stable release
on Nmap's website.
Upgrade when you can,
after all, it's free.
Finally, when it makes sense,
consider optimizing timing and performance parameters.
Let's talk about that.