‫Correct timing and end map scans is important for the accuracy and effectiveness of the scan.
‫In the case of outside scans, it is usually preferable to use flow scans to avoid devices such as apps
‫and ideas.
‫Whereas in a scan from an internal network, quick scan options will be preferred.
‫While the fine grained timing controls are powerful and effective, fortunately, and Map offers a simple
‫approach with six timing templates.
‫You can specify them with the uppercase T option and their number zero through five or their name.
‫The template names are paranoid.
‫Zero.
‫Sneaky one.
‫Polite to normal.
‫Three.
‫Aggressive four and insane five.
‫The first two are for IDs evasion.
‫Polite mode slows down the scan to use less bandwidth and target machine resources.
‫Normal mode is the default, and so T3 does nothing.
‫Aggressive mode.
‫Speed scans up by making the assumption that you were on a reasonably fast and reliable network.
‫Finally, insane mode assumes that you're on an extraordinarily fast network or you're willing to sacrifice
‫some accuracy for speed.
‫Max Retrials option is to specify the maximum number of ports again, probe retransmission.
‫When Mapp receives no response to a port scan probe, it could mean that the port is filtered, or maybe
‫the probe or response was simply lost on the network.
‫It's also possible that the target host has rate limiting enabled that temporarily blocked the response.
‫So Nmap tries again by re transmitting the initial probe if an mapp detects poor network reliability.
‫It may try many more times before giving up on a port.
‫And while this benefits accuracy, it also lengthens scan times.
‫So when performance is critical, scans may be sped up by limiting the number of Re transmissions allowed.
‫You can even specify MAX retry is zero to prevent any Re transmissions, though that's only recommended
‫for situations such as informal surveys where occasional missed ports and hosts are acceptable.
‫The default with no uppercase T template is to allow 10 Re transmissions.
‫Host timeout is used to give up slow target, some host simply take a long time to scan.
‫This may be due to poorly performing or unreliable networking hardware or software packet rate limiting
‫or restricted firewall.
‫The slowest few percent of the scanned hosts can eat up a majority of the scan time.
‫Sometimes it's best to cut your losses and skip to those hosts initially.
‫Specify host time out with a maximum amount of time you're willing to wait.
‫For example, specify 30 minutes to ensure that and map doesn't waste more than half an hour on a single
‫host.
‫Note that Nmap may be scanning other hosts at the same time during that half an hour, so it's not a
‫complete loss.
‫And Map utilizes parallelism and many advanced algorithms to accelerate the scans, especially in the
‫case of external scans.
‫It may be necessary to close the parallel scan that is to send a single packet to a server at the same
‫time, and Map utilizes different options for this purpose.
‫As we saw just a few minutes ago, you can manage the timing using uppercase T option if you use the
‫template zero paranoid, one sneaky or too polite, parallel ization is closed.
‫That means these templates serialize is the scan, so only one port is scanned at a time.
‫Scan, delay option causes and map to wait at least a given amount of time between each probe it sends
‫to a given host.
‫This is particularly useful in the case of rate limiting.
‫Solaris machines, among many others, will usually respond to UDP scan probe packets with only one
‫ICMP message per second.
‫Any more than that sent by end map will be wasteful, scan delay of one second or keep and map at that
‫slow rate.
‫And Matt tries to detect rate limiting and a justice can delay accordingly.
‫But it doesn't hurt to specify it explicitly if you already know what rate works best.
‫OK, so by default, and Map calculates an ever changing ideal parallelism based on network performance,
‫the max parallelism option is sometimes set to one to prevent and map from sending more than one probe
‫at a time to hosts.
‫And Map has the ability to port, scan or version scan multiple hosts in parallel, and map does this
‫by dividing the target IP space into groups and then scanning one group at a time.
‫When a maximum group size is specified with Max, host group and map will never exceed that size.
‫So if you specify maximum number of hosts in a group as one using Max host group option.
‫There will be only one host in the group, and only one host will be scanned at a time.
‫So what do you reckon the difference is between the MAX parallelism and the Max host group?
‫Did you see it?
‫When you set Max parallelism to one end map sends only one packet to a host at a time.
‫When you said Max host group to one end map scans only one host at a time.