HTB Academy nmap network performance

Nmap Scanning Performance Optimization

Scanning performance plays a critical role when scanning large networks or working with low bandwidth. Nmap provides various options to tune scanning behavior:

• Timing template: -T <0-5>
• Parallelism: --min-parallelism <number>
• Timeouts: --initial-rtt-timeout <time>, --max-rtt-timeout <time>
• Rate control: --min-rate <number>
• Retries: --max-retries <number>

🧭 Quick Reference (What each knob does)

⏱️ Timeouts

When Nmap sends a packet, it waits for a Round-Trip-Time (RTT) response. By default, it starts with --min-rtt-timeout 100ms and adapts.

Default Scan

sudo nmap 10.129.2.0/24 -F
# Nmap done: 256 IP addresses (10 hosts up) scanned in 39.44 seconds

Optimized RTT

sudo nmap 10.129.2.0/24 -F   --initial-rtt-timeout 50ms --max-rtt-timeout 100ms
# Nmap done: 256 IP addresses (8 hosts up) scanned in 12.29 seconds

Tradeoff: Faster, but fewer hosts detected due to shorter timeout.

Tip: On lossy/WAN links, raise --max-rtt-timeout instead; on LANs, you can lower it more aggressively.

🔄 Max Retries

By default, Nmap retries up to 10 times if a port doesn’t respond. We can reduce this with --max-retries.

Default Scan

sudo nmap 10.129.2.0/24 -F | grep "/tcp" | wc -l
# 23

Reduced Retries

sudo nmap 10.129.2.0/24 -F --max-retries 0 | grep "/tcp" | wc -l
# 21

Tradeoff: Faster, but may miss open ports.

Hint: Try small values like --max-retries 2 before going to 0 to keep some resiliency.

🚀 Rates

If whitelisted in a penetration test, we can speed up scans using packet rates.

Default Scan

sudo nmap 10.129.2.0/24 -F -oN tnet.default
# Nmap done: 256 IP addresses (10 hosts up) scanned in 29.83 seconds

Optimized Scan

sudo nmap 10.129.2.0/24 -F --min-rate 300 -oN tnet.minrate300
# Nmap done: 256 IP addresses (10 hosts up) scanned in 8.67 seconds

Comparison – Open Ports Found

cat tnet.default     | grep "/tcp" | wc -l   # 23
cat tnet.minrate300  | grep "/tcp" | wc -l   # 23

✅ Faster, same results.

Add --min-parallelism 50 on clean networks; reduce if you see packet loss.

⏳ Timing Templates

Nmap provides predefined timing templates:

• -T0 → paranoid
• -T1 → sneaky
• -T2 → polite
• -T3 → normal (default)
• -T4 → aggressive
• -T5 → insane

Too aggressive scans can trigger security systems.

Example – Insane Scan

sudo nmap 10.129.2.0/24 -F -T5 -oN tnet.T5
# Nmap done: 256 IP addresses (10 hosts up) scanned in 18.07 seconds

Comparison – Open Ports Found

cat tnet.default | grep "/tcp" | wc -l  # 23
cat tnet.T5      | grep "/tcp" | wc -l  # 23

✅ Same results, faster execution.

🧪 Suggested Profiles (copy/paste)

Conservative WAN

sudo nmap -Pn -F   --max-retries 2   --initial-rtt-timeout 150ms --max-rtt-timeout 800ms   --min-parallelism 5   10.129.2.0/24

Balanced LAN

sudo nmap -F -T4   --max-retries 2   --initial-rtt-timeout 50ms --max-rtt-timeout 200ms   --min-rate 200 --min-parallelism 25   10.129.2.0/24

Speed run (whitelisted)

sudo nmap -F -T5   --max-retries 0   --initial-rtt-timeout 25ms --max-rtt-timeout 100ms   --min-rate 500 --min-parallelism 50   10.129.2.0/24

📌 Key Takeaways

• Lower RTT timeouts speed up scans but risk missing hosts.
• Fewer retries increase speed but may miss ports.
• Higher packet rate (--min-rate) accelerates scans if bandwidth allows.
• Timing templates (-T0 to -T5) provide easy tuning.
• Tune parallelism to the stability of the network; watch for packet loss and retransmits.

Ethics & safety: coordinate rates/templates with your client’s SOC; aggressive settings can flood links or trip IDS/IPS.