>> The simplest way to adjust
the performance of Nmap is by using timing templates.
They are extremely easy to remember
and to apply to your scans.
On this slide and on
the one page cheat sheet
>> I've provided with this course,
>> I've written out what each timing template
means and when you may consider using it.
In many of the previous labs we've gone through,
I've made on the fly adjustments to scans by
specifying the timing template I wanted to use.
All you have to do is put a dash capital T,
followed by a number from 0-5.
The lower the number, the slower the scan,
but also the more quiet it is.
The higher the number, the faster the scan,
but it is also more apt to being
flagged by an intrusion detection system.
Also, when using these options,
you really need to consider
the speed of your scanning station,
the speed of your target,
and the speed of the network between the two.
Setting the timing template to T5 may do little good
if you and your target are on
a 10 megabit per second network,
have little processing power,
and are a continent apart or are
using some method of anonymization.
T0 is considered paranoid and T1 is sneaky.
Both can be useful for IDS evasion.
T2 is polite and poses little risk,
but may also be slow.
T3 is normal.
If you're thinking about using this timing template,
you might just consider not specifying
a timing template at all because it is the default.
T4 is aggressive and assumes you and
your target are in a fast and reliable network,
and it runs the risk of being flagged by an IDS.
T5 is called insane mode and
assumes you and your target are in a very fast network.
Because of several of its performance tuning options,
it may provide a little less accurate scan results.
Options discussed next will give you
a more fine-grain timing on Nmap scans,
but are a little more difficult to remember and apply.
Sometimes they take so long to test for optimization
that they defeat the purpose of
performing scans within the timeframe.
Timing templates are an easy way to
remember and easy way to apply scans,
and they can actually be used in
conjunction with finer grain timing the options.
Just remember that the fine-grain
timing options will take
precedence over the timing template
where both exist in a scan.
When working with fine-grain timing control options,
the first thing you need to learn
is the effect of each of the options.
Secondarily, you need to learn about
how time is interpreted by Nmap.
In other words, is Nmap asking for milliseconds,
seconds, minutes, or hours?
The truth is, it can accept any of those options as
long as you append the ms for milliseconds,
s for seconds, m for minutes,
or h for hours next to
the number representing the associated time.
Before I start explaining what
each of these options does,
I want to say that using
the timing templates described in the previous slide or
default Nmap scans gives Nmap
the ability to dynamically
adjust the values of these options.
So before you decide to make
these tweaks on a really big or critical scan,
play around with them to make sure that
the scan times and results are acceptable to you.
In some cases, default Nmap scans may
perform better and give you more accurate results.
Let's run through each of these timing options.
Remember, you can combine these in an Nmap scan,
and you can even combine them with timing templates.
If you combine them with a timing template,
the fine-grain timing control will take precedence.
Keep in mind that I've placed each of
these fine-grain timing and
performance options on the one page cheat sheet
provided with this course.
So you don't need to worry about
memorizing them unless you just want to.
--host-timeout option is intended
to give up on slow targets.
In other words, some hosts may take
a really long time to respond for whatever reason.
--host-timeout simply tells Nmap to
give up on a host if it doesn't
respond within a given timeframe.
--min, max, and initial,
-rtt-timeout, actually will adjust
the timeout value of individual probes.
Nmap keeps track of the amount of time
it is waiting for a probe response.
Adjusting these values will change the way Nmap
determines when to retransmit probes.
If you specify a low --initial-rtt-timeout
and max-rtt-timeout,
you can speed up scan significantly.
--min and max-hostgroup adjusts
Nmap's ability to scan multiple hosts in parallel.
Adjusting these values will set the number of
hosts that Nmap will scan simultaneously.
Similarly, --min and max-parallelism
adjusts Nmap's ability to send
multiple probes to a group at the same time.
Adjusting these values will help Nmap determine
the number of probes that
Nmap will send at the same time.
--scan-delay and --max-scan-delay,
adjust the time delay between probes.
In other words, it will cause
Nmap to wait at least the given amount of
time between each probe it sends out to a host.
--max-retries sets the maximum number
of port scan, probe retransmissions.
Lowering this number will speed up scans but may
lead to inaccuracies of scan results.
--min and max-rate gives
you the ability to directly control the scanning rate.
By default, Nmap dynamically
determines and adjust this rate.
The number represents the number of
packets that Nmap will send per second.
For example, if you set a min-rate of
300 and you're on a fast network,
Nmap may dynamically adjust
the scanning rate up or faster.
However, if you specify a max-rate,
it will never exceed that number of packets per second.
It's really cool to learn about the granularity that
fine-grained timing control options offer for sure.
But when I first started learning
about Nmap's timing options,
I was like, where do I start?
What I found extremely helpful was this
Nmap provided table of
default values for each timing template.
If you're having performance issues
and want to make some tweaks,
I suggest that you set many of the options in
this table to the value in the T3 column.
Then start by making changes
accordingly based on what you
learned in the previous slide.
Carefully consider your goal and think about
what timeframe you have available in your given scans.
This table gives you
a good reference point for you to decide
how fast you want your scans to run
given the performance and your machine,
your network, and your target.
You can decide, given your goal,
how important accuracy is.
In this lesson, we covered the following.
First, I gave you an overview of
Nmap's performance related issues.
Next, we discussed some basic techniques to
improve the performance of Nmap scans.
Then we talked about Nmap's built-in timing templates.
Finally, we ran through
some fine-grain timing control options.
Thank you so much for walking through this lesson
on Nmap's Timing and Performance.