Nmap host timeout inquiry

[tommymay () comcast net (Tommy May)]

Hello Nmap Folk:

I am not an experienced developer, so please excuse my lack of knowledge on the inner 
mechanics.

I have been trying to optimize nmap scans for host discovery and find that the 
built in T4 option works awesome (after having played with all of the 
customizable "rtt" options)... but I also would like to add the --host-timeout 
parameter to speed up scans a little.

details:

I am using an input file (-iL) with entire /24 networks 

 - default "nmap -sTU -T4 -P0" on a reasonably fast /24 netblock with stateful 
firewall ruleset takes roughly 15 hours to complete, but its the most accurate 
results I have been able to produce (measure - all hosts that are truly up, 
result in the output file).

- I have been able to complete a scan on the same network with "nmap -sTU -T4 
-P0 --host-timeout 120m" in roughly 6 hours... but I notice that the second half 
of the netblock all times out... 

This leads me to suspect that the "--host-timeout" parameter may apply to all of the targets that you specifiy in the 
input list, rather than just IP by IP?  This could explain why half of the IP's 
in the netblock timed out, when no timeout parameter catches all of the IP 
addresses in the netblock.

Are my suspicions correct or am I just shooting in the dark?  I would suppose 
that I would have to do a separate IP by IP scan to allow the --host-timeout 
parameter to work per IP?

Any insight you may have as to how this parameter works in this way would be 
greatly appreciated, and will better help me to discover the optimal settings.

Sincerely,
Tommy May

_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://SecLists.Org