RE: Scan 3 thousand host consume severals hour

["Ricardo A. Reis" <ricardo_bsd () yahoo com br>]

Hi Sina,

> A few comments:
>
> You mentioned 3000 machines, yet you are scanning a range of 65536 machines
> because you are scanning an entire class B network

Yes, you this correct

The UNIFESP network topology exist many network segment's with subnet
mask /24, but doesn't a  continuum host's, this a problem caused by
sub-net delegation.
For samples is 172.16.[1-3,150-163].XXX, in the past i used a list
provide per ettercap using arp-request function but this cause a problem
with arp tables in old cabletron switches and cisco routers.

 
> Also, you are doing a TCP scan and a UDP scan. You might want to simply do a
> syn scan, as that is faster. The TCP scan will take forever and a day
> unfortunately ... This is no fault of nmap, but it is due to the fact that
> it has to do a three way handshake, and also remember that the firewalls
> aren't helping things any, *smile*.

You this correct again, 

i always use -sS with no windows hosts

> I would recommend that you find a better way of narrowing down the machines
> you have. For example, can you simply do a list scan of the machines on your
> network and then grep/awk for the appropriate entries to place into a hosts
> file which you can pass into nmap with -iL ...

 I use also -P0 per XP firewall block icmp, with this scan is more
slowly.
 I used -iL before fyodor announce the nmap lite version, the old nmap
use +/- 280 MB  this is a problem for central host monitor and per this
i resolved scan a severals class B.
  

> If you would like some advice on how to do this, or if maybe I misunderstood
> something, please let me know how I can help.


Thanks again, i test again with -sS and nmap lite version now using
subnets.



Ricardo A. Reis
UNIFESP
Unix and Network Admin



        

        
                
_______________________________________________________ 
Yahoo! doce lar. Faça do Yahoo! sua homepage. 
http://br.yahoo.com/homepageset.html 



_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev