On Wed, Nov 16, 2011 at 01:11:32PM +0100, jeetika kataria wrote:
I am doing a UDP port scan with -T4 template but i set the scan delay as
which is more than rtt timeout, according to this template the max
option is set to 6 but after analyzing the scan it is seen that nmap is
transmitting a probe for each port only 2 times rather than 6. Whats the
reason for this behavior of Nmap?
Nmap only uses all of its retires when it senses that the network is
unreliable. The default is --max-retries 10, but it hardly ever sends 10
retransmissions. Sending a probe only two times is normal behavior. See
this part of the man page:
"The default (with no -T template) is to allow ten
retransmissions. If a network seems reliable and the target
hosts aren't rate limiting, Nmap usually only does one
retransmission. So most target scans aren't even affected by
dropping --max-retries to a low value such as three."