RE: Scan 3 thousand host consume severals hour

["Sina Bahram" <sbahram () nc rr com>]

A few comments:

You mentioned 3000 machines, yet you are scanning a range of 65536 machines
because you are scanning an entire class B network
 
Also, you are doing a TCP scan and a UDP scan. You might want to simply do a
syn scan, as that is faster. The TCP scan will take forever and a day
unfortunately ... This is no fault of nmap, but it is due to the fact that
it has to do a three way handshake, and also remember that the firewalls
aren't helping things any, *smile*.

It's good that you have -n for no dns resolution, and hopefully the new
patch for concurrent DNS querries will make it into nmap soon, which should
help things along a little bit as well.

I would recommend that you find a better way of narrowing down the machines
you have. For example, can you simply do a list scan of the machines on your
network and then grep/awk for the appropriate entries to place into a hosts
file which you can pass into nmap with -iL ...

Also, do not use -v, but instead simply store the results of your nmap scans
with the greppable output option, then use a tool like ndiff to perform
analysis on them. You can even set that script up to run each hour and email
you the results.

If you would like some advice on how to do this, or if maybe I misunderstood
something, please let me know how I can help.

Take care,
Sina

-----Original Message-----
From: nmap-dev-bounces () insecure org [mailto:nmap-dev-bounces () insecure org]
On Behalf Of Ricardo A. Reis
Sent: Sunday, December 18, 2005 2:21 PM
To: nmap-dev () insecure org
Subject: Scan 3 thousand host consume severals hour

Hi,


I work on the UNIFESP a large Brazilian University with +/- 3000 windows
workstations, now  i  create a routine capable to  scan for worms  and
softwares listening, in my test the scan consumo +/- 49 hours, because many
workstations with WinXP use firewall.
         The question is with is possible reduce the time ?
 
      i use this line on FreeBSD Monitor,
  
#nmap -v -sT -sU -p 1-65535 -n  172.16.0.0/16 


Thanks

Ricardo A. Reis
UNIFESP
Unix and Network Admin




        

        
                
_______________________________________________________
Yahoo! doce lar. Faga do Yahoo! sua homepage. 
http://br.yahoo.com/homepageset.html 




_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev