Skipping tests to speed up long scans

Nmap scans break down into different phases. When we are working with a large list of hosts, we can save up time by skipping tests that return information we don't need. By carefully selecting our scan flags, we can significantly improve the performance of our scans.

This recipe explains the process that takes place behind the curtains when scanning, and how to skip certain phases in order to speed up long scans.

How to do it...

To perform a full port scan with the timing template set to aggressive, and without the reverse DNS resolution or ping, use the following command:

# nmap -T4 -n -Pn -p- 74.207.244.221

The command we just used gives us the following output:

Nmap scan report for 74.207.244.221
Host is up (0.11s latency).
Not shown: 65532 closed ports
PORT     STATE SERVICE
22/tcp   open  ssh
80/tcp   open  http
9929/tcp open  nping-echo

Nmap done: 1 IP address (1 host up) scanned in 60.84 seconds

Compare the running time that we got against a full...