Re: nmap udp scan time

Kevin Mc Grath wrote:

I have completed a udp scan on an embedded device in the lab and the
scan duration was 18.22 hours.

The scan syntax used is as follows:

nmap -sU -p0-65535 <ip_addr>

Should a UDP scan take such a long time? Could the scan time relate to
some problem with the device?

If you don't get any negative response (such as the various ICMP unreachables)
from the device, it will largely be a question of timeouts and retransmissions. Factor
in the number of UDP ports probed in parallel, and the general speed of the network
connection, and you should be able to say if 18 hours is in the ballpark
or not.

Read and consider:

http://insecure.org/nmap/man/man-port-scanning-techniques.html

http://insecure.org/nmap/man/man-performance.html

Note that nmap adjusts the number of concurrent probes based on its performance.
You may have to force its lower limit (--min_parallelism) to something larger than 1.
Note also the default value of --max_retries, which is rather conservative for
reasonably fast devices on a lightly-loaded local LAN.

Check the http://insecure.org/nmap/docs.html for more useful documents. The Nmap book
will probably be the definitive reference on Nmap ... if and when it is published.

--
Anders Thulin anders.thulin@xxxxxxxxx 070-757 36 10

------------------------------------------------------------------------
This list is sponsored by: Cenzic

Need to secure your web apps NOW?
Cenzic finds more, "real" vulnerabilities fast.
Click to try it, buy it or download a solution FREE today!

http://www.cenzic.com/downloads
------------------------------------------------------------------------

Relevant Pages

  • Re: Identifying Kernel 2.4.x based Linux machines using UDP
    ... > Linux Kernel 2.4.x has a bug with the UDP implementation which allows ... It also isn't specific to UDP -- you'll find ... Last year I added a feature to Nmap which automates this IPID ...
    (Bugtraq)
  • Re: how nmap can know my firewalled servers ?
    ... UDP or ICMP protocol), it will mark the port as closed. ... descrition, how NMAP determins, if the UDP port is open or closed. ... Try Webroot's Spy Sweeper Enterprisefor 30 days for FREE with no ...
    (Security-Basics)
  • Re: IP Chains -- DENY or REJECT
    ... >-sU UDP scans: This method is used to determine which UDP (User Data? ... > to send 0 byte udp packets to each port on the target machine. ... is depend on specification of nmap. ... Which useage is correct, DENY or REJECT? ...
    (comp.os.linux.security)
  • nmap -- UDP scanning
    ... It is well documented that UDP scanners wait for an "icmp port unreachable" message to differentiate between open/filtered ... Seen as this method cannot be used, it does not seem feasible for nmap to generate any meaningful information in this ... If the port is open, nmap sends two udp packets with a length of zero -- no data is returned. ...
    (Pen-Test)