Improve Nmap Performance with These Brilliant Scripts

In this article, I will show you how to fix Nmap performance issues using Python scripts. By the end of this article, you will have a better understanding of how Nmap works and how you can use Python to extend its capabilities.

Identifying Performance Bottlenecks in Nmap

Before you start fixing Nmap performance issues, you need to identify the bottlenecks in the scanning process. I know firsthand what bottlenecks are, as I once tried to run an Nmap scan on a very slow computer. Let’s just say I had plenty of time to eat lunch.

To identify the bottlenecks in Nmap, you need to understand how it performs each of these techniques. You can use the “-d” flag to increase the debug level of Nmap and see what is happening under the hood.

For example, if you want to see what Nmap is doing when it performs a TCP port scan, you can use the following command:

nmap -d -p 1-65535 <target>

This will run an Nmap scan with debug output enabled for TCP port scanning. Look at the output and see where Nmap is spending most of its time.

Another useful tool for identifying performance bottlenecks in Nmap is Wireshark. By capturing the network traffic generated by Nmap, you can see which packets are being sent and received and how long it takes for Nmap to get a response.

Optimising Nmap Performance with Python

Now that you’ve identified the performance bottlenecks in Nmap, start optimising its performance using Python. There are several ways to do this, including:

One of the most effective ways to speed up Nmap scans is to parallelize them. Nmap supports parallel scanning using the “-Pn” flag, which tells Nmap to skip host discovery and assume that all hosts are up. You can use this flag in conjunction with Python’s multiprocessing library to run multiple Nmap scans in parallel.

Here’s an example Python script that uses multiprocessing to run Nmap scans in parallel:

import multiprocessing
import subprocess

def nmap_scan(ip):
    command = "nmap -Pn " + ip
    subprocess.call(command, shell=True)

if __name__ == '__main__':
    ips = ['192.168.1.1', '192.168.1.2', '192.168.1.3']
    with multiprocessing.Pool(processes=3) as pool:
        pool.map(nmap_scan, ips)

This script will run Nmap scans for three IP addresses in parallel, using three processes. You can adjust the number of processes based on the number of cores on your machine.

Additionally, you can further improve the performance of our script by limiting the number of ports scanned. By default, Nmap scans all 65,535 ports, but in most cases, you only need to scan a subset of those ports.

To limit the number of ports scanned, you can use the “-p” flag in Nmap and specify a range of ports to scan. For example, if you only want to scan the top 1000 ports, you can use the flag “-p 1–1000”.

Here’s an updated version of the script:

import nmap
import multiprocessing

def nmap_scan(ip):
    nm = nmap.PortScanner()
    nm.scan(ip, arguments='-sS -p 1-1000')
    print(nm.csv())

if __name__ == '__main__':
    ips = ['192.168.1.1', '192.168.1.2', '192.168.1.3']
    processes = []
    for ip in ips:
        p = multiprocessing.Process(target=nmap_scan, args=(ip,))
        processes.append(p)
        p.start()

    for p in processes:
        p.join()

By limiting the number of ports scanned, you can reduce the amount of time it takes for Nmap to complete the scan, resulting in faster overall performance.

Now that error handling and argument parsing are added, the script now looks like this:

import argparse
import nmap
import multiprocessing

def nmap_scan(ip):
    try:
        nm = nmap.PortScanner()
        nm.scan(ip, arguments='-sS -p 1-1000')
        print(nm.csv())
    except nmap.PortScannerError as e:
        print(f"Error while scanning {ip}: {e}")

if __name__ == '__main__':
    parser = argparse.ArgumentParser()
    parser.add_argument('--ips', nargs='+', required=True, help='List of IP addresses to scan')
    parser.add_argument('--processes', type=int, default=multiprocessing.cpu_count(), help='Number of processes to use')
    args = parser.parse_args()

    processes = []
    for ip in args.ips:
        p = multiprocessing.Process(target=nmap_scan, args=(ip,))
        processes.append(p)
        p.start()

    for p in processes:
        p.join()

Then pass the IP addresses to scan as command-line arguments when running the script, like this:

python nmap_scan.py --ips 192.168.1.1 192.168.1.2 192.168.1.3

Finally, by implementing the use of asyncio, running multiple scans simultaneously without the need for multiple processes is possible, which can significantly improve the efficiency of our code:

import argparse
import nmap
import asyncio

async def nmap_scan(ip):
    try:
        nm = nmap.PortScanner()
        nm.scan(ip, arguments='-sS -p 1-1000')
        print(nm.csv())
    except nmap.PortScannerError as e:
        print(f"Error while scanning {ip}: {e}")

async def run_scans(ips):
    tasks = [asyncio.create_task(nmap_scan(ip)) for ip in ips]
    await asyncio.gather(*tasks)

if __name__ == '__main__':
    parser = argparse.ArgumentParser()
    parser.add_argument('--ips', nargs='+', required=True, help='List of IP addresses to scan')
    args = parser.parse_args()

    asyncio.run(run_scans(args.ips))

In this code, you define the nmap_scan function as an asynchronous function using the async keyword. Then you define a new function, run_scans, which creates a list of tasks for each IP address and runs them asynchronously using the asyncio.gather() method.

Finally, you call the run_scans function using asyncio.run(), which runs the function in an event loop and returns the results.

To conclude, you’ve explored how to use Python to improve the efficiency of Nmap scans by implementing multiprocessing and error handling techniques. With these improvements, you can drastically reduce the time it takes to scan multiple IP addresses and ensure that you don’t miss any potential vulnerabilities. I hope that I showcased how useful Python is as a Cybersecurity Professional.