Skip to content

Output & performance

MITRE ATT&CK: T1595 Active Scanning · Tactic: Reconnaissance · Last updated: 2026-10-13

Summary

Save every scan in all formats, turn the XML into an HTML report, and tune speed to the network you are on rather than always going as fast as possible.

Saving results

sudo nmap 10.129.2.28 -p- -oA target
xsltproc target.xml -o target.html
Flag File Use
-oN .nmap Human-readable copy of the terminal output
-oG .gnmap Greppable, one host per line (grep "/open/")
-oX .xml Parsed by tools; convert to HTML with xsltproc
-oA name all three Use this by default
--resume file Continue an interrupted scan
--append-output Append instead of overwrite

Timing & rate

Template Name Typical use
-T0 paranoid Extremely slow, rarely practical
-T1 sneaky Very slow
-T2 polite Lower load on fragile hosts
-T3 normal Default
-T4 aggressive Labs, reliable fast links
-T5 insane Fast and error-prone; can miss open ports

Finer control: --min-rate, --max-rate (packets/s), --max-retries, --host-timeout, --initial-rtt-timeout. A high --min-rate with --max-retries 0 is fast but may drop answers, so a port reported closed might actually be open.

sudo nmap 10.129.2.0/24 -F --max-retries 0 --initial-rtt-timeout 50ms   # fast, may miss hosts
sudo nmap 10.129.2.0/24 -F -T2                                          # gentle

Check speed by comparing the "scanned in N seconds" line and the number of hosts/ports found between runs; if the faster run found fewer, it was too aggressive.

Pentester view

  • Pick the profile by the target: -T4 or --min-rate in labs, -T2/--max-rate on production or old gear.
  • If results differ between two runs, trust neither: rerun the slower one on the disputed ports.
  • Keep the .xml as evidence; the HTML report is quick to show a client.

Defender view

  • High-rate scans appear as bursts in firewall logs and in conn.log connection counts per second per source.
  • Slow scans (-T1) spread over hours slip under short-window thresholds, so aggregate over a long window (24h unique ports per source).

CPTS exam notes

Time is limited: run -p- with a sensible --min-rate in the background, work other targets while it runs, and always keep the -oA files.