From ed4e96b4f7776ce00d68a09ec96f5d656928b306 Mon Sep 17 00:00:00 2001 From: david Date: Wed, 9 Apr 2008 22:23:57 +0000 Subject: [PATCH] Update the --min-rate documentation in the reference guide. --- docs/refguide.xml | 32 +++++++++++++++++++++++--------- 1 file changed, 23 insertions(+), 9 deletions(-) diff --git a/docs/refguide.xml b/docs/refguide.xml index 1a49438ab..5fab0ced8 100644 --- a/docs/refguide.xml +++ b/docs/refguide.xml @@ -2310,26 +2310,40 @@ threshold based intrusion detection and prevention systems (IDS/IPS). Nmap's dynamic timing does a good job of finding an appropriate speed at which to scan. Sometimes, however, you may happen to know an -appropriate speed for a network, or you may have to guarantee that a -scan will be finished by a certain time. When the - is given Nmap will do its best to send -packets as fast or faster than the given rate. The argument is a +appropriate scanning rate for a network, or you may have to guarantee +that a scan will be finished by a certain time. When the + option is given Nmap will do its best to +send packets as fast or faster than the given rate. The argument is a positive real number representing a packet rate in packets per second. -For example, using --min-rate 300 will ensure that -the packet sending rate doesn't fall below 300 packets per second. -Specifying a minimum rate does not keep Nmap from going faster if -conditions warrant. +For example, specifying --min-rate 300 means that +Nmap will try to keep the sending rate at or above 300 packets per +second. Specifying a minimum rate does not keep Nmap from going faster +if conditions warrant. There are two conditions when the actual scanning rate may fall below the specified minimum. The first is if the minimum is faster than the fastest rate at which Nmap can send, which is dependent on hardware. -In this case Nmap will send packets as fast a possible, but be aware +In this case Nmap will send packets as fast as possible, but be aware that such high rates are likely to cause a loss of accuracy. The second case is when Nmap has nothing to send, for example at the end of a scan when the last probes have been sent and Nmap is waiting for them to time out or be responded to. It's normal to see the scanning rate drop at the end of a scan or in between groups of hosts. +Specifying a minimum rate should be done with care. Scanning +faster than a network can support may lead to a loss of accuracy. In +some cases, using a faster rate can make a scan take +longer than it would with a slower rate. This is +because Nmap's adaptive +retransmissionadaptive retransmission +will detect the network congestion caused by an excessive scanning rate +and increase the number of retransmissions in order to improve accuracy. +So even though packets are sent at a higher rate, more packets are sent +overall. Cap the number of retransmissions with the + +option if you need to set an upper limit on total scan +time. + The option is global, affecting an entire scan, not individual hosts. It only affects port and host discovery scans. Other features like OS detection implement their own