Timing and Performance Part 1 - NM

00:00

Welcome to the end map lesson on timing and performance.

00:04

At first glance, this lesson may seem like an unimportant at Aunt RN MAPP training Siri's, but I think you'll find that making use of and maps, timing and performance options can really help you in two key ways. First, that can help you tweak your scan so they provide you with intended results very quickly.

00:21

And second, it can help you to adjust timing and performance of scans and their probes in such a way that they can evade detection from intrusion detection systems.

00:31

I'm sure you can see the value of that functionality.

00:35

Let's get started.

00:36

Here are the learning objectives for this lesson.

00:39

First, I'll give you an overview of and maps performance related issues.

00:43

Next, we'll discuss some basic techniques to improve the performance of N map scans.

00:49

Then we'll talk about and maps built in timing templates and finally will run through some fine grain timing control options.

00:57

Let's talk about some General and Matt performance considerations.

01:00

First, I need to mention that performance is and always has been a big priority for M APP developers with every default scan that you run in and map. The developers have tried to take into consideration both speed and accuracy,

01:14

so

01:15

you can feel reasonably certain that even when timing options air not set, then map developers have tried their best to provide you with great performance. With that said, though, they've also set out to provide the user with accurate results. In general, the's to stated goals may sometimes be at odds with one another.

01:34

Additionally, scanning large networks with default scans can become slow. For example, it is certainly possible to run a default and maps can against a slash 16 network. But leaving all timing options at their default value will probably take a really long time to provide you with the information you really care about.

01:52

Several obvious ways to deal with this are to scan smaller network segments at a time,

01:57

limit the number of ports or probes toe only those that are important to you or fine tune timing and performance options like the ones provided to you in the rest of this lesson.

02:07

There are several types of scans that are pretty slow in almost every case,

02:13

even when you do a just timing options. For example, UDP scanning and version detection scans.

02:19

When you run these types of scans, take some of the things I mentioned into account

02:23

or

02:24

if the information they provide really doesn't align with your goals, just leave them out entirely.

02:31

Also, firewalls with response rate limiting can slow down scans. So when you determine that some of your targets are either firewalls or sitting on the other side of a firewall, you should either be willing to wait to get your scan results or should adjust timing options in such a way that the firewalls response rate limiting

02:50

is not activated.

02:53

One really powerful tool that end map uses by default is parallelism and advanced algorithms to speed up scans. This basically means that N map can send out multiple probes to multiple hosts at the same time.

03:06

Then it can dynamically calculate the best way to adjust its timing options in order to both retrieve results quickly and accurately.

03:14

The point here is that sometimes it is best to similar. Simply allow any map to make adjustments to it, scans dynamically and skip manual adjustments to timing altogether.

03:24

Ultimately, and Matt places performance optimization in the hands of the user, though,

03:30

you can feel confident that performance and accuracy are at the heart of them. ABS default scans. However, sometimes performance may be more important to you than extreme accuracy.

03:39

And the opposite is also true. Sometimes accuracy of results and the desire to be very quiet from a scanning perspective, maybe the most important.

03:49

The rest of this lesson will be devoted to helping you learn how to make those adjustments based on your goals.

03:55

Great. Mm. Scanning in that map is a result of careful scan construction that takes into account your goals and your time constraints.

04:04

Here are the most basic things you should consider regarding timing and performance and then map

04:10

first. Like I mentioned before and will probably mention again, Start with a clear goal with every one of your end map scans. Ask yourself, What information do I need to know? How important is 100% accuracy, and how fast do I need it?

04:24

Second,

04:25

leave out unnecessary tests. For example, if you don't really care about you, dp ports or if you don't need service, an application versions at the moment of your scan.

04:34

Just leave those things out since they have very clear performance ramifications.

04:40

Also, consider adjusting the ports you're interested in

04:44

by scanning using the DASH P Command line switch.

04:47

Remember that a default and maps camel scan 1000 ports, simply adding the dash capital. F option will drop that down to 100.

04:56

But if you're only interested in TCP ports 2123 25 80 then use the DASH P switch to make that change.

05:04

Third, ensure you have the latest version of en map,

05:08

though in map has been around and has been adjusted as network, the network landscape has changed. Enhancements are made very often. I'd suggest that you check your version of an map about once a month using the Dash Capital V command line switch, then compare it to the most recent stable release on maps website.

05:27

Upgrade when you can. After all, it's free.

05:30

And finally, when it makes sense, consider optimizing timing and performance parameters.