1

I read on a book that the SYN scan in nmap is usually a lot faster than the TCP connect scan, because it doesn't go through all the three way handshake connection. But when i try both scans on the same target, the TCP connect scan takes 2 seconds, while the SYN scan takes 7 minutes at least.

Can anyone tell me what's wrong here ?

Improve this question
1

1 Answer 1

Reset to default
3

While the SYN scan method itself is theoretically quicker, it doesn't mean that it will always be the best or fastest scan to use. It is possible that a firewall or IPS has detected the scan and is slowing you down (nearly every NIDS in the world knows about SYN scans and will alert on sight).

You can also try adjusting the timing settings (-T[0-5], higher is faster/more aggressive).

In short, there is no one scan mode or setting that will always be fastest, and you should experiment to find what works best for the target.

Improve this answer
6
  • thanks for the answer man, but is it really normal that SYN scan takes more than 100 times more time than TCP Connect scan ?? Commented Jan 23, 2016 at 19:56
  • This supposes, that a TCP connect scan will not be detected in contrast to a syn scan, right? Why would that be the case? Commented Sep 16, 2021 at 11:21
  • @m4110c a single SYN scan could be flagged by an IDS, since it doesn't really follow the TCP protocol (at least in a normally expected way). Per contrast, a TCP connect scan can be detected, but the IDS/IPS has to determine whether they are legitimate connection attempts vs. a scan, and would have to wait for potentially several ports to be scanned to know. Commented Sep 17, 2021 at 1:44
  • @multithr3at3d Wouldn't it be extremely easy for an IDS to just monitor what happens after the initial connect. I mean, even if you'd scan just a single port, you will not send any legitimate data afterwards. So if I were an IDS I'd reason: "Ok, we have a connect with no data following. Must be a scan." Commented Sep 18, 2021 at 12:34
  • @m4110c perhaps, but I wonder if this would cause lots of false positives. I could maybe see legitimate cases where a client connects, but decides to close after receiving a message initially sent by the server. Depending on the protocol in question, of course. For a protocol like HTTP, this would not be normal. Commented Sep 18, 2021 at 17:44

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.