-scan_delay milliseconds-Similar to вЂ“T, this specifies how long to wait between probes.If NMap appears to hang, you might want to adjust this timer. -host_timeout milliseconds-Specifies how long to wait for a response before scanning stops for a single host.aggressive and insane attempt to speed up the scans, but because accuracy and stealth are important, you should avoid these unless you have a justifiable reason to use them. polite waits every 0.4 seconds and is designed to prevent host crashing. paranoid is helpful to avoid IDS systems and waits five minutes between sending packets. The default is normal, which attempts to scan as quickly as possible. -T -Changes the timing policies for scanning.Of course, discovering that these hosts crash is a vulnerability that you should document in your penetration report. Limiting this value decreases the scan rate, which is helpful when scanning some hosts that have been known to crash when being scanned. -M max sockets-Sets the maximum number of sockets used by NMap.Enable this to see the most detailed output. For example, to scan TCP ports 23 (Telnet), 25 (SMTP), and 80 (HTTP), you can type this: NMap -p T:23,25,80 You can also specify whether you want to ping UDP or TCP ports only. This switch lets you specify single ports, ranges, or lists of ports to scan. -p-Specifies the port number(s) to scan.-append_output-Appends the output to your existing log files instead of overwriting them.-oG logfilename-Same as вЂ“oN, but stores all the results on a single line for querying through the Grep program.-oX logfilename-Same as вЂ“oN, but this time send it to the logfile in XML format.

-oN logfilename-Sends the output in human-readable format to the file of your choosing.

You can perform a port scan against a host name through DNS (assuming the DNS server has the IPv6 AAAA records) or through the IP address. This switch also uses ICMP to determine if the host is live, but it uses a different ICMP packet for this purpose.

Some firewalls and routers block echo requests yet still allow other traffic to penetrate. Normally, NMap attempts to ping the hosts using ICMP echo request (ICMP type 1) packets to see if the host is there. -PP-Uses the ICMP timestamp request (ICMP type 13) packet to find listening hosts.-P0-Do not try to ping hosts before scanning them.In addition, other parameters are helpful: -sI-Dumb scan (also called an idle scan).The predominant switches available in NMap as they correspond to the scans covered earlier are as follows:: In the man (manual) page, NMap is described as a tool to 'allow system administrators and curious individuals to scan large networks which hosts are up and what services they are offering.' (To view more of the man page, type man NMap at the Linux command line.) NMap allows you to perform many of the scans previously covered. See Appendix B, 'Tools,' for information on these and other port scanners. Other port scanners include Superscan, Scanline, VScan, and Angry IP. NMap, although the most popular, is not the only port scanner available.

What does zenmap do