Re: Detecting hosts in large subnets

[Hillel <hillel.t () gmail com>]

4N9e Gutek wrote:

> > > my only interest is host availability. The software runs
> > >      
> within the LAN, which means there is no blocking firewall.
> - Assuming those two conditions, note that the -sP scan
> sends both a ICMP (echo request) and a TCP (to port 80)
> probes. If you just want to know who is up, consider adding
> a -PE, -PP or -PM option. This will force ICMP only, and
> reduces your scan time by a half.
> (see
> http://www.insecure.org/nmap/man/man-host-discovery.html
> for details )
>  
That's true to scans outside my subnet, but as I saw from docs and 
sniffer output, when nmap scans my subnet it uses only arp scan (no ICMP 
and no TCP probes). The local subnet is my main problem, but I will use 
these options for scanning external subnets.

> - Consider also the --min_hostgroup specification (
> http://www.insecure.org/nmap/man/man-performance.html ) for
> increasing performances at the beginning of the process
> (ok, you'll gain about 1 or two seconds, but...)
>  
I did try to play with this option, but no considerable gain was 
achieved. As you said my scan is long and the time it takes nmap adjust 
this parameter doesn't seem very long. I will try to play with it some 
more though, even a couple of seconds is nice.

>  
>
> > > Are there any licensing issues when including nmap and
> > >      
> libpcap (it's a windows app) in a commercial release?
> -You should have a look at the Legal Notice (
> http://www.insecure.org/nmap/man/man-legal.html#nmap-copyright
> ) concerning the "derived works", wich deals with any that
> :
>   *Integrates source code from Nmap
>   *Reads or includes Nmap copyrighted data files, such as
> nmap-os-fingerprints or nmap-service-probes.
>   *Executes Nmap and parses the results (as opposed to
> typical shell or execution-menu apps, which simply display
> raw Nmap output and so are not derivative works.)
>   *Integrates/includes/aggregates Nmap into a proprietary
> executable installer, such as those produced by
> InstallShield.
>   *Links to a library or executes a program that does any
> of the above.
>
>  
Ouch! this looks like a killer. As I understand it there is no way to 
use parsed nmap output in a commercial app without either releasing the 
app as GPL, or buying a commercial nmap license.
Do I understand correctly?

Hillel.


_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev