Question

I want to scan a large network, for example 10.10.0.0/16 and I’m looking for the port 22 open, but I’m only interested in those ports that run “OpenSSH 5.1”.

What I’ve done until now is the following:

nmap -PN -T4 -sS -p 22 -sV 10.10.0.0/16 -oG test_results
cat test_results | grep 'OpenSSH 5.1'

This works, but here is the difficult part. Nmap initiates service scan only after it completes port scan of all the IPs in the range of the scan, am I correct?

But what if I want to view the service that is running after each port scan of a single IP, not after the whole range of IPs has been scanned. In other words:

1. Port scan one IP, find out if port 22 is open.
2. If 22 port is open, then service scan now.
3. If the service name matches ‘OpenSSH 5.1’, then output IP immediately on screen, while scan is still running.
4. Port scan the next IP in range… and so on…

Hope I made some sense, thank you.

Answer 1

That is not how Nmap is designed to work, for efficiency reasons. Especially if you are scanning a /16 network, you will find this approach to be highly inefficient.

You may be interested in the --max-hostgroup option, which can be used to set the maximum number of hosts per hostgroup. By default, scans for just a few ports use a larger hostgroup, which means you won’t see results as quickly (though the scan will be faster overall). You can set it to a lower value like 24 in order to get the results for each batch of 24 hosts when it is done. Setting it to 1 would give the effect you want.