Skip to main content

​
Overview

Optimization options help you balance scan speed, accuracy, and reliability. These settings control retry behavior, timeouts, port verification, and host discovery.

​
Retry Configuration

​
-retries
integer
default:"3"
Number of retry attempts for port scanning.When a port doesn’t respond, scan4all will retry the specified number of times before marking it as closed or filtered.Default values by scan type:
  • SYN scan: 3 retries
  • CONNECT scan: 3 retries
Range: 0-10 (practical range: 1-5)Examples:
# No retries (fastest, least reliable)
scan4all -host example.com -retries 0

# Default (balanced)
scan4all -host example.com -retries 3

# High reliability (slower)
scan4all -host example.com -retries 5
Increase retries for:
  • Unstable networks
  • High packet loss environments
  • Critical scans requiring accuracy
Decrease retries for:
  • Fast reconnaissance
  • Stable local networks
  • Time-sensitive scans

​
Timeout Configuration

​
-timeout
integer
default:"1000"
Milliseconds to wait for port responses before timing out.Controls how long to wait for a response from each port before considering it unresponsive.Default values by scan type:
  • SYN scan: 1000ms (1 second)
  • CONNECT scan: 3000ms (3 seconds)
Range: 100-30000msExamples:
# Fast scan, aggressive timeout
scan4all -host example.com -timeout 500

# Default
scan4all -host example.com -timeout 1000

# Patient scan for slow networks
scan4all -host example.com -timeout 3000

# Very patient for satellite/high-latency links
scan4all -host example.com -timeout 5000
Timeouts that are too short may cause false negatives (missing open ports). Timeouts that are too long will significantly increase scan duration.

​
Timing Between Phases

​
-warm-up-time
integer
default:"2"
Seconds to wait between scan phases.scan4all performs scanning in phases (port discovery, service detection, vulnerability checks). This setting controls the pause between phases to allow the network and target system to settle.Range: 0-30 secondsExamples:
# No warm-up (fastest)
scan4all -host example.com -warm-up-time 0

# Default
scan4all -host example.com -warm-up-time 2

# Gentle on target systems
scan4all -host example.com -warm-up-time 5
Increase warm-up time when:
  • Scanning production systems
  • Avoiding rate limiting
  • Giving IDS/IPS systems time to reset
  • Working with resource-constrained targets

​
Port Verification

​
-verify
boolean
default:"false"
Validate discovered ports with TCP CONNECT verification.After the initial port scan, re-check all found ports using a full TCP connection to confirm they are truly open. This reduces false positives.Example:
# Verify all findings
scan4all -host example.com -verify

# Fast SYN scan with verification
scan4all -host example.com -s s -rate 2000 -verify

# Full port scan with verification
scan4all -host example.com -p 1-65535 -verify -retries 2
Impact:
  • Increases scan time by 20-40%
  • Reduces false positives
  • Provides higher confidence in results
  • Uses TCP CONNECT regardless of initial scan type
Enable verification for:
  • Critical security audits
  • High-accuracy requirements
  • Reducing false positives
  • Fast SYN scans that might miss responsive ports

​
Host Discovery

​
-ping
boolean
default:"false"
Use ping (ICMP echo) probes for host discovery and validation.Performs ICMP ping before port scanning to:
  • Verify host is alive
  • Measure network latency
  • Identify fastest route
  • Skip dead hosts
Example:
# Ping before scanning
scan4all -host example.com -ping

# Scan subnet with ping discovery
scan4all -host 192.168.1.0/24 -ping -tp 100
Benefits:
  • Skips unresponsive hosts
  • Optimizes scan order by latency
  • Reduces wasted scan time
  • Provides network reachability info
Limitations:
  • Many hosts block ICMP
  • Firewalls may filter pings
  • Can cause false negatives
Some hosts don’t respond to ping but have open ports. Consider scanning without ping if you suspect ICMP is blocked.

​
Optimization Strategies

​
Maximum Speed (Less Reliable)

scan4all -host example.com \
  -timeout 500 \
  -retries 1 \
  -warm-up-time 0 \
  -rate 5000

scan4all -host example.com \
  -timeout 1000 \
  -retries 3 \
  -warm-up-time 2 \
  -rate 1000

​
Maximum Accuracy (Slower)

scan4all -host example.com \
  -timeout 3000 \
  -retries 5 \
  -warm-up-time 3 \
  -verify \
  -ping

​
High-Latency Networks

scan4all -host example.com \
  -timeout 5000 \
  -retries 4 \
  -warm-up-time 5 \
  -rate 200

​
Local Network (Fast & Reliable)

scan4all -host 192.168.1.1 \
  -timeout 500 \
  -retries 2 \
  -rate 5000 \
  -verify

​
Network Type Recommendations

Network TypeTimeoutRetriesWarm-upVerifyPing
Local LAN500ms21sYesNo
Internet (Good)1000ms32sOptionalYes
Internet (Poor)3000ms43sYesYes
Satellite/High-latency5000ms55sYesOptional
Fast Reconnaissance500ms10sNoNo
Security Audit2000ms43sYesYes

​
Tuning for Scan Scope

​
Small Target Set (1-10 hosts)

# Thorough and accurate
scan4all -l targets.txt \
  -p 1-65535 \
  -timeout 2000 \
  -retries 4 \
  -verify \
  -ping

​
Medium Target Set (10-100 hosts)

# Balanced approach
scan4all -l targets.txt \
  -tp 1000 \
  -timeout 1000 \
  -retries 3 \
  -verify

​
Large Target Set (100+ hosts)

# Efficient scanning
scan4all -l targets.txt \
  -tp 100 \
  -timeout 1000 \
  -retries 2 \
  -warm-up-time 1 \
  -ping

​
Performance Impact

​
Timeout Effects

  • Lower timeout: Faster scans, more false negatives
  • Higher timeout: Slower scans, fewer false negatives
  • Impact: Linear with number of ports × hosts

​
Retry Effects

  • Fewer retries: Faster scans, less reliable
  • More retries: Slower scans, more reliable
  • Impact: Multiplicative on failed probes only

​
Verification Effects

  • Without verify: Faster, potential false positives
  • With verify: 20-40% slower, high accuracy
  • Impact: Only on discovered open ports

​
Troubleshooting

​
Missing Open Ports

Symptoms: Known open ports not detected Solutions: 
# Increase timeout and retries
scan4all -host example.com -timeout 3000 -retries 5

# Add verification
scan4all -host example.com -verify

# Reduce scan rate
scan4all -host example.com -rate 500 -timeout 2000

​
Scan Too Slow

Symptoms: Taking much longer than expected Solutions: 
# Reduce timeout and retries
scan4all -host example.com -timeout 800 -retries 2

# Remove verification
scan4all -host example.com  # Don't use -verify

# Reduce warm-up time
scan4all -host example.com -warm-up-time 0

​
False Positives

Symptoms: Ports reported as open but aren’t Solutions: 
# Enable verification
scan4all -host example.com -verify

# Increase retries
scan4all -host example.com -retries 4 -verify

​
Network Overload

Symptoms: Packet loss, incomplete results Solutions: 
# Increase warm-up time
scan4all -host example.com -warm-up-time 5

# Reduce rate and increase timeout
scan4all -host example.com -rate 300 -timeout 2000

​
Best Practices

  1. Start with defaults: Adjust only if needed
  2. Test on known hosts: Verify settings work correctly
  3. Match network conditions: Adjust timeouts for latency
  4. Use verification for accuracy: When false positives are unacceptable
  5. Balance speed vs accuracy: Faster isn’t always better
  6. Monitor with stats: Use -stats to observe behavior
  7. Document your settings: Keep notes on what works for different scenarios

Build docs developers (and LLMs) love

Get started for freeTalk to us