up vote 3 down vote favorite
share [g+] share [fb]

Anyone know if its possible to halt a running nmap scan and for another scan on a different machine to 'pick up where it left off'?

link|improve this question
85% accept rate
1  
Don't think this is possible without a bit of messing, around one could output the scan data to a file then read the file on another machine and retrieve the last scanned IP address and set a start range from that. that's just how i would do it – Christopher Wilson Jun 9 '10 at 1:25
feedback

2 Answers

up vote 1 down vote accepted

nmap supports different output formats for human readability and scripted parsing.
As a simple trick, you should be able to process the 'grepable output' form to identify the extent of completed scan and generate a continuing scan command for the other machine.

Alternatively, nmap has a host of control options. You could just create multiple scan commands that cover a range and issue them from different machines (that would be a distributed scan).

Of course, that does not help if you have started a longish scan and later decide to (say) complete it from your home :-), the output processing scheme should work then.

link|improve this answer
I was thinking along the same lines, but unfortunatly I don't think this would work for --randomize-hosts. The distributed scan makes sense if you're planning and thinking ahead :) Thanks Nik – Andrew Bolster Jun 9 '10 at 7:10
Well, the randomize is not really that random (groups of 2,048 hosts at a time are randomly chosen, making the entire scan less conspicuous when examining traffic patterns), you might be able to premeditate and even compute blocks that are covered, from the output file. But, if you 'might' move to a different machine, why not just write multiple scan range commands and run them with a script? that way you can continue from the last-and-incomplete scan command. – nik Jun 9 '10 at 11:37
feedback
up vote 0 down vote

Without some serious hackery, I can't think of any way this could be done. It's not supported by nmap, so short of dumping the memory it's using, and restoring this elsewhere, I doubt it can be done. Cheat Engine supports saving and loading memory states, but I've no idea if this would work across different machines..

The best you can probably do is to look at the output file you've got so far, and then try to scan blocks that haven't been included in it yet.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.