Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Anyone know if its possible to halt a running nmap scan and for another scan on a different machine to 'pick up where it left off'?

share|improve this question
Don't think this is possible without a bit of messing, around one could output the scan data to a file then read the file on another machine and retrieve the last scanned IP address and set a start range from that. that's just how i would do it – Christopher Wilson Jun 9 '10 at 1:25
up vote 1 down vote accepted

nmap supports different output formats for human readability and scripted parsing.
As a simple trick, you should be able to process the 'grepable output' form to identify the extent of completed scan and generate a continuing scan command for the other machine.

Alternatively, nmap has a host of control options. You could just create multiple scan commands that cover a range and issue them from different machines (that would be a distributed scan).

Of course, that does not help if you have started a longish scan and later decide to (say) complete it from your home :-), the output processing scheme should work then.

share|improve this answer
I was thinking along the same lines, but unfortunatly I don't think this would work for --randomize-hosts. The distributed scan makes sense if you're planning and thinking ahead :) Thanks Nik – Andrew Bolster Jun 9 '10 at 7:10
Well, the randomize is not really that random (groups of 2,048 hosts at a time are randomly chosen, making the entire scan less conspicuous when examining traffic patterns), you might be able to premeditate and even compute blocks that are covered, from the output file. But, if you 'might' move to a different machine, why not just write multiple scan range commands and run them with a script? that way you can continue from the last-and-incomplete scan command. – nik Jun 9 '10 at 11:37

If you don't care about the XML output (or are willing to do some manual combining of files), Nmap supports resuming a scan with the --resume option. As long as Normal (-oN filename.nmap) or Grepable (-oG filename.gnmap) output files were specified in the original scan, running nmap --resume filename.nmap will pick up where the previous scan left off.

One caveat is that this resuming is only granular down to the hostgroup level. Nmap chooses some number of hosts to scan at a time. If interrupted in the middle of a hostgroup, it will pick up at the beginning of that hostgroup, possibly re-scanning some machines. There will not be any duplication in the output files, however. You can control the size of the hostgroups with the --min-hostgroup and --max-hostgroup options. For instance, set a low --max-hostgroup to ensure you don't lose as much time if you need to stop and restart a scan. This can slow down your overall scan time, though, especially for UDP port scans.

share|improve this answer

Without some serious hackery, I can't think of any way this could be done. It's not supported by nmap, so short of dumping the memory it's using, and restoring this elsewhere, I doubt it can be done. Cheat Engine supports saving and loading memory states, but I've no idea if this would work across different machines..

The best you can probably do is to look at the output file you've got so far, and then try to scan blocks that haven't been included in it yet.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .