How does NMap decide to print a progress line?

Question

Checking a larger subnet than I normally do; mapping out a cluster suite in a university for a traffic mapping project (permission attained), and I was wondering something.

NMap usually prints its progress periodically, but I'm unclear to what that 'periodically' is, because the cirrent scan printed a line for basically every 100th of a percent up to 1% done, then one at 1.5%, and has said nothing since.

I suspect that it changes at different 'levels' but does anyone have an actual answer?

Answer 1

You can get a status line during a running scan by pressing any key that is not bound to a function (press ? for a list of bindings).

Alternatively, you can pass the --stats-every option with a time value. So this: nmap --stats-every 1m would print a detailed (2-line) status every minute. This status line also shows in the XML output file.

Answer 2

After diving through the NMap source (particularly timing.cc) this is what I have for default verbosity and debugging values.

• If the scan is < 0.003% done, don't print
• If there is < 1% done, use the following rules, but don't print ETA's
• If there's < 30 seconds estimated time remaining in the scan, don't print
• If there's no estimated time, don't print
• Otherwise, if a previous estimate has been passed (ETA in the past) print a new one
• Finally, if there's been a change in the ETA of more than 3 minutes, or 5% change in progress, print a new ETA

I think that's basically it but if anyone finds any more rules, feel free to add them in comments and I'll edit them in.