Choose a scan type on purpose and measure what timing costs

short · 50 min · Objective 2.3

Task

Run several Nmap scan types against a lab host you built and see, against ground truth, what each one answers and what faster timing costs you in accuracy. Nmap is named in CompTIA's own scope, so this is about using it deliberately rather than by default.

Steps

  1. On the lab network you own, build a target with a few known-open ports and a host firewall filtering others.
  2. Run a SYN scan and a connect scan against it, saving to /tmp/syn.txt and /tmp/connect.txt. Note they agree on what is listening.
  3. Run an ACK scan and read it for what it actually tells you — firewall filtering, not open services.
  4. Run the same scan at a fast timing template and again at a slow one, saving both, and diff them: a shortened timeout can record a slow-but-open port as filtered, so the scan got faster by being wrong.
  5. Save output in a structured format (XML) alongside the human-readable one, and keep the exact command line with each.

Verify

grep -cE "^[0-9]+/tcp\s+open" /tmp/syn.txt
diff <(grep -oE "^[0-9]+/tcp\s+\w+" /tmp/fast.txt | sort) <(grep -oE "^[0-9]+/tcp\s+\w+" /tmp/slow.txt | sort) | grep -c "^[<>]"
test -s /tmp/scan.xml && echo "structured output saved" || echo "no XML output"

The first count must be non-zero — the SYN scan found the open ports. The second counts the differences between fast and slow timing: if it is non-zero, you have measured the accuracy cost of speed directly, which is the point; if zero, run the fast scan against more ports or a busier host until you see it. The third confirms you saved structured output, which is what feeds the next tool and makes the finding reproducible.

Notes

Match the scan type to the question: ACK for what the firewall filters, SYN or connect for what is listening. "Stealth" is largely obsolete — modern monitoring sees a SYN scan plainly — so prefer it for speed and courtesy to the application, not for hiding. Script categories can be intrusive, so name scripts explicitly rather than invoking whole categories on a network you do not own. Here, that network is your lab.

This is an independent study companion for CompTIA PenTest+ PT0-003 and is not produced by or endorsed by CompTIA.