How to retrieve both TCP and UDP ports with Nmap?

Question

I need to retrieve both TCP and UDP ports in the same scan with Nmap in the fastest way possible. I'll try to explain it better. If I use the most common command:

nmap 192.168.1.1

It retrieves ONLY TCP ports and it is really fast.

If I use the following command:

nmap -sU 192.168.1.1

It retrieves ONLY UDP ports and it is quite fast (well not so fast but still).

My question: is there a combination of the two commands? I tryed:

nmap -sU -sS 192.168.1.1
nmap -sU -sT 192.168.1.1

But they are TERRIBLY slow.

I am using Nmap 5.51, any suggestion?

Answer 1

As you've seen, UDP scanning is slow as open/filtered ports typically don't respond so nmap has to time out and then retransmit whilst closed ports will send a ICMP port unreachable error, which systems typically rate limit.

You can add the -T switch to increase the speed of the scan, though this may reduce accuracy and make it easier to detect.

-T<0-5>: Set timing template (higher is faster)

-PN will turn off the ping scan element

You could also scan more hosts in parallel,

or reduce the number of ports you're scanning with the -p switch or --top-ports , which will scan the highest-ratio ports found in the nmap-services file.

If you were scanning multiple hosts, you could use --host-timeout to skip slow hosts.

Regarding TCP, -sS should be quicker than -sT.

HTH!