19.8 Timing, Output Formats and Scan Hygiene

By Ravindra Bagale Last updated: 27 September 2026

Timing templates control speed and stealth:

Template	Name	Use
`-T0` / `-T1`	paranoid / sneaky	Very slow, for IDS evasion studies
`-T2`	polite	Uses less bandwidth
`-T3`	normal	Default
`-T4`	aggressive	Fast, good for your lab and reliable networks
`-T5`	insane	May miss ports; avoid

Always save output – a scan you did not save is a scan you will have to repeat:

sudo nmap -sC -sV -oN scan.txt 192.168.56.20      # normal text, easy to read
sudo nmap -sC -sV -oX scan.xml 192.168.56.20      # XML, for tools and reports
sudo nmap -sC -sV -oG scan.gnmap 192.168.56.20    # grepable
sudo nmap -sC -sV -oA msf2_full 192.168.56.20     # all three at once (best habit)
grep "open" msf2_full.gnmap                        # quick filter
xsltproc msf2_full.xml -o msf2_full.html           # turn XML into an HTML report

A professional workflow on one target looks like this:

mkdir -p ~/lab/msf2/nmap && cd ~/lab/msf2/nmap
sudo nmap -sn 192.168.56.0/24 -oA 01_hosts          # 1. who is alive
sudo nmap -p- -T4 192.168.56.20 -oA 02_allports     # 2. every open TCP port
sudo nmap -sC -sV -p 21,22,80 192.168.56.20 -oA 03_services   # 3. details only on open ports
sudo nmap -sU --top-ports 50 192.168.56.20 -oA 04_udp          # 4. top UDP ports

Ravindra Bagale's Tip

Students scan kartat, screen var output baghtat, aani terminal band kartat. Don divsanni report lihitana kahich nahi! Nehmi -oA vapra aani har target sathi vegla folder theva. Report ha ethical hacker cha khara product aahe – scan nahi.

Lab

Follow the four-step workflow above against Metasploitable 2 and keep all output files. Convert 03_services.xml to HTML with xsltproc and open it in Firefox inside Kali.