Performance Characteristics

ProRT-IP's performance characteristics across all scan types, features, and deployment scenarios.

Overview

Key Performance Indicators (v0.5.0):

Performance Philosophy:

ProRT-IP balances three competing goals:

1. Speed: Masscan-inspired stateless architecture (10M+ pps capable)
2. Depth: Nmap-compatible service/OS detection
3. Safety: Built-in rate limiting, minimal system impact

Throughput Metrics

Stateless Scans (SYN/FIN/NULL/Xmas/ACK)

Localhost Performance (v0.5.0):

Network Performance Factors:

Timing Template Impact:

Stateful Scans (Connect, Idle)

Connect Scan Performance:

Idle Scan Performance:

Why Connect is Slower:

• Full TCP 3-way handshake (SYN → SYN-ACK → ACK)
• Application-layer interaction (banner grab, service probe)
• Connection tracking overhead (kernel state)

UDP Scans

UDP Performance (ICMP-limited):

UDP Challenges:

1. ICMP Rate Limiting: Linux kernel limits ICMP unreachable to ~200/s
2. No Response = Open or Filtered: Ambiguity requires retries
3. 10-100x Slower: Compared to TCP SYN scans

Mitigation Strategies:

• Focus on known UDP services (DNS:53, SNMP:161, NTP:123)
• Use protocol-specific probes (DNS query, SNMP GET)
• Accept longer scan times (UDP is inherently slow)

Latency Metrics

End-to-End Scan Latency

Single Port Scan (p50/p95/p99 percentiles):

Component-Level Latency

Packet Operations:

Detection Operations:

I/O Operations:

Memory Usage

Baseline Memory (No Scan)

Scan Memory Footprint

Stateless Scans (SYN/FIN/NULL/Xmas/ACK):

Stateful Scans (Connect):

Service Detection Overhead:

Plugin System Overhead:

Event System Overhead:

Memory Optimization

Buffer Pooling:

• Packet buffers: Pre-allocated pool of 1,500-byte buffers
• Connection buffers: Reused across connections
• Reduces allocation overhead: 30-40% faster

Streaming Results:

• Write results to disk incrementally
• Don't hold all results in memory
• Enables internet-scale scans (1M+ targets)

Batch Processing:

• Process targets in batches (default: 64 hosts)
• Release memory after batch completion
• Trade-off: Slight slowdown for memory efficiency

Scaling Characteristics

Small-Scale (1-100 hosts)

Characteristics:

• Scaling: Linear (O(n × p), n=hosts, p=ports)
• Bottleneck: Network latency (RTT dominates)
• Memory: <10 MB (negligible)
• CPU: 10-20% single core (packet I/O bound)

Optimization Tips:

• Use timing template T4 or T5
• Disable rate limiting for local scans
• Enable parallel host scanning (--max-hostgroup 64)

Medium-Scale (100-10K hosts)

Characteristics:

• Scaling: Sub-linear (O(n × p / batch_size))
• Bottleneck: File descriptors (ulimit), memory
• Memory: 10-100 MB (target state)
• CPU: 40-60% multi-core (async I/O overhead)

Optimization Tips:

• Increase ulimit: ulimit -n 65535
• Enable batch processing: --max-hostgroup 128
• Use rate limiting: --max-rate 10000
• Stream to database or file

Large-Scale (10K-1M hosts)

Characteristics:

• Scaling: Batch-linear (O(n × p / batch_size + batch_overhead))
• Bottleneck: Bandwidth, rate limiting, disk I/O
• Memory: 100-500 MB (batch state, result buffering)
• CPU: 80-100% multi-core (packet crafting, async workers)

Optimization Tips:

• Mandatory rate limiting: --max-rate 50000 (internet)
• Large host groups: --max-hostgroup 256
• Streaming output: --output-file scan.json
• NUMA optimization: --numa (multi-socket systems)
• Reduce port count: Focus on critical ports

Internet-Scale Considerations:

Feature Overhead Analysis

Service Detection (-sV)

Overhead Breakdown:

Per-Service Cost:

• HTTP: ~15ms (single probe)
• SSH: ~18ms (banner + version probe)
• MySQL: ~35ms (multi-probe sequence)
• Unknown: ~50ms (all 187 probes tested)

Optimization:

• Use --version-intensity 5 (default: 7) for faster scans
• Focus on known ports (80, 443, 22, 3306, 5432)
• Enable regex caching (done automatically)

OS Fingerprinting (-O)

Overhead Breakdown:

Accuracy vs Speed:

• Requires both open and closed ports (ideal: 1 open, 1 closed)
• Accuracy: 75-85% (Nmap-compatible)
• Use --osscan-limit to skip hosts without detectable OS

IPv6 Overhead (--ipv6 or :: notation)

Overhead Breakdown:

ICMPv6 vs ICMP:

• ICMPv6 more complex (NDP, router advertisements)
• Overhead: +20-30% for UDP scans
• Feature parity: 100% (Sprint 5.1 completion)

TLS Certificate Analysis (--tls-cert-analysis)

Overhead Breakdown:

Parsing Performance:

• 1.33μs per certificate (mean)
• Handles chains up to 10 certificates
• SNI support (virtual hosts)

Evasion Techniques

Packet Fragmentation (-f):

Decoy Scanning (-D):

Source Port Evasion (-g):

Event System (Sprint 5.5.3)

Overhead Breakdown:

Event Types:

• Scan start/stop
• Host discovery
• Port state change
• Service detected
• Error events

Performance Impact:

• Lock-free event bus: Minimal contention
• Async event dispatch: Non-blocking
• Event logging: Buffered I/O (10-20ms flush interval)

Rate Limiting (V3 Adaptive)

Overhead Breakdown (Sprint 5.X optimization):

Why Faster:

• Convergence algorithm optimizes system-wide flow
• Reduces kernel queue overflow
• Better CPU cache utilization
• Industry-leading result (Nmap: +5-10%, Masscan: N/A)

Burst Behavior:

• Burst size: 100 packets (optimal)
• Convergence: 95% in <500ms
• Adaptive: ICMP error monitoring

Optimization Guide

System Tuning

File Descriptor Limits:

# Check current limit
ulimit -n

# Increase to 65535 (temporary)
ulimit -n 65535

# Permanent (add to /etc/security/limits.conf)
* soft nofile 65535
* hard nofile 65535

Why: Each connection requires 1 file descriptor. Default limit (1024) insufficient for large scans.

Network Tuning (Linux):

# Increase socket buffer sizes
sysctl -w net.core.rmem_max=26214400
sysctl -w net.core.wmem_max=26214400

# Increase connection backlog
sysctl -w net.core.netdev_max_backlog=5000

# Reduce TIME_WAIT duration (careful!)
sysctl -w net.ipv4.tcp_fin_timeout=15

Why: Larger buffers accommodate high packet rates, reduced TIME_WAIT prevents port exhaustion.

NUMA Optimization (Multi-Socket Systems):

# Check NUMA topology
numactl --hardware

# Run with NUMA optimization
prtip --numa -sS -p 1-65535 192.168.1.0/24

# Or manual binding (advanced)
numactl --cpunodebind=0 --membind=0 prtip -sS ...

Why: Avoids cross-NUMA memory access penalties (30-50% latency penalty).

ProRT-IP Tuning

Timing Templates:

Host Group Sizing:

# Default (64 concurrent hosts)
prtip -sS -p 1-1000 192.168.0.0/16

# Increase for speed (256 concurrent)
prtip --max-hostgroup 256 -sS -p 1-1000 192.168.0.0/16

# Decrease for memory (16 concurrent)
prtip --max-hostgroup 16 -sS -p 1-65535 192.168.0.0/16

Rate Limiting:

# Localhost: Disable (safe)
prtip -sS -p 1-1000 127.0.0.1

# LAN: 50K pps
prtip --max-rate 50000 -sS -p 1-1000 192.168.1.0/24

# Internet: 10K pps (safe)
prtip --max-rate 10000 -sS -p 80,443 target.com/24

# Stealth: 1K pps
prtip --max-rate 1000 -T2 -p 80,443 target.com/24

Performance Checklist

Before Large Scans:

• Increase ulimit: ulimit -n 65535
• Set appropriate timing template (T3 for internet, T4 for LAN)
• Enable rate limiting: --max-rate 10000 (internet)
• Stream results: --output-file scan.json
• Test small subset first: -p 80,443 target.com (verify connectivity)
• Monitor system resources: htop, iotop, iftop

During Scans:

• Watch for ICMP errors (rate limiting)
• Monitor packet loss: ifconfig (check RX/TX errors)
• Check event log for errors: --event-log events.jsonl
• Verify results incrementally (spot-check)

After Scans:

• Analyze results for anomalies
• Check scan duration vs estimate
• Review error log for issues
• Archive results: benchmarks/history/

Capacity Planning

How Many Hosts Can I Scan?

Memory-Based Capacity:

Network-Based Capacity:

Formula:

Hosts/Min = (Bandwidth_bps / (Packet_Size_bytes × 8)) / Ports_per_host

How Long Will My Scan Take?

Estimation Formula:

Duration (sec) = (Hosts × Ports) / Throughput_pps

Example Calculations:

Adjust for Features:

What Hardware Do I Need?

CPU Requirements:

RAM Requirements:

Network Requirements:

Storage Requirements:

Platform Differences

Linux (Primary Platform)

Advantages:

• Native sendmmsg/recvmmsg support (fast batching)
• AF_PACKET sockets (raw packet access)
• NUMA support (numactl)
• Best performance: 10-15K pps localhost

Limitations:

• Requires root/CAP_NET_RAW for raw sockets
• ICMP rate limiting (200 unreachable/s)

macOS

Advantages:

• BPF (Berkeley Packet Filter) support
• Good Nmap compatibility

Limitations:

• No sendmmsg/recvmmsg (fallback to send/recv loops)
• Slower: 6-8K pps localhost
• ChmodBPF required for raw socket access

Windows

Advantages:

• Npcap library support (WinPcap successor)

Limitations:

• Slower raw socket access: 4-6K pps
• FIN/NULL/Xmas scans unsupported (Windows TCP stack limitation)
• Npcap installation required
• UAC elevation for raw sockets

Platform Performance Comparison:

See Also

• Performance Tuning - Detailed optimization techniques
• Benchmarking - Benchmark framework and methodology
• Rate Limiting - V3 algorithm details
• Service Detection - Detection overhead analysis
• Platform Support - Platform-specific characteristics