Port Scan Coverage Calculator
Work out how long a port scan takes at a given probe rate, and how much of the target range a scan window actually covers.
About Port Scan Coverage Calculator
Scan time is purely arithmetic: the probe count is the product of hosts, ports and retries, and the duration is that divided by the rate you can sustain. Because a full 65535-port TCP scan of even a /22 is over 134 million probes, a rate that is safe for production hardware turns an overnight window into a multi-day job. Vulnerability programmes that quietly scan only the top 1000 ports because of time pressure miss the high-numbered management and database ports where the real exposures live.
Formula
Port Scan Coverage
probes = hosts × ports per host × retries; duration = probes ÷ probe rate; coverage = (window seconds × probe rate) ÷ probes.
- probes
- Total packets the scan must send
- probe rate
- Sustained packets per second the scanner is allowed to send
Worked example
With the default values below, Port Scan Coverage Calculator returns Time for a Full Scan of 124.27. Change any input above and every figure here is recalculated in your browser.
Inputs used
- Hosts in scopeaccepts 1–16,777,216 hosts
- 1,024 hosts
- Ports probed per hostaccepts 1–65,535 ports
- 65,535 ports
- Probes per port (including retries)accepts 1–10 probes
- 2 probes
- Sustained probe rateaccepts 1–10,000,000 packets/s
- 300 packets/s
- Available scan windowaccepts 0.1–720 hours
- 8 hours
Results
- Time for a Full Scan
- 124.27 hours
- Total Probes Required
- 134,215,680
- Range Covered in the Window
- 6.44%
- Hosts Fully Scanned in the Window
- 65
- Probe Rate Needed to Finish in the Window
- 4,660.3 packets/s
- Full Scan Duration
- 447,386 seconds
Step by step
- 1Values used
- 2Port Scan Coverage
- 3Time for a Full Scan= 124.27 hours
- 4Total Probes Required= 134,215,680
- 5Range Covered in the Window= 6.44
- 6Hosts Fully Scanned in the Window= 65
- 7Probe Rate Needed to Finish in the Window= 4,660.3 packets/s
- 8Full Scan Duration= 447,386 seconds
Assumptions and limits
- The result is derived only from the 5 inputs listed above. Anything not among them is not part of the calculation.
- In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
- Figures are rounded for display to 2 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.
How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.
Frequently Asked Questions
How is Port Scan Coverage calculated?
probes = hosts × ports per host × retries; duration = probes ÷ probe rate; coverage = (window seconds × probe rate) ÷ probes. Scan time is purely arithmetic: the probe count is the product of hosts, ports and retries, and the duration is that divided by the rate you can sustain. Because a full 65535-port TCP scan of even a /22 is over 134 million probes, a rate that is safe for production hardware turns an overnight window into a multi-day job.
Why does Port Scan Coverage matter?
Vulnerability programmes that quietly scan only the top 1000 ports because of time pressure miss the high-numbered management and database ports where the real exposures live.
What values do I need to enter?
This calculator takes 5 inputs: Hosts in scope, Ports probed per host, Probes per port (including retries), Sustained probe rate, Available scan window. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
How do I make a full-range scan fit an overnight window?
Three levers: raise the probe rate where the path can take it, split the range across parallel scanners in different segments, or stage it — a fast top-1000 sweep nightly plus a full 65535-port sweep on a monthly rotation. Raising the rate blindly triggers IPS thresholds and can exhaust stateful firewall session tables, so validate it on a small block first.