Port Scan Coverage Calculator
Work out how long a port scan takes at a given probe rate, and how much of the target range a scan window actually covers.
Inputs
1024 is a /22; 65536 is a /16.
Keep this low enough that IPS rate thresholds and stateful devices are not overwhelmed.
Time for a Full Scan
124.27hours
Total Probes Required
134,215,680
Range Covered in the Window
6.44%
Hosts Fully Scanned in the Window
65
Probe Rate Needed to Finish in the Window
4,660.3packets/s
Full Scan Duration
447,386seconds
Step by step
Values used
Hosts in scope = 1,024 hosts; Ports probed per host = 65,535 ports; Probes per port (including retries) = 2 probes; Sustained probe rate = 300 packets/s; Available scan window = 8 hours
Port Scan Coverage
probes = hosts × ports per host × retries; duration = probes ÷ probe rate; coverage = (window seconds × probe rate) ÷ probes.
Time for a Full Scan
= 124.27 hours
Total Probes Required
= 134,215,680
Range Covered in the Window
= 6.44
Hosts Fully Scanned in the Window
= 65
Probe Rate Needed to Finish in the Window
= 4,660.3 packets/s
Full Scan Duration
= 447,386 seconds
How it works
Scan time is purely arithmetic: the probe count is the product of hosts, ports and retries, and the duration is that divided by the rate you can sustain. Because a full 65535-port TCP scan of even a /22 is over 134 million probes, a rate that is safe for production hardware turns an overnight window into a multi-day job. Vulnerability programmes that quietly scan only the top 1000 ports because of time pressure miss the high-numbered management and database ports where the real exposures live.
Formula
Port Scan Coverage
probes = hosts × ports per host × retries; duration = probes ÷ probe rate; coverage = (window seconds × probe rate) ÷ probes.
- probes
- Total packets the scan must send
- probe rate
- Sustained packets per second the scanner is allowed to send
Frequently Asked Questions
How is Port Scan Coverage calculated?
probes = hosts × ports per host × retries; duration = probes ÷ probe rate; coverage = (window seconds × probe rate) ÷ probes. Scan time is purely arithmetic: the probe count is the product of hosts, ports and retries, and the duration is that divided by the rate you can sustain. Because a full 65535-port TCP scan of even a /22 is over 134 million probes, a rate that is safe for production hardware turns an overnight window into a multi-day job.
Why does Port Scan Coverage matter?
Vulnerability programmes that quietly scan only the top 1000 ports because of time pressure miss the high-numbered management and database ports where the real exposures live.
What values do I need to enter?
This calculator takes 5 inputs: Hosts in scope, Ports probed per host, Probes per port (including retries), Sustained probe rate, Available scan window. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
How do I make a full-range scan fit an overnight window?
Three levers: raise the probe rate where the path can take it, split the range across parallel scanners in different segments, or stage it — a fast top-1000 sweep nightly plus a full 65535-port sweep on a monthly rotation. Raising the rate blindly triggers IPS thresholds and can exhaust stateful firewall session tables, so validate it on a small block first.