Work out how long a port scan takes at a given probe rate, and how much of the target range a scan window actually covers.
Scan time is purely arithmetic: the probe count is the product of hosts, ports and retries, and the duration is that divided by the rate you can sustain. Because a full 65535-port TCP scan of even a /22 is over 134 million probes, a rate that is safe for production hardware turns an overnight window into a multi-day job. Vulnerability programmes that quietly scan only the top 1000 ports because of time pressure miss the high-numbered management and database ports where the real exposures live.
Port Scan Coverage
probes = hosts × ports per host × retries; duration = probes ÷ probe rate; coverage = (window seconds × probe rate) ÷ probes.
probes = hosts × ports per host × retries; duration = probes ÷ probe rate; coverage = (window seconds × probe rate) ÷ probes. Scan time is purely arithmetic: the probe count is the product of hosts, ports and retries, and the duration is that divided by the rate you can sustain. Because a full 65535-port TCP scan of even a /22 is over 134 million probes, a rate that is safe for production hardware turns an overnight window into a multi-day job.
Vulnerability programmes that quietly scan only the top 1000 ports because of time pressure miss the high-numbered management and database ports where the real exposures live.
This calculator takes 5 inputs: Hosts in scope, Ports probed per host, Probes per port (including retries), Sustained probe rate, Available scan window. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Three levers: raise the probe rate where the path can take it, split the range across parallel scanners in different segments, or stage it — a fast top-1000 sweep nightly plus a full 65535-port sweep on a monthly rotation. Raising the rate blindly triggers IPS thresholds and can exhaust stateful firewall session tables, so validate it on a small block first.