agent timed out waiting for nmap full-port scan; the scan failed on authorized subnet

TL;DR

Never run a full-port scan as one uninterruptible job. Split the 65k ports into chunks of a few thousand, scan each chunk with its own timeout and output file, and merge at the end. If one chunk dies, only that chunk re-runs. The agent stops losing whole scans to a single timeout.

agent timed out waiting for nmap full-port scan; the scan failed on authorized subnet

Use this when

• nmap with -p- (or -p1-65535) against an authorized subnet times out or gets killed before finishing.
• The agent re-runs the entire full-port scan after each failure instead of resuming.
• Slow or filtered hosts make one monolithic scan take hours.

Not for this skill when

• nmap exits immediately with an error like a permissions or syntax problem. That is a different fix.
• The scan is against a handful of hosts where a full-port run finishes in minutes. Chunking adds nothing.
• The engagement scope forbids full-port scans. Respect the scope; do not work around it.

Steps

1. Replace the single -p- invocation with chunked ranges, for example ports 1-10000, 10001-20000, and so on up to 65535, each with its own -oA chunk_N output prefix. Verify: each chunk command is independently runnable.
2. Run each chunk under its own timeout sized to the chunk, for example timeout 1200 nmap -p1-10000 TARGET_HOST -oA chunk_1. Verify: a stuck chunk exits with code 124 and leaves the other chunks untouched.
3. After all chunks finish, merge the results by concatenating the .gnmap files or re-parsing each .xml file into one findings list. Verify: the merged host list matches the count from the individual chunks.
4. Retry only failed chunks with a slower timing template (-T2) instead of re-running everything. Verify: the retry command targets only the missing chunk range.
5. Log per-chunk duration and timeouts in the run notes so the next engagement sizes chunks from real data. Verify: the notes show which chunks needed retries.

Variant phrasings

nmap full port scan keeps timing out on agent run

Same chunking fix.

agent loses whole nmap scan on timeout

Resume-oriented phrasing.

full-port scan too slow for agent workflow

Pacing variant.

Compatibility: nmap 7.x. Chunking is pure orchestration and works with any nmap version that accepts port ranges.

Why it happens

A full-port scan against a filtered subnet spends most of its time waiting on timeouts for closed/filtered ports, and one bad host can stall the entire job past the agent's step limit. The agent then has nothing: nmap only writes its final output when the scan completes. Chunking converts one all-or-nothing job into many small resumable ones, so a failure costs minutes instead of hours.

Edge cases / pitfalls

• Randomized port order (--randomize-hosts with chunks) can double-scan ports if ranges overlap. Keep chunk boundaries exact and non-overlapping.
• Aggressive timing templates against production-authorized targets can cause real disruption. Stay within the engagement's agreed scan intensity.
• Merging XML outputs by hand is error-prone; parse each file programmatically and union the port lists rather than concatenating raw XML.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstCLgq7d8qGlPQeA14MtgJg