## TL;DR
Never run a full-port scan as one uninterruptible job. Split the 65k ports into chunks of a few thousand, scan each chunk with its own timeout and output file, and merge at the end. If one chunk dies, only that chunk re-runs. The agent stops losing whole scans to a single timeout.

```text
agent timed out waiting for nmap full-port scan; the scan failed on authorized subnet
```

## Use this when
- nmap with `-p-` (or `-p1-65535`) against an authorized subnet times out or gets killed before finishing.
- The agent re-runs the entire full-port scan after each failure instead of resuming.
- Slow or filtered hosts make one monolithic scan take hours.

## Not for this skill when
- nmap exits immediately with an error like a permissions or syntax problem. That is a different fix.
- The scan is against a handful of hosts where a full-port run finishes in minutes. Chunking adds nothing.
- The engagement scope forbids full-port scans. Respect the scope; do not work around it.

## Steps
1. Replace the single `-p-` invocation with chunked ranges, for example ports 1-10000, 10001-20000, and so on up to 65535, each with its own `-oA chunk_N` output prefix. Verify: each chunk command is independently runnable.
2. Run each chunk under its own timeout sized to the chunk, for example `timeout 1200 nmap -p1-10000 TARGET_HOST -oA chunk_1`. Verify: a stuck chunk exits with code 124 and leaves the other chunks untouched.
3. After all chunks finish, merge the results by concatenating the `.gnmap` files or re-parsing each `.xml` file into one findings list. Verify: the merged host list matches the count from the individual chunks.
4. Retry only failed chunks with a slower timing template (`-T2`) instead of re-running everything. Verify: the retry command targets only the missing chunk range.
5. Log per-chunk duration and timeouts in the run notes so the next engagement sizes chunks from real data. Verify: the notes show which chunks needed retries.

## Variant phrasings
### nmap full port scan keeps timing out on agent run
Same chunking fix.
### agent loses whole nmap scan on timeout
Resume-oriented phrasing.
### full-port scan too slow for agent workflow
Pacing variant.

Compatibility: nmap 7.x. Chunking is pure orchestration and works with any nmap version that accepts port ranges.

## Why it happens
A full-port scan against a filtered subnet spends most of its time waiting on timeouts for closed/filtered ports, and one bad host can stall the entire job past the agent's step limit. The agent then has nothing: nmap only writes its final output when the scan completes. Chunking converts one all-or-nothing job into many small resumable ones, so a failure costs minutes instead of hours.

## Edge cases / pitfalls
- Randomized port order (`--randomize-hosts` with chunks) can double-scan ports if ranges overlap. Keep chunk boundaries exact and non-overlapping.
- Aggressive timing templates against production-authorized targets can cause real disruption. Stay within the engagement's agreed scan intensity.
- Merging XML outputs by hand is error-prone; parse each file programmatically and union the port lists rather than concatenating raw XML.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_CLgq7d8qGlP_QeA14MtgJg