Comparison of speeds between nmap and naabu: Why is nmap faster?

[mythldy]

Why is it that a simple full-port SYN half-connection scan on the client side is twice as fast as Naabu in nmap? Is it because my parameter settings are incorrect, or is it simply that nmap cannot match its speed?
The configuration parameters when using nmap are as follows
-sS -Pn -p T:0-65535 --source-port 58915 --max-retries 0 --min-rate 20000 --max-rate 20000 -n -v -T3 --open --stats-every 5s --min-hostgroup 100 --max-hostgroup 100
When using Naabu, the configuration parameters are as follows. The version of Naabu is 2.3.3.
ScanType: "s",
//OnResult: func(hr *result.HostResult) {
// log.Printf("host:%s:%s", hr.Host, hr.Ports)
//},
//Debug: false,
//Verbose: false,
//StatsInterval: 0,
Threads: 1000,
ExcludeIps: excludeip,
Rate: 20000,
DisableUpdateCheck: true,
JSON: true,
Retries: 1,
Silent: true,
Ports: ports,
Timeout: 200,

[joshfinley]

You might try benchmarking Naabu SYN scans against regular Naabu CONNECT scans. Inefficiency could be coming from the tear down on the sockets.

[joshfinley]

I went ahead and tested this myself:

• SYN scan: 78.8% more cycles
• CONNECT scan: 27.2% faster runtime

Result: Clear increase in overhead on SYN scans.

user@user:~ $ perf stat naabu -host 192.168.1.1 --top-ports 100 -retries 1 -timeout 500 -warm-up-time 1

                  __
  ___  ___  ___ _/ /  __ __
 / _ \/ _ \/ _ \/ _ \/ // /
/_//_/\_,_/\_,_/_.__/\_,_/

                projectdiscovery.io

[INF] Current naabu version 2.3.4 (latest)
[INF] Running CONNECT scan with non root privileges
192.168.1.1:22
[INF] Found 1 ports on host 192.168.1.1 (192.168.1.1)

 Performance counter stats for 'naabu -host 192.168.1.1 --top-ports 100 -retries 1 -timeout 500 -warm-up-time 1':

            179.98 msec task-clock:u                     #    0.129 CPUs utilized
                 0      context-switches:u               #    0.000 /sec
                 0      cpu-migrations:u                 #    0.000 /sec
             5,248      page-faults:u                    #   29.158 K/sec
       196,751,090      cycles:u                         #    1.093 GHz
       214,858,287      instructions:u                   #    1.09  insn per cycle
   <not supported>      branches:u
           905,582      branch-misses:u

       1.395903274 seconds time elapsed

       0.109030000 seconds user
       0.073984000 seconds sys

...
root@user:/home/user # perf stat naabu -host 192.168.1.1 --top-ports 100 -retries 1 -timeout 500 -warm-up-time 1 -scan-type s

                  __
  ___  ___  ___ _/ /  __ __
 / _ \/ _ \/ _ \/ _ \/ // /
/_//_/\_,_/\_,_/_.__/\_,_/

                projectdiscovery.io

[INF] Current naabu version 2.3.4 (latest)
[INF] Running SYN scan with CAP_NET_RAW privileges

 Performance counter stats for 'naabu -host 192.168.1.1 --top-ports 100 -retries 1 -timeout 500 -warm-up-time 1 -scan-type s':

            201.13 msec task-clock                       #    0.105 CPUs utilized
             1,343      context-switches                 #    6.677 K/sec
                18      cpu-migrations                   #   89.493 /sec
             5,447      page-faults                      #   27.082 K/sec
       351,873,767      cycles                           #    1.749 GHz
       289,141,074      instructions                     #    0.82  insn per cycle
   <not supported>      branches
         1,317,729      branch-misses

       1.916181423 seconds time elapsed

       0.136933000 seconds user
       0.068466000 seconds sys