The most stable version until now, but with some drawbacks and improvements needed

[ehsandeep]

Discussed in https://github.com/projectdiscovery/naabu/discussions/1365

^{Originally posted by BulzN February 3, 2025}

Naabu Stability and Performance Analysis

During my investigation of Naabu in a production environment analyzing over 300 hosts, I found that the most stable version so far is 2.3.3. While the tool is excellent, I have identified a few drawbacks:

1. Issues with Nmap CLI Parsing – When scanning a large number of hosts and ports, integrating Naabu with Nmap CLI sometimes causes the scanning process to break unexpectedly. Despite my efforts, I couldn't find a clear explanation for this behavior. To ensure a complete and accurate analysis of all hosts, I had to run Nmap separately after Naabu completed its scanning.

2. Performance Regression in Version 2.3.4 – The latest version, 2.3.4, appears to have a significantly slower analysis rate compared to 2.3.3. While the older version utilized more CPU resources (50–70% usage) and completed scans faster, 2.3.4 shows a drastic drop in CPU utilization—falling below 1%—while memory usage remains unchanged. This issue was observed in a Docker environment with 4 allocated CPUs, where the newer version fails to utilize them efficiently, resulting in significantly longer scan times.

3. Metrics Endpoint Format Improvements – Enhancing the metrics endpoint to support structured formats compatible with observability tools, such as Prometheus, would be a valuable addition. This would allow users to easily feed scan results—including IPs, ports, hosts, and Nmap findings—into monitoring and alerting systems.

These are just my findings, and I could be mistaken regarding the first two points, but this is my analysis based on usage from December 2024 until now. I hope this serves as constructive feedback and a simple heads-up. Keep up the great work—Naabu is one of the best open-source tools for this purpose, and the entire ProjectDiscovery.io suite is outstanding. Looking ahead, it would be fantastic to see a self-hosted environment integrating all these tools, even if access to a self-hosted repository were available through a donation model.

[waydmy]

The scanning speed of naabu 2.3.4 is much slower than that of 2.3.3

[BulzN]

The scanning speed of naabu 2.3.4 is much slower than that of 2.3.3

Follow-Up Comment:

You can check my detailed assessment from the discussion here: https://github.com/projectdiscovery/naabu/discussions/1365. I'd really appreciate if anyone could also run a test on their side to help validate this issue thoroughly. While my tests were conducted in my environment (macOS on my MacBook Pro), the same principles should apply in VMs or other Linux hosts.

[ocervell]

I confirm this issue on a 10-nodes Kubernetes clusters with autoscaled workers, so it is not your environment. Especially the end of the run takes time to complete for some reason (after all open ports have been found).

You can check that by running with just one port (443 for https service): naabu -Pn -host <HOST> -json -port 443

[a2dom]

I do confirm the same behaviour in 2.3.4 vs 2.3.3 as the one described by @ocervell

[tavgar]

I confirm that the script is way slower in 2.3.4 for me it was significantly noticeably. barely uses CPU.

[ehsandeep]

Hey Guys!

The issue related to slowness should be fixed in latest release - https://github.com/projectdiscovery/naabu/releases/tag/v2.3.5

Feel free to try upgrading and let us know if you notice otherwise.

cc @BulzN

[BulzN]

I confirm that the performance issue has been fixed in the new version of Naabu. Everyone should upgrade to the latest version: v2.3.5.

Test Results

Using Docker:

time docker run -it --rm \
  --ulimit nofile=65535:65535 \
  -v "${PWD}:/tmp" \
  projectdiscovery/naabu:v2.3.5 -host 1.1.1.1

Output:

                  __
  ___  ___  ___ _/ /  __ __
 / _ \/ _ \/ _ \/ _ \/ // /
/_//_/\_,_/\_,_/_.__/\_,_/

        projectdiscovery.io

[INF] Current naabu version 2.3.5 (latest)
[WRN] UI Dashboard is disabled, Use -dashboard option to enable
[INF] Running CONNECT scan with non root privileges
1.1.1.1:443
1.1.1.1:53
1.1.1.1:80
1.1.1.1:8080
1.1.1.1:8443
[INF] Found 5 ports on host 1.1.1.1 (1.1.1.1)

Timing:

docker run ...   0.01s user 0.01s system 0% cpu 5.891 total

---

Using Locally Installed Naabu:

time echo 1.1.1.1 | naabu

Output:

                  __
  ___  ___  ___ _/ /  __ __
 / _ \/ _ \/ _ \/ _ \/ // /
/_//_/\_,_/\_,_/_.__/\_,_/

        projectdiscovery.io

[INF] Current naabu version 2.3.5 (latest)
[WRN] UI Dashboard is disabled, Use -dashboard option to enable
[INF] Running CONNECT scan with non root privileges
1.1.1.1:8080
1.1.1.1:8443
1.1.1.1:53
1.1.1.1:80
1.1.1.1:443
[INF] Found 5 ports on host 1.1.1.1 (1.1.1.1)

Timing:

echo 1.1.1.1   0.00s user 0.00s system 24% cpu 0.003 total
naabu         0.06s user 0.12s system 2% cpu 5.841 total

---

Thanks for addressing it. The performance issue seems fully resolved in v2.3.5, and I believe the issue can be safely closed.

For future improvements, the third point on structured metrics output might be worth revisiting, especially for Prometheus integration. Also, a self-hosted "all-in-one" ProjectDiscovery suite would be an exciting direction, even behind a donation model.

Really appreciate the work you’re doing. Naabu and the entire ProjectDiscovery toolkit are top-tier

[ehsandeep]

@BulzN thanks for confirming, and appreciate your patience while we investigated and fixed the issue. Thanks again for reporting.