What is the most efficient way to scan thousands of addresses?

Slicing is a valid strategy. It depends a bit on how/whether you want to aggregate the results
into a single report. 100 appears to me like very small slice, I use far bigger slices.

At Greenbone we work with some customers on such large scale scans. My recommendation is that you use the GMP interface and script the scans. Our works for the customers result in some GMP scripts we publish to gvm-tools, see here:

A typical challenge is that your hosts are hidden in a larger address range of which most are “dead” IPs.

For large scale scanning I also recommend to spend some time on tuning the Scan Configuration.
And what also determines the performance is of course the port list. Especially the port list is a trade-off between speed and false-negative-tolerance. Which makes it important to define what you want to achieve with the scans. The actual purpose will drive your technical decisions.

One practical recommendation from my experience for large scale scans: Use the “random” host order for scanning in your task configuration.

2 Likes