Nmap's timing templates (0-5) provide a simple way to control scan aggressiveness without manually configuring dozens of parameters. Each template sets multiple timing values simultaneously: Paranoid (T0) and Sneaky (T1) serialize scans and add long delays (5 minutes to 15 seconds between probes) to evade IDS detection—ideal for stealth but extremely slow. Polite (T2) adds 400ms delays to reduce bandwidth and target load, but scans can take 10x longer than default. Normal (T3) is the balanced default with adaptive timing. Aggressive (T4) caps TCP scan delays at 10ms and reduces retries to 6, assuming fast reliable networks—recommended for modern infrastructure. Insane (T5) minimizes all timeouts (300ms max RTT, 5ms TCP delay, only 2 retries) for maximum speed, sacrificing some accuracy. Templates can be combined with fine-grained controls; granular options override template defaults for specific parameters.
Fine-Grained Timing Controls: Beyond templates, Nmap offers precise control over scan behavior. Hostgroup size (--min-hostgroup, --max-hostgroup) determines how many hosts are scanned concurrently—larger groups are faster but delay results. Parallelism (--min-parallelism, --max-parallelism) controls concurrent probes per host—higher values speed scans but may overwhelm targets or trigger rate limiting. Probe timeouts (--min-rtt-timeout, --max-rtt-timeout, --initial-rtt-timeout) define how long Nmap waits for responses—lower values speed up scans on fast networks but cause false negatives on slow links. Retransmissions (--max-retries) determine persistence—more retries improve accuracy on unreliable networks but slow scans. Scan delays (--scan-delay, --max-scan-delay) insert pauses between probes to avoid rate limiting—TCP can use very low delays (5ms with T5). Rate limiting (--min-rate, --max-rate) directly controls packets per second. Nmap's adaptive algorithms (congestion control, RTT estimation, exponential backoff) dynamically adjust these parameters based on detected network conditions, packet loss, and latency—ensuring optimal balance between speed and accuracy without manual tuning.
Timing Parameters
--max-rtt-timeout1000ms
50ms5000ms
Maximum time Nmap waits for a probe response. Higher values handle slow networks better but increase scan time. Lower values (300-1250ms) speed up scans on fast networks. T0-T2 use 5min-10s, T3-T4 use 1000-1250ms, T5 uses 300ms.
--min-rtt-timeout100ms
50ms5000ms
Lower bound for round trip timeout calculations. Rarely adjusted manually. T0-T4 use 100ms, T5 uses 50ms. Only useful for extremely unreliable networks.
--initial-rtt-timeout500ms
50ms5000ms
Starting timeout value for first probes before Nmap adapts based on responses. T0 uses 5min, T1 uses 15s, T2-T3 use 1s, T4 uses 500ms, T5 uses 250ms. Lower values speed up initial scans.
--max-retries10
010
Maximum probe retransmissions before giving up. Higher values improve accuracy on unreliable networks but slow scans. T0-T3 use 10 retries, T4 uses 6, T5 uses 2. Set to 0 for fastest scans but lower accuracy.
--max-scan-delayAdaptive
0ms (adaptive)300000ms (5min)
Maximum delay between probes. Set to 0 for adaptive behavior (T3-T5). T0-T2 use delays of 5min-400ms for stealth. T4 caps at 10ms, T5 at 5ms. Higher delays avoid rate limiting and IDS detection but slow scans dramatically.
Parallelism~100
0 (Serial)300+
Number of concurrent probes sent simultaneously. 0 = serial (one at a time, T0-T2 behavior). T3-T5 use dynamic parallelism (typically 100-300+). Higher values speed scans but may overwhelm targets or trigger rate limiting.
Detection Level (Stealth)
Moderate
Measures scan stealthiness. Higher values use longer timeouts and delays to avoid IDS detection. T0-T1 (Paranoid/Sneaky) maximize stealth. Lower values prioritize speed but are more detectable.
Scan Speed
Normal
Relative scanning speed compared across templates. T0 is extremely slow (5min delays), T5 is maximum speed (minimal delays, low retries). Speed increases with lower timeouts, fewer retries, higher parallelism, and minimal delays.
Port Knocks (Probes per Port)
10
Number of probe retransmissions per port. Maps directly to --max-retries. T0-T3 use 10 retries for accuracy, T4 uses 6, T5 uses 2. More retries improve accuracy but increase scan time, especially on filtered or rate-limited ports.
Parallelism (Concurrent Probes)
Dynamic
Number of concurrent probes sent at once. T0-T2 use serial scanning (parallelism = 1) for maximum stealth. T3-T5 use dynamic parallelism (typically 100-300+) for speed. Higher parallelism speeds scans but may overwhelm targets or trigger security controls.