If I set a rate limit (e.g. -T1) on an nmap scan that uses decoys, does the rate limit apply to all probes, or just each individual source? I checked the documentation, but can't see anything specific. I'm primarily concerned about this from a stealth scanning perspective.

1 Answer 1


From the source:

    This function also handles the sending of decoys. There is no fine-grained
    control of this; all decoys are sent at once on one call of this function.
    This means that decoys do not honor any scan delay and may violate congestion
    control limits. */
static UltraProbe *sendIPScanProbe(UltraScanInfo *USI, HostScanStats *hss,
                               const probespec *pspec, u8 tryno, u8 pingseq) {

It appears that each probe will be sent from your real source address according to your timing options, but at the same time it will be sent from all your decoys. So your target should see synchronized -T1 scans from number_of_decoys + 1 different sources, which will be number_of_decoys + 1 times more packets than a non-decoy scan.

  • Are you sure this is correct? Seems this may only apply to IP protocol scans, rather than TCP connect or SYN scans.
    – Polynomial
    Nov 27, 2013 at 16:22
  • 1
    @Polynomial Yes, it is correct. This function is used for sending all probes other than TCP Connect (-sT) Nov 28, 2013 at 2:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .