If I set a rate limit (e.g. -T1) on an nmap scan that uses decoys, does the rate limit apply to all probes, or just each individual source? I checked the documentation, but can't see anything specific. I'm primarily concerned about this from a stealth scanning perspective.


From the source:

    This function also handles the sending of decoys. There is no fine-grained
    control of this; all decoys are sent at once on one call of this function.
    This means that decoys do not honor any scan delay and may violate congestion
    control limits. */
static UltraProbe *sendIPScanProbe(UltraScanInfo *USI, HostScanStats *hss,
                               const probespec *pspec, u8 tryno, u8 pingseq) {

It appears that each probe will be sent from your real source address according to your timing options, but at the same time it will be sent from all your decoys. So your target should see synchronized -T1 scans from number_of_decoys + 1 different sources, which will be number_of_decoys + 1 times more packets than a non-decoy scan.

| improve this answer | |
  • Are you sure this is correct? Seems this may only apply to IP protocol scans, rather than TCP connect or SYN scans. – Polynomial Nov 27 '13 at 16:22
  • 1
    @Polynomial Yes, it is correct. This function is used for sending all probes other than TCP Connect (-sT) – bonsaiviking Nov 28 '13 at 2:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.