Timing Templates
Timing templates control how fast Nmap scans and how much network load it generates. The right choice depends on your network conditions, target resilience, and whether you need to evade detection. Nmap offers six templates from Paranoid to Insane.
The Six Timing Templates
Click any template to expand and see its full technical behavior, ideal use cases, and tradeoffs.
Speed Comparison
Relative speed of each template when scanning 1000 ports on a local network with a responsive target.
Advanced Timing Controls
For fine-grained control beyond the six templates, Nmap offers individual timing flags that let you precisely tune scan behavior.
--min-parallelism <num>Minimum number of probes sent in parallel. Overrides the dynamic timing system.
--max-parallelism <num>Maximum number of probes sent in parallel. Prevents overwhelming the network.
--min-rtt-timeout <time>Minimum RTT timeout. Nmap will never wait less than this for a response.
--max-rtt-timeout <time>Maximum RTT timeout. Nmap gives up waiting after this duration.
--initial-rtt-timeout <time>Starting RTT timeout before Nmap has gathered enough data to estimate properly.
--max-retries <tries>Maximum number of retransmissions for a probe. Set to 0 to disable retries.
--host-timeout <time>Give up on a target if the total scan time exceeds this limit.
--scan-delay <time>Minimum delay between each probe sent to a single target.
--max-scan-delay <time>Maximum allowed delay between probes. Overrides dynamic delays.
Recommendations
Tip
-T4 on internal networks and -T3 (default) on external/WAN targets. Only use -T0 or -T1 when you have confirmed IDS monitoring and stealth is critical.Warning
-T5 seems tempting but often produces incomplete results. -T4 is almost as fast and significantly more reliable.Info
--max-retries 1 with -T4 for faster scans on reliable networks. This reduces retransmissions without sacrificing much accuracy.