Nmap timing templates -T0 to -T5: speed, accuracy, and safety

What a template sets

The -T options are presets for a group of lower-level settings: probe timeouts, the delay between probes, parallelism, and how many retransmissions Nmap tries. -T3 (normal) is the default. -T4 (aggressive) assumes a fast, reliable network and is a common choice on labs and modern LANs. -T5 (insane) cuts timeouts so short that it misses ports on any network with jitter.

-T0 and -T1 (paranoid and sneaky) wait minutes or seconds between probes. They exist for IDS evasion, which is out of scope for authorized defensive work. -T2 (polite) slows down to reduce load and is a reasonable choice for fragile networks.

Fast scans can lie by omission

Nmap decides a port is filtered when no reply arrives within the timeout after retries. If you cut timeouts and retries, a slow but open port can be marked filtered. --max-retries 0 is the most common way people accidentally hide services from themselves.

Nmap prints “Increasing send delay” or “giving up on port because retransmission cap hit” when it detects loss. Those lines are a sign the network is pushing back. Slow down instead of forcing it.

Lab: measure the trade-off

Add artificial latency and loss to your lab VM’s interface with tc netem, then run the same full scan at -T3, -T4, and -T5 with --max-retries 1. Compare the open ports found and the runtime. With 5% loss, the aggressive templates usually start missing ports that -T3 still finds.

Remove the netem rule afterward. This exercise is the best argument for keeping default timing on anything that matters and saving -T4 for clean lab networks.

Snippet

# on the target VM
sudo tc qdisc add dev enp0s8 root netem delay 80ms 20ms loss 5%
# scanner
for t in 3 4 5; do sudo nmap -T$t --max-retries 1 -p- 192.168.56.101 -oN t$t.txt; done
grep -c open t*.txt
# cleanup
sudo tc qdisc del dev enp0s8 root

Finer controls

--max-rtt-timeout, --initial-rtt-timeout, --max-retries, --host-timeout, --scan-delay, and --max-parallelism override individual parts of a template. --host-timeout is especially useful on large scans so one slow host does not hold up the run.

Write the timing options into your scan notes. Two scans with different templates are not directly comparable, and a later analyst needs to know which you used.

Diagram

Aggressive timing on a lossy link

Speed gained at the cost of accuracy.

-T5 with --max-retries 0

Runtime. Fastest.

Result. Open ports marked filtered when a reply is late.

Use. Almost never.

-T3 or -T4 with default retries

Runtime. Longer.

Result. Retries recover lost probes.

Use. Default for real networks; -T4 for clean labs.

Check yourself

1. Which timing template is Nmap’s default?

2. Why can --max-retries 0 hide open ports?

3. Which option stops one slow host from delaying a large scan?