The number of script instance threads running at the same time is affected by the number of open ports and the size of the group being scanned simultaneously. The maximum limit of script instance threads that can be hardcoded in Nmap (nmap/nse_main.lua
) is 1,000, but this limit does not take into consideration the new NSE threads launched by the scripts. As an NSE developer, it is important that you consider this, especially if you are communicating with an external service, as too many connections running simultaneously might ban IP addresses.
Before we start with the parallelism mechanisms available in Lua and NSE, let's focus on the Nmap options that affect parallelism in scans. The --min-hostgroup
, --max-hostgroup
, --min-parallelism
, and --max-parallelism
options work as described in the following sections.