Delay
Along with the timeout variables, parallel host scanning options, and simultaneous port probes, nmap can also modify the delay between each probe frame to scan as quickly or as slowly as desired. This delay can be modified to come in "under the radar" of an intrusion prevention device, or to slow the scan down for use over non-terrestrial links.
Minimum Delay Between Probes (--scan_delay <milliseconds>)
The minimum delay between probes option (--scan_delay) takes a departure from the normal nmap nomenclature, since the preface of 'min' isn't included as part of the option name.
The --scan_delay option specifies the minimum amount of time that nmap will wait between each port request.
The --scan_delay starting value is zero. Nmap dynamically changes this delay during a scan, especially when a remote station (such as FreeBSD or Solaris) begins throttling the responses. When this occurs, nmap displays a message like this:
Increasing send delay for 192.168.0.99 from 0 to 5 due to 13 out of 43 dropped probes since last increase.If the --scan_delay is specified on the command line, the variable must be greater than zero. If it's set too low, nmap aborts the scan with this nondescript failure message:
scan_delay must be greater than 0
Maximum Delay Between Probes (--max_scan_delay <milliseconds>
The maximum delay between probes option (--max_scan_delay) sets an upper ceiling for the time that nmap will delay between each request.
Nmap's maximum probe delay can dynamically grow to as much as one per second. Using the --max_scan_delay option allows for a different maximum delay, perhaps even exceeding the one second maximum default. Increasing this option will significantly slow the total scan time. However, slowing this value may be necessary to obtain accurate scans on non-terrestrial network links or congested WAN connections.
The default maximum delay is 1,000 milliseconds (1 second). If the --max_scan_delay is set too low, nmap will halt the scan with this message:
max_scan_delay must be greater than 0

