How nuclei RPS mechanism works?

[Merricx]

When scanning specific target (only single host), nuclei gradually dropped the RPS and it eventually reach ~5 RPS. This is very bad because the scan would take more than 1 hour to complete.

My questions are as follows:

• Beside the network condition, what are other possible causes of this?
• Is Nuclei internally use mechanism where the scan speed is adapting the network condition?
• Why when the RPS dropped and we restart the scan, it goes back to high RPS immediately (which will then drop again as the time goes on)?
• Is there any parameter to prevent long-running scan on unresponsive/slow target? (I've read that using -mhe will not solve this)

Thanks in advance

[ab-samatbhn]

Hey @Merricx I'm also having this same problem lately, the RPS quickly dropped in 4-5 seconds at start, from average 150 RPS down to 5-6 RPS which is very slow. Have you compare it with other tools?

[ejabu]

is the normal ping request to the target also slowed down after some time ?

[tarunKoyalwar]

@Merricx . There are some known issues with stats #4434 .

example some templates outgoing request count is not fixed ( changes on template logic / depends on condition) . this is currently not reflected in stats i.e why scan percentage is not 💯 accurate (currently)

Change in RPS is mainly due to target & template (protocol type) . when scan is first started RPS will be over 300 or even more depending on target count , this is because dns templates are lightweight and they complete first , and http protocol and other protocol templates are comparatively heavier than dns i.e why RPS drops or keeps fluctuating.

finally about low RPS in the end is usually because of slow / high latency targets or templates that send more than one request or due to retries on unresponsive hosts etc
also we recently fixed a issue in templates that sent more than 1 requests #4715 looks like you are still using old nuclei version

other than that ratelimit values also directly affects stats in case of http templates

RPS Range directly depends on concurrency , checkout docs on mass scanning which provides insights on concurrency and other options as well https://docs.projectdiscovery.io/tools/nuclei/mass-scanning-cli

Note

stats percentage may not be accurate but RPS is accurate