Appendix D: CPU Throttling Guidance

The -cputhrottle flag provides comprehensive control over CPU usage across all resource-intensive operations. This feature prevents system overload, ensures smooth operation alongside other applications, and provides predictable performance characteristics.

Key Benefits

  • Prevents system resource exhaustion
  • Reduces memory consumption by 40-70%
  • Allows concurrent workload execution
  • Adaptive throttling based on system load

Real-World Performance Metrics

Based on testing with a 14-core system scanning 516 cipher suites and 2,300+ filesystem certificates:

Metric None Low Medium High
CPU Usage 100% 50% 70% 90%
Memory Usage ~5.2 MB ~1.3 MB ~2.6 MB ~2.6 MB
Scan Time (relative) 1.0x 4.0x 2.0x 1.5x
Concurrent Operations 28 7 14 14
Filesystem Workers 56 14 28 28
System Responsiveness Fair Excellent Good Fair

Memory Efficiency Gains

Throttling reduces peak memory demand as well as CPU demand.

Table 1. Memory Behavior Without and With Throttling
Metric Without Throttling With Throttling
Peak memory usage ~5.2 MB ~1.3 MB
Concurrent operations 28 7
Filesystem workers 56 14
Allocation pattern Unbounded growth on large scans Bounded and predictable

Operations Affected by CPU Throttling

Cryptographic operations:

  • Cipher Suite Enumeration: TLS/SSL cipher testing and negotiation
  • Certificate Analysis: X.509 certificate parsing and validation
  • SSH Key Exchange: SSH protocol negotiation and testing

Filesystem operations:

  • Certificate Discovery
  • Outlook Archive Scanning
  • Trust Store Analysis

Network operations:

  • Port Scanning
  • Host Discovery
  • DNS Enumeration

System operations:

  • Memory Scanning
  • VPN Client Detection
  • IPSec Tunnel Analysis

Recommended Use Cases

Production Server Scanning (Low)
Minimizes impact on production services. Uses only 50% CPU.
Developer Workstation (Medium)
Default setting. Provides a good balance between scan speed and system responsiveness.
Overnight Security Audit (High)
Maximizes scanning speed during off-hours when the system is otherwise idle.
CI/CD Pipeline Integration (Low)
Ensures pipeline stability by leaving headroom for build and test jobs.
Dedicated Security Scanner (None)
Maximizes throughput on dedicated hardware with no competing workloads.

Best Practices & Recommendations

Do:

  • Start with Medium (default) and adjust based on system response
  • Use Low for production systems
  • Monitor with -logfile
  • Consider scan scope: large CIDR blocks need more aggressive throttling
  • Use High for idle periods

Do not:

  • Avoid None on shared systems
  • Do not scan /8 networks without throttling
  • Do not ignore memory warnings
  • Avoid frequent throttle changes
  • Do not disable throttling for "speed"
Warning:

Critical warning: large network scans. Scanning large CIDR blocks (for example, /8 or /16) without proper throttling can cause:

  • Memory exhaustion (GB-scale allocations)
  • System crashes, especially on Windows
  • Network infrastructure overload
  • Security monitoring alerts

Always use -cputhrottle low or -cputhrottle medium for large-scale scans.