diff --git a/docs/refguide.xml b/docs/refguide.xml
index eae1c92a1..2e892430c 100644
--- a/docs/refguide.xml
+++ b/docs/refguide.xml
@@ -2604,7 +2604,11 @@ lists the relevant options and describes what they do.
ICMP, SYN, ACK, or whatever) and during the actual port
scanning phase. Decoys are also used during remote OS
detection (). Decoys do not work with
- version detection or TCP connect scan.
+ version detection or TCP connect scan. When a scan delay is
+ in effect, the delay is enforced between each batch of
+ spoofed probes, not between each individual probe. Because
+ decoys are sent as a batch all at once, they may temporarily
+ violate congestion control limits.
It is worth noting that using too many decoys may
slow your scan and potentially even make it less
diff --git a/scan_engine.cc b/scan_engine.cc
index 0f886afee..3903d96c3 100644
--- a/scan_engine.cc
+++ b/scan_engine.cc
@@ -2694,7 +2694,12 @@ static UltraProbe *sendArpScanProbe(UltraScanInfo *USI, HostScanStats *hss,
}
/* If this is NOT a ping probe, set pingseq to 0. Otherwise it will be the
- ping sequence number (they start at 1). The probe sent is returned. */
+ ping sequence number (they start at 1). The probe sent is returned.
+
+ This function also handles the sending of decoys. There is no fine-grained
+ control of this; all decoys are sent at once on one call of this function.
+ This means that decoys do not honor any scan delay and may violate congestion
+ control limits. */
static UltraProbe *sendIPScanProbe(UltraScanInfo *USI, HostScanStats *hss,
const probespec *pspec, u8 tryno, u8 pingseq) {
u8 *packet = NULL;