For large environments, RelayKing can divide the target list into groups and scan them sequentially. Each group produces its own output file (when --output-file is used). Grouping is controlled by two mutually exclusive flags and one skip flag.
--max-scangroup N
Sets the maximum number of hosts per group. RelayKing calculates the required number of groups automatically.
python3 relayking.py -u lowpriv -p pass -d corp.local --dc-ip 10.0.0.1 \
--audit --max-scangroup 100 --output-file scan
--max-scangroup 100:
Output files:
scan_0.txt
scan_1.txt
scan_2.txt
--split-into N
Sets the total number of groups. RelayKing calculates the group size automatically.
python3 relayking.py -u lowpriv -p pass -d corp.local --dc-ip 10.0.0.1 \
--audit --split-into 3 --output-file scan
--split-into 3:
You cannot use --max-scangroup and --split-into at the same time. Specifying both will produce an error.
--skip N
Skips the first N groups and begins scanning from group N. Use this to restart from a specific point after an interruption, or to manually parallelize scanning across machines.
python3 relayking.py -u lowpriv -p pass -d corp.local --dc-ip 10.0.0.1 \
--audit --max-scangroup 100 --skip 1 --output-file scan
--max-scangroup 100, and --skip 1:
- Group 0 (hosts 0–99): skipped
- Group 1 (hosts 100–199): scanned
- Group 2 (hosts 200–298): scanned
Practical use cases
Resuming after an interruption
If the scan dies partway through group 1:
# Re-run from group 1
python3 relayking.py -u lowpriv -p pass -d corp.local --dc-ip 10.0.0.1 \
--audit --max-scangroup 100 --skip 1 --output-file scan
For --audit scans, use --session-resume instead of --skip when recovering from an interruption. Session resume tracks completed hosts within each group, so you do not lose any partial progress inside a group. See Session resume. Distributing across multiple machines
Run three parallel scans on three machines, each covering a different slice of the target list:
# Machine 1: group 0 only
python3 relayking.py -u lowpriv -p pass -d corp.local --dc-ip 10.0.0.1 \
--audit --split-into 3 --skip 0 --max-scangroup 1 --output-file scan
# Machine 2: group 1 only
python3 relayking.py -u lowpriv -p pass -d corp.local --dc-ip 10.0.0.1 \
--audit --split-into 3 --skip 1 --max-scangroup 1 --output-file scan
# Machine 3: group 2 only
python3 relayking.py -u lowpriv -p pass -d corp.local --dc-ip 10.0.0.1 \
--audit --split-into 3 --skip 2 --max-scangroup 1 --output-file scan
Limiting blast radius during testing
Scan only the first 50 hosts to validate configuration before committing to a full run:
python3 relayking.py -u lowpriv -p pass -d corp.local --dc-ip 10.0.0.1 \
--audit --max-scangroup 50 --split-into 1 --output-file scan-test
