When you want to run an attack on more than one system without duplicating work, you need to distribute the work.
The hashcat --skip and --limit options can distribute work by dividing an attack into discrete “chunks”. Each instance of hashcat works on one chunk.
* The --skip option defines where to start the chunk (how far along in the keyspace to start)
* The --limit option defines where to end the chunk (how much of the keyspace to attack before stopping, or the chunk size).
The number and size of “chunks” in a given attack vary based on a measurement that hashcat calls “keyspace”. This has a meaning specific to hashcat, distinct from its general meaning in cryptography. For an explanation of hashcat's keyspace, see What is a keyspace? in the hashcat FAQ.
To calculate the keyspace for a given attack, run the attack with the --keyspace option.
If --keyspace gives you a keyspace of 15 (unusually small for illustration purposes), and you want to divide the attack among three machines of equal power:
1. On machine 1, --skip 0 --limit 5
2. On machine 2, --skip 5 --limit 5
3. On machine 3, --skip 10 --limit 5
If you want to divide the same keyspace between two machines, where machine 2 is twice as fast as machine 1:
1. On machine 1, --skip 0 --limit 5 (1/3 of the keyspace)
2. On machine 2, --skip 5 --limit 10 (2/3 of the keyspace)
A straight or hybrid attack given several inputs counts them as one keyspace, and --skip, --limit and --keyspace cover the whole queue rather than one file at a time. So you measure the queue once and cut it up once, instead of per wordlist.
A position counts base words. Rules and the rest of a mask expand each one afterwards, which is why a chunk of 5 is not 5 candidates.
Some attacks reject these options and report an error:
--limit conflicts with --loopback--restore when the attack has more than one mask
If you are reading progress back out of hashcat, see machine-readable output: PROGRESS already accounts for the range you asked for, so a tool must not add --skip to it.
The hashcat project doesn't directly endorse any particular third-party framework for distributing work. Hashtopolis is the one most people use, and Hashview is the other one actively worked on.
NOTE: These platforms sometimes have limitations on the size of wordlists and/or target hashlists. Do NOT expect to easily push a multi-GB wordlist through such frameworks. They are best suited to running smaller wordlists against a smaller number of slower hashes, or running a mask or hybrid attack against a smaller number of faster hashes. If you are working with larger targets or larger wordlists, you can run those attacks locally first to reduce the target size and avoid trying to push large wordlists into your distribution framework.