Index: scripts/ipidseq.nse
===================================================================
--- scripts/ipidseq.nse	(revision 19466)
+++ scripts/ipidseq.nse	(working copy)
@@ -224,7 +224,7 @@
 
 	pcap:pcap_open(host.interface, 104, 0, callback, "tcp and dst host " .. saddr .. " and src host " .. daddr .. " and src port " .. port)
 
-	pcap:set_timeout(3000)
+	pcap:set_timeout(host.times.timeout * 1000)
 
 	local tcp = genericpkt(host, port)
 
Index: scripts/qscan.nse
===================================================================
--- scripts/qscan.nse	(revision 19466)
+++ scripts/qscan.nse	(working copy)
@@ -382,7 +382,13 @@
 
 	try = nmap.new_try(function() sock:ip_close() end)
 
-	pcap:set_timeout(3000)
+	-- Simply double the calculated host timeout to account for possible
+	-- extra time due to port forwarding or whathaveyou.  Nmap has all
+	-- ready scanned this host, so the timing should have taken into
+	-- account some of the RTT differences, but I think it really depends
+	-- on how many ports were scanned and how many were forwarded where.
+	-- Play it safer here.
+	pcap:set_timeout(2 * host.times.timeout * 1000)
 
 	local tcp = genericpkt(host)
 
Index: nse_nmaplib.cc
===================================================================
--- nse_nmaplib.cc	(revision 19466)
+++ nse_nmaplib.cc	(working copy)
@@ -145,6 +145,12 @@
     lua_setfield(L, -2, "bin_ip_src");
   }
 
+  lua_newtable(L);
+  setnfield(L, -1, "srtt", (lua_Number) currenths->to.srtt / 1000000.0);
+  setnfield(L, -1, "rttvar", (lua_Number) currenths->to.rttvar / 1000000.0);
+  setnfield(L, -1, "timeout", (lua_Number) currenths->to.timeout / 1000000.0);
+  lua_setfield(L, -2, "times");
+
   FingerPrintResults *FPR = currenths->FPR;
 
   /* if there has been an os scan which returned a pretty certain