Basic Scan Types
| Command | Description |
|---|---|
nmap <target> | Simple scan, default is a TCP connect scan |
nmap -sS <target> | Stealth SYN scan (default for privileged users) |
nmap -sT <target> | TCP connect scan (used if SYN scan isn’t an option) |
nmap -sU <target> | UDP scan |
nmap -sP <target> | Ping scan, lists live hosts (no port scan) |
nmap -sV <target> | Version detection (finds version of services) |
nmap -O <target> | OS detection |
Port Scanning
| Command | Description |
|---|---|
nmap -p <port> <target> | Scan specific port |
nmap -p- <target> | Scan all 65535 TCP ports |
nmap --top-ports <N> <target> | Scan N most common ports |
nmap -F <target> | Fast scan (100 most common ports) |
nmap --reason <target> | Show why a port is reported as open/closed |
Aggressive Scanning
| Command | Description |
|---|---|
nmap -A <target> | Aggressive scan (includes OS detection, version detection, script scanning, traceroute) |
nmap -T4 <target> | Faster scan with aggressive timing (T0-T5, higher is faster) |
Host Discovery
| Command | Description |
|---|---|
nmap -sn <target> | Ping scan (host discovery, no port scan) |
nmap -Pn <target> | Disable ping (treats all hosts as up) |
nmap -PS/PA <target> | TCP SYN/ACK ping (port selection: -PS22,80 for 22, 80) |
nmap -PU <target> | UDP ping (port selection: -PU53 for port 53) |
Service & Version Detection
| Command | Description |
|---|---|
nmap -sV <target> | Detect service version on open ports |
nmap --version-all <target> | Attempt to detect version on all ports |
Output Formats
| Command | Description |
|---|---|
nmap -oN output.txt <target> | Normal text output |
nmap -oX output.xml <target> | XML output |
nmap -oG output.gnmap <target> | Grepable output |
nmap -oA output <target> | Output in all formats (normal, XML, grepable) |
Scan Specific IP Range
| Command | Description |
|---|---|
nmap <IP1>-<IP2> | Scan a range of IP addresses (e.g., nmap 192.168.1.1-20) |
nmap <IP>/CIDR | Scan a subnet (e.g., nmap 192.168.1.0/24) |
Excluding Hosts
| Command | Description |
|---|---|
nmap <target> --exclude <host> | Exclude specific hosts from scan |
nmap <target> --excludefile <file> | Exclude hosts listed in a file |
Nmap Scripting Engine (NSE)
| Command | Description |
|---|---|
nmap --script <script-name> <target> | Run specific script |
nmap --script-help <script-name> | Get help for a specific script |
nmap --script vuln <target> | Scan target for vulnerabilities using NSE |
nmap --script safe <target> | Only run non-intrusive scripts |
Advanced Options
| Command | Description |
|---|---|
nmap -6 <target> | Enable IPv6 scanning |
nmap -D RND:10 <target> | Use decoys to hide the real scanning source |
nmap --data-length <num> <target> | Send packets with additional padding |
nmap --spoof-mac <mac address> | Spoof MAC address |
nmap -S <source_ip> <target> | Use specific source IP address |
