Command library / nmap

Network mapper: finds hosts, open ports and service versions

Nmap ("Network Mapper") discovers hosts on a network, finds their open ports and can identify the services, versions and operating systems behind them. Scan types are single-dash options whose letters are case-sensitive (-sS, -sV, -sU). Only scan systems you own or have written permission to test.

Usage

Options and flags

• target

  host name, IP address or CIDR range to scan

• -sV

  service/version detection on open ports

• -sS

  TCP SYN scan (fast, needs root)

• -sT

  TCP connect scan (no root needed)

• -sU

  UDP scan (slow; needs root)

• -sN

  TCP Null scan (no flags set)

• -sn

  ping scan: host discovery only, no port scan

• -sC

  run the default NSE scripts

• -p, --ports PORTS

  ports to scan, e.g. 22,80,443 or 1-1000 or - for all 65535

• -Pn

  skip host discovery — treat the host as up (use when ping is blocked)

• -A

  aggressive: OS detection, version detection, default scripts and traceroute

• -O

  OS detection

• -F

  fast scan: only the 100 most common ports

• -v

  increase verbosity

• -T 0-5

  timing template: 0 (slowest, stealthy) to 5 (fastest)

• --top-ports N

  scan the N most common ports

• --script SCRIPTS

  run the named NSE scripts or categories

• -oN FILE

  save results in normal (human-readable) format

• -oX FILE

  save results as XML

• -oA BASENAME

  save in all three formats at once

• -iL FILE

  read the target list from a file

Examples

• nmap -sV 192.168.1.10

  Scan the default ports and identify service versions.

• nmap -p 22,80,443 10.10.10.5

  Only three ports — quick and quiet.

• nmap -sn 192.168.1.0/24

  Which hosts on the /24 are alive? No port scan.

• nmap -Pn -p- 10.10.10.5

  All 65535 ports on a host that ignores ping.

• nmap -sV -oN scan.txt 10.10.10.5

  Version scan, results saved to scan.txt.

Common mistakes

Related commands