LEGAL AND ETHICAL NOTICE: Scanning networks that you do not own or have explicit permission to scan is illegal in most jurisdictions and violates the Computer Fraud and Abuse Act (CFAA) in the United States and similar laws worldwide. Always obtain written authorization before scanning any network. Use nmap only on your own networks, systems you have permission to test, or in controlled lab environments. Unauthorized scanning can result in criminal prosecution, civil liability, and network access termination.
About nmap
Nmap (Network Mapper) is a free and open-source utility for network discovery and security auditing. Originally written by Gordon Lyon (Fyodor), nmap has become the de facto standard for network reconnaissance and is used by system administrators, security professionals, and network engineers worldwide.
Primary uses: Network inventory, managing service upgrade schedules, monitoring host or service uptime, discovering vulnerabilities, mapping network topology, identifying open ports, detecting operating systems and applications, and performing security assessments. Nmap uses raw IP packets to determine available hosts, services, operating systems, packet filters/firewalls, and numerous other characteristics.
Key capabilities: Host discovery, port scanning, version detection, OS detection, scriptable interaction with the target (NSE - Nmap Scripting Engine), and flexible output formats for integration with other tools.
Basic Syntax:
nmap [Scan Type] [Options] {target specification}
Target Specification:
nmap 192.168.1.1 # Single IP
nmap 192.168.1.1-254 # IP range
nmap 192.168.1.0/24 # CIDR notation
nmap scanme.nmap.org # Hostname
nmap 192.168.1.1 192.168.1.5 # Multiple targets
nmap -iL targets.txt # Input from file
Common Scan Types:
-sS TCP SYN scan (default, requires root)
-sT TCP connect() scan
-sU UDP scan
-sV Version detection
-O OS detection
-A Aggressive scan (OS, version, script, traceroute)
Common Options:
-p Port specification (e.g., -p 22,80,443 or -p 1-65535)
-Pn Skip host discovery (treat all hosts as online)
-n No DNS resolution
-v Verbose output
-T4 Timing template (0-5, higher is faster)
-oN Normal output to file
Detailed Examples
1Basic Host Discovery (Ping Scan)
Determine which hosts are up on a network without performing a port scan.
$ sudo nmap -sn 192.168.1.0/24
Starting Nmap 7.94 ( https://nmap.org ) at 2025-11-28 10:00 EST
Nmap scan report for 192.168.1.1
Host is up (0.0012s latency).
MAC Address: 00:11:22:33:44:55 (Cisco Systems)
Nmap scan report for 192.168.1.10
Host is up (0.0025s latency).
MAC Address: AA:BB:CC:DD:EE:FF (Dell)
Nmap scan report for 192.168.1.15
Host is up (0.0018s latency).
MAC Address: 11:22:33:44:55:66 (Apple)
Nmap scan report for 192.168.1.100
Host is up.
Nmap done: 256 IP addresses (4 hosts up) scanned in 2.45 seconds
What's happening: The
-sn flag performs a "ping scan" (previously called -sP). This discovers which hosts are online without scanning ports. By default, nmap sends an ICMP echo request, a TCP SYN to port 443, a TCP ACK to port 80, and an ICMP timestamp request. When run with root privileges (sudo), nmap also uses ARP requests on local networks, which is faster and more reliable. The output shows four hosts are up out of 256 addresses scanned. For three hosts, MAC addresses are shown (meaning they're on the same local network), while 192.168.1.100 shows no MAC (likely the scanning host itself). Latency times indicate network responsiveness.
The -sn flag is perfect for quickly mapping a network before deeper scans. It's less intrusive than port scanning and completes much faster. On local networks, ARP-based discovery is very reliable.
Scan Type: Host Discovery
Techniques used: ICMP echo request, TCP SYN (443), TCP ACK (80), ICMP timestamp, ARP request (local networks) Requires root: For full functionality, yes Typical use case: Initial network reconnaissance, inventory management2Basic Port Scan - Common Ports
Scan the most commonly used ports on a single target.
$ nmap 192.168.1.50
Starting Nmap 7.94 ( https://nmap.org ) at 2025-11-28 10:15 EST
Nmap scan report for webserver.local (192.168.1.50)
Host is up (0.00045s latency).
Not shown: 996 closed tcp ports (conn-refused)
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
443/tcp open https
3306/tcp open mysql
Nmap done: 1 IP address (1 host up) scanned in 0.18 seconds
What's happening: Without any flags, nmap performs a default scan of the 1,000 most common TCP ports. The output shows four ports are open (accepting connections), while 996 ports are closed (actively refusing connections). The "STATE" column indicates the port status, and "SERVICE" shows the typical service associated with that port based on nmap's service database. Port 22 (SSH) suggests remote administration is available, ports 80 and 443 indicate a web server with HTTP and HTTPS, and port 3306 suggests MySQL database access. The scan completed in 0.18 seconds, which is quite fast. The notation "conn-refused" indicates closed ports sent RST (reset) packets in response.
Running nmap without sudo uses TCP connect() scans instead of SYN scans. Connect scans are slower and more easily detected because they complete the full three-way TCP handshake. They also appear in application logs.
Running a default scan is a good starting point, but it only checks 1,000 ports. A complete TCP port space has 65,535 ports. Critical services might run on non-standard ports and would be missed by this scan.
3SYN Stealth Scan with Specific Ports
Perform a stealthy half-open scan on specific ports.
$ sudo nmap -sS -p 21,22,23,25,80,443,3389 192.168.1.75
Starting Nmap 7.94 ( https://nmap.org ) at 2025-11-28 10:30 EST
Nmap scan report for fileserver.local (192.168.1.75)
Host is up (0.00032s latency).
PORT STATE SERVICE
21/tcp closed ftp
22/tcp open ssh
23/tcp filtered telnet
25/tcp closed smtp
80/tcp closed http
443/tcp closed https
3389/tcp open ms-wbt-server
MAC Address: 00:50:56:AA:BB:CC (VMware)
Nmap done: 1 IP address (1 host up) scanned in 0.08 seconds
What's happening: The
-sS flag performs a TCP SYN scan (also called "half-open" scan), which is the default when running as root. This sends SYN packets and analyzes responses without completing the TCP handshake, making it stealthier than connect scans. The -p flag specifies exactly which ports to scan (FTP, SSH, Telnet, SMTP, HTTP, HTTPS, and RDP). The results show three different port states: open (22, 3389) - accepting connections; closed (21, 25, 80, 443) - no service listening but port accessible; filtered (23) - firewall or packet filter blocking access, so nmap can't determine if it's open or closed. Port 3389 being open suggests this is a Windows machine with Remote Desktop enabled. The VMware MAC address indicates this is a virtual machine.
SYN scans are faster and stealthier than connect scans because they don't complete the TCP three-way handshake. However, modern IDS/IPS systems can still detect SYN scans. The term "stealth scan" is somewhat historical; these scans were stealthy in the 1990s but are well-known now.
Scan Type: TCP SYN (Stealth Scan)
How it works: Sends SYN, receives SYN/ACK (open) or RST (closed), sends RST to abort Requires root: Yes (raw socket access) Detection difficulty: Medium (logged by firewalls, not usually by applications)4Service Version Detection
Identify specific versions of services running on open ports.
$ sudo nmap -sV 192.168.1.50
Starting Nmap 7.94 ( https://nmap.org ) at 2025-11-28 11:00 EST
Nmap scan report for webserver.local (192.168.1.50)
Host is up (0.00042s latency).
Not shown: 996 closed tcp ports (reset)
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.4 (Ubuntu Linux; protocol 2.0)
80/tcp open http Apache httpd 2.4.52 ((Ubuntu))
443/tcp open ssl/http Apache httpd 2.4.52 ((Ubuntu))
3306/tcp open mysql MySQL 8.0.35-0ubuntu0.22.04.1
MAC Address: 00:0C:29:AA:BB:CC (VMware)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 6.78 seconds
What's happening: The
-sV flag enables version detection, which probes open ports to determine the exact service and version. This is significantly more intensive than a basic port scan. Nmap connects to each open port and sends various probes to elicit responses that reveal version information. The results show detailed service information: OpenSSH version 8.9p1 on Ubuntu, Apache 2.4.52 web server, and MySQL 8.0.35. This level of detail is crucial for security auditing because specific versions may have known vulnerabilities. The "Service Info" line provides OS detection based on service fingerprints. Note the scan took 6.78 seconds compared to 0.18 seconds for the basic scan - version detection is much slower because it must interact with each service.
Version detection is essential for vulnerability assessment. Once you know exact versions, you can check CVE databases for known vulnerabilities. However, this aggressive probing is very noisy and will definitely be logged by the target systems.
Version detection can sometimes crash poorly-written services or cause denial of service. Always test in development environments before scanning production systems.
5Operating System Detection
Identify the operating system and version of the target host.
$ sudo nmap -O 192.168.1.75
Starting Nmap 7.94 ( https://nmap.org ) at 2025-11-28 11:30 EST
Nmap scan report for fileserver.local (192.168.1.75)
Host is up (0.00035s latency).
Not shown: 998 closed tcp ports (reset)
PORT STATE SERVICE
22/tcp open ssh
3389/tcp open ms-wbt-server
MAC Address: 00:50:56:AA:BB:CC (VMware)
Device type: general purpose
Running: Microsoft Windows 10|2016
OS CPE: cpe:/o:microsoft:windows_10 cpe:/o:microsoft:windows_server_2016
OS details: Microsoft Windows 10 1607 - 1903, or Windows Server 2016
Network Distance: 1 hop
OS detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 4.52 seconds
What's happening: The
-O flag enables OS detection using TCP/IP stack fingerprinting. Nmap sends a series of TCP and UDP packets to the target and examines the responses. Different operating systems implement TCP/IP stacks slightly differently (in terms of window sizes, options, TTL values, etc.), creating unique "fingerprints." The results indicate this is likely Microsoft Windows 10 or Windows Server 2016, with CPE (Common Platform Enumeration) identifiers for precise system identification. The "Network Distance: 1 hop" indicates the target is on the same local network. OS detection requires at least one open and one closed port to be effective. The confidence level isn't 100% because multiple OS versions can have similar fingerprints.
For best OS detection results, combine -O with -sV: sudo nmap -O -sV target. The service version information helps refine OS guesses. Also, use --osscan-guess for more aggressive guessing when nmap isn't confident.
Scan Type: OS Fingerprinting
Technique: Analyzes TCP/IP stack behavior, sequence prediction, ICMP responses Requirements: Root access, at least one open and one closed port Accuracy: Generally 85-95% with good conditions6Aggressive Scan (Combined Techniques)
Comprehensive scan with OS detection, version detection, script scanning, and traceroute.
$ sudo nmap -A -T4 192.168.1.50
Starting Nmap 7.94 ( https://nmap.org ) at 2025-11-28 12:00 EST
Nmap scan report for webserver.local (192.168.1.50)
Host is up (0.00041s latency).
Not shown: 996 closed tcp ports (reset)
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.4 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 256 a4:bb:cc:dd:ee:ff:00:11:22:33:44:55:66:77:88:99 (ECDSA)
|_ 256 11:22:33:44:55:66:77:88:99:aa:bb:cc:dd:ee:ff:00 (ED25519)
80/tcp open http Apache httpd 2.4.52 ((Ubuntu))
|_http-title: Welcome to Ubuntu
|_http-server-header: Apache/2.4.52 (Ubuntu)
443/tcp open ssl/http Apache httpd 2.4.52 ((Ubuntu))
|_http-title: Welcome to Ubuntu
|_http-server-header: Apache/2.4.52 (Ubuntu)
| ssl-cert: Subject: commonName=webserver.local
| Not valid before: 2024-01-15T10:00:00
|_Not valid after: 2026-01-14T10:00:00
3306/tcp open mysql MySQL 8.0.35-0ubuntu0.22.04.1
| mysql-info:
| Protocol: 10
| Version: 8.0.35-0ubuntu0.22.04.1
| Thread ID: 12
| Capabilities flags: 65535
| Some Capabilities: Support41Auth, LongPassword, SupportsTransactions
|_ Status: Autocommit
MAC Address: 00:0C:29:AA:BB:CC (VMware)
Device type: general purpose
Running: Linux 5.X
OS CPE: cpe:/o:linux:linux_kernel:5.15
OS details: Linux 5.15 (Ubuntu 22.04)
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
TRACEROUTE
HOP RTT ADDRESS
1 0.41 ms webserver.local (192.168.1.50)
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 18.93 seconds
What's happening: The
-A flag enables aggressive scanning, which combines OS detection (-O), version detection (-sV), script scanning (--script=default), and traceroute (--traceroute). The -T4 flag sets the timing template to "aggressive" for faster scanning. The results are comprehensive: NSE (Nmap Scripting Engine) scripts gathered SSH host keys, HTTP server headers and titles, SSL certificate information, and MySQL server capabilities. The scripts ran automatically and provided valuable reconnaissance data. The SSL certificate shows the server's validity period (2024-2026) and confirms the hostname. The traceroute shows only one hop, confirming local network placement. This scan took 18.93 seconds because it's running multiple detection methods and numerous scripts.
Aggressive scans (-A) are very noisy and will absolutely be detected and logged. They can also trigger IDS/IPS alerts. Only use on networks where you have explicit permission and during approved security testing windows.
The -A flag is powerful for security assessments but should be used judiciously. It runs many NSE scripts that actively interact with services, potentially exposing vulnerabilities in a way that could be detected or cause issues.
7UDP Port Scan
Scan for open UDP ports, which are often overlooked but critical for security.
$ sudo nmap -sU -p 53,67,68,69,123,161,162 192.168.1.1
Starting Nmap 7.94 ( https://nmap.org ) at 2025-11-28 13:00 EST
Nmap scan report for router.local (192.168.1.1)
Host is up (0.0012s latency).
PORT STATE SERVICE
53/udp open domain
67/udp open dhcps
68/udp open|filtered dhcpc
69/udp closed tftp
123/udp open ntp
161/udp open snmp
162/udp closed snmptrap
MAC Address: 00:11:22:33:44:55 (Cisco Systems)
Nmap done: 1 IP address (1 host up) scanned in 7.43 seconds
What's happening: The
-sU flag performs UDP scanning, which is fundamentally different from TCP scanning. UDP is a connectionless protocol, so there's no handshake to complete or refuse. Nmap sends UDP packets and waits for responses. An open port means the service responded; closed means an ICMP port unreachable message was received; open|filtered means no response was received, which could mean the port is open but the service doesn't respond to empty probes, or a firewall is dropping packets. This router shows typical UDP services: DNS (53), DHCP server (67), DHCP client (68), NTP time sync (123), and SNMP network management (161). UDP scanning is notoriously slow because of rate limiting on ICMP unreachable messages and the need to wait for timeouts.
UDP scans are extremely slow. A full 65,535 port UDP scan can take 18+ hours. Always specify specific ports with -p when UDP scanning. Also, many UDP services don't respond to empty probes, resulting in "open|filtered" states that require additional investigation.
UDP services are often neglected in security audits but can be critical attack vectors. SNMP (161) with default community strings is a common vulnerability. DNS (53) and NTP (123) can be used for amplification attacks.
8Scan All TCP Ports
Comprehensive scan of all 65,535 TCP ports to find services on non-standard ports.
$ sudo nmap -p- -T4 -v 192.168.1.100
Starting Nmap 7.94 ( https://nmap.org ) at 2025-11-28 14:00 EST
Initiating SYN Stealth Scan at 14:00
Scanning devserver.local (192.168.1.100) [65535 ports]
Discovered open port 22/tcp on 192.168.1.100
Discovered open port 80/tcp on 192.168.1.100
Discovered open port 8080/tcp on 192.168.1.100
Discovered open port 8443/tcp on 192.168.1.100
Discovered open port 9000/tcp on 192.168.1.100
Discovered open port 33060/tcp on 192.168.1.100
Completed SYN Stealth Scan at 14:02, 42.28s elapsed (65535 total ports)
Nmap scan report for devserver.local (192.168.1.100)
Host is up (0.00038s latency).
Not shown: 65529 closed tcp ports (reset)
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
8080/tcp open http-proxy
8443/tcp open https-alt
9000/tcp open cslistener
33060/tcp open mysqlx
MAC Address: 00:0C:29:DD:EE:FF (VMware)
Nmap done: 1 IP address (1 host up) scanned in 42.35 seconds
What's happening: The
-p- flag (equivalent to -p 1-65535) scans all 65,535 possible TCP ports instead of just the default 1,000. The -v flag provides verbose output, showing discovered ports in real-time as the scan progresses. The -T4 timing template speeds up the scan. This comprehensive scan discovered services running on non-standard ports that a default scan would miss: port 8080 (alternate HTTP), 8443 (alternate HTTPS), 9000 (often used for development services), and 33060 (MySQL X Protocol). The scan took 42.35 seconds to check all 65,535 ports. Without -T4, this could take several minutes. In security assessments, administrators sometimes move services to non-standard ports for "security through obscurity," but a full port scan reveals them.
Full port scans are essential for thorough security audits. Services on non-standard ports might be development servers, backdoors, or legitimate services that administrators tried to "hide." Always perform full scans during comprehensive security assessments.
9NSE Script Scan for Vulnerabilities
Use Nmap Scripting Engine to check for common vulnerabilities.
$ sudo nmap -sV --script=vuln 192.168.1.50
Starting Nmap 7.94 ( https://nmap.org ) at 2025-11-28 15:00 EST
Nmap scan report for webserver.local (192.168.1.50)
Host is up (0.00043s latency).
Not shown: 996 closed tcp ports (reset)
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.4 (Ubuntu Linux; protocol 2.0)
80/tcp open http Apache httpd 2.4.52 ((Ubuntu))
|_http-stored-xss: Couldn't find any stored XSS vulnerabilities.
|_http-csrf: Couldn't find any CSRF vulnerabilities.
|_http-dombased-xss: Couldn't find any DOM based XSS.
| http-enum:
| /admin/: Possible admin folder
| /admin/index.php: Possible admin folder
|_ /backup/: Backup folder w/ directory listing
443/tcp open ssl/http Apache httpd 2.4.52 ((Ubuntu))
|_http-stored-xss: Couldn't find any stored XSS vulnerabilities.
| ssl-poodle:
| VULNERABLE:
| SSL POODLE information leak
| State: VULNERABLE
| IDs: CVE:CVE-2014-3566 OSVDB:113251
| The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other
| products, uses nondeterministic CBC padding, which makes it easier
| for man-in-the-middle attackers to obtain cleartext data via a
| padding-oracle attack, aka the "POODLE" issue.
| Disclosure date: 2014-10-14
| Check results:
| TLS_RSA_WITH_AES_128_CBC_SHA
| References:
| https://www.openssl.org/~bodo/ssl-poodle.pdf
| https://www.imperialviolet.org/2014/10/14/poodle.html
|_ http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566
3306/tcp open mysql MySQL 8.0.35-0ubuntu0.22.04.1
MAC Address: 00:0C:29:AA:BB:CC (VMware)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 47.82 seconds
What's happening: The
--script=vuln option runs all NSE scripts in the "vuln" category, which check for known vulnerabilities. NSE (Nmap Scripting Engine) is a powerful Lua-based scripting framework that extends nmap's capabilities. In this scan, scripts tested for XSS vulnerabilities, CSRF, enumerated web directories (finding /admin/ and /backup/ directories), and discovered an SSL POODLE vulnerability (CVE-2014-3566) on port 443. The POODLE finding is significant - it's a real vulnerability in SSL 3.0 that could allow attackers to decrypt secure connections. The script provides the CVE identifier, description, disclosure date, and references for further research. The /backup/ directory with directory listing is also a security concern. This scan took 47.82 seconds because vulnerability scripts are thorough and make multiple requests.
The vuln script category is incredibly powerful for security assessments but should be used carefully. Some vulnerability checks can crash services or create unusual log entries. Always test in non-production first. Document any findings thoroughly for remediation.
NSE has many script categories: safe, intrusive, exploit, auth, brute, discovery, version, vuln, and more. You can also run individual scripts with --script=scriptname or combine categories with --script="vuln and safe".
10Saving Scan Results in Multiple Formats
Export scan results in various formats for documentation and integration with other tools.
$ sudo nmap -A -T4 192.168.1.0/24 -oA network_scan_20251128
Starting Nmap 7.94 ( https://nmap.org ) at 2025-11-28 16:00 EST
Nmap scan report for router.local (192.168.1.1)
Host is up (0.0011s latency).
Not shown: 995 closed tcp ports (reset)
[... scan output continues ...]
Nmap done: 256 IP addresses (15 hosts up) scanned in 485.22 seconds
$ ls -lh network_scan*
-rw-r--r-- 1 root root 45K Nov 28 16:08 network_scan_20251128.gnmap
-rw-r--r-- 1 root root 89K Nov 28 16:08 network_scan_20251128.nmap
-rw-r--r-- 1 root root 124K Nov 28 16:08 network_scan_20251128.xml
What's happening: The
-oA flag outputs results in all three major formats simultaneously with the specified basename "network_scan_20251128". This creates three files: .nmap (normal human-readable format, same as -oN), .gnmap (grepable format for parsing with command-line tools, same as -oG), and .xml (XML format for importing into other tools like Metasploit, Nessus, or custom parsers, same as -oX). The XML format is particularly valuable for integrating nmap results into vulnerability management systems, automated reporting tools, or security information and event management (SIEM) platforms. The scan took over 8 minutes (485 seconds) because it performed an aggressive scan (-A) on an entire /24 network (256 addresses). Using date-stamped filenames (20251128) is a best practice for tracking scan history and comparing results over time.
Always save scan results for documentation and comparison. Use descriptive filenames with dates and target identifiers. The XML format (-oX) is especially valuable for tool integration. You can also use -oS for script kiddie format (rarely used) and --stylesheet for custom XML styling.
Output Format Best Practices
- -oN (normal): Human-readable, good for reports and review
- -oG (grepable): Easy parsing with grep, awk, sed
- -oX (XML): Tool integration, programmatic analysis
- -oA (all): Creates all three, safest choice
- Append mode: Use --append-output to add to existing files
- Resume: Use --resume filename to continue interrupted scans
Scan Techniques Reference
| Scan Type | Flag | Description | Requires Root |
|---|---|---|---|
| TCP SYN Scan | -sS |
Half-open scan, sends SYN, doesn't complete handshake (default with root) | Yes |
| TCP Connect Scan | -sT |
Full TCP connection, uses system connect() call (default without root) | No |
| UDP Scan | -sU |
Scans UDP ports by sending UDP packets | Yes (recommended) |
| TCP ACK Scan | -sA |
Maps firewall rules, determines filtered vs. unfiltered ports | Yes |
| TCP Window Scan | -sW |
Like ACK but examines TCP window field for open port detection | Yes |
| TCP Maimon Scan | -sM |
Sends FIN/ACK probe, exploits BSD-derived TCP implementation detail | Yes |
| TCP NULL Scan | -sN |
Sends packet with no flags set | Yes |
| TCP FIN Scan | -sF |
Sends packet with only FIN flag set | Yes |
| TCP Xmas Scan | -sX |
Sends packet with FIN, PSH, and URG flags (lights up like a Christmas tree) | Yes |
| Ping Scan | -sn |
Host discovery only, no port scanning | No (limited), Yes (full) |
| IP Protocol Scan | -sO |
Determines which IP protocols are supported (TCP, UDP, ICMP, etc.) | Yes |
| FTP Bounce Scan | -b |
Uses FTP server to scan other hosts (rarely works now) | No |
Timing and Performance Options
Nmap provides timing templates (-T0 through -T5) that control scan speed and aggressiveness. These templates adjust dozens of internal timing parameters. Higher numbers mean faster but noisier scans.
| Template | Name | Description | Use Case |
|---|---|---|---|
-T0 |
Paranoid | Extremely slow, one port at a time, 5-minute delays | IDS evasion (historical, rarely effective now) |
-T1 |
Sneaky | Very slow, 15-second delays between probes | IDS evasion attempts |
-T2 |
Polite | Slows down to use less bandwidth and target resources | Avoiding network congestion, respecting target |
-T3 |
Normal | Default timing, balances speed and accuracy | General purpose scanning (default) |
-T4 |
Aggressive | Speeds up scans on fast/reliable networks | Fast local network scans, modern networks |
-T5 |
Insane | Extremely fast, may sacrifice accuracy | Very fast networks, when speed matters more than accuracy |
For most modern networks, -T4 is recommended. It's significantly faster than the default -T3 without sacrificing accuracy on good networks. Use -T2 or slower only when specifically trying to avoid detection or reduce network load.
Port Specification Options
Nmap provides flexible ways to specify which ports to scan. By default, nmap scans the 1,000 most common ports from its internal database.
| Option | Example | Description |
|---|---|---|
-p <port> |
-p 22 |
Scan a single port |
-p <port1,port2> |
-p 22,80,443 |
Scan specific ports (comma-separated) |
-p <start-end> |
-p 1-1024 |
Scan a range of ports |
-p- |
-p- |
Scan all 65,535 ports (1-65535) |
-p U:<ports>,T:<ports> |
-p U:53,T:80,443 |
Specify UDP and TCP ports separately |
--top-ports <n> |
--top-ports 100 |
Scan the N most common ports |
--port-ratio <ratio> |
--port-ratio 0.1 |
Scan ports with ratio or higher in nmap-services |
-F |
-F |
Fast scan (scans only 100 most common ports) |
Host Discovery Options
Before port scanning, nmap performs host discovery to determine which targets are online. These options control that discovery process.
| Option | Description |
|---|---|
-sn |
Ping scan only (no port scan), previously -sP |
-Pn |
Skip host discovery, treat all hosts as online |
-PS <ports> |
TCP SYN discovery to given ports (default: 80) |
-PA <ports> |
TCP ACK discovery to given ports (default: 80) |
-PU <ports> |
UDP discovery to given ports (default: 40125) |
-PE |
ICMP echo request discovery (traditional ping) |
-PP |
ICMP timestamp request discovery |
-PM |
ICMP address mask request discovery |
-PR |
ARP discovery on local network (default for local) |
-n |
Never do DNS resolution (speeds up scans) |
-R |
Always do DNS resolution (even for offline hosts) |
Many networks block ICMP, making traditional ping useless. Nmap's default host discovery uses multiple techniques (ICMP, TCP SYN to 443, TCP ACK to 80, and ICMP timestamp) to maximize success. On local networks, ARP is used and is very reliable.
Nmap Scripting Engine (NSE) Categories
NSE scripts are organized into categories. You can run entire categories with
--script=<category> or individual scripts with --script=<scriptname>.
| Category | Description | Risk Level |
|---|---|---|
auth |
Scripts dealing with authentication (bypassing, brute force) | Medium-High |
broadcast |
Discover hosts via broadcast (DHCP, DNS-SD, etc.) | Low |
brute |
Brute force attack scripts (passwords, keys) | High |
default |
Scripts that run with -sC or -A, safe and useful | Low |
discovery |
Active information gathering (SNMP, uptime, etc.) | Low-Medium |
dos |
Scripts that may cause denial of service | Very High |
exploit |
Scripts that actively exploit vulnerabilities | Very High |
external |
Scripts that send data to external resources | Medium |
fuzzer |
Fuzzing scripts that send unexpected input | High |
intrusive |
Scripts that are very noisy or risky | High |
malware |
Scripts that check for malware/backdoors | Low |
safe |
Scripts unlikely to crash services or be intrusive | Very Low |
version |
Scripts used for advanced version detection | Low |
vuln |
Scripts that check for specific vulnerabilities | Medium-High |
Always understand what NSE scripts do before running them. Scripts in the exploit, dos, and intrusive categories can crash services, trigger security alerts, or even cause system compromise. Read the script documentation with: nmap --script-help=<scriptname>
Best Practices for Network Scanning
Legal and Ethical Guidelines
- Get explicit written permission: Before scanning any network, obtain clear written authorization from the network owner or authorized representative.
- Define scope clearly: Document exactly which IP addresses, networks, and time windows are approved for scanning.
- Notify relevant parties: Inform IT security teams, NOC staff, and other stakeholders before conducting scans that might trigger alerts.
- Use test networks: Practice and develop skills on your own networks, virtual lab environments, or explicitly authorized test ranges like scanme.nmap.org.
- Document everything: Keep detailed logs of what you scanned, when, and what authorization you had.
- Respect system resources: Don't overwhelm target systems with aggressive scans that could cause performance issues or outages.
Technical Best Practices
- Start with discovery: Begin with host discovery (-sn) to identify live hosts before port scanning.
- Scan progressively: Start with quick scans (top ports), then expand to comprehensive scans based on findings.
- Use appropriate timing: -T4 for local networks, -T3 for internet, -T2 for avoiding detection or reducing load.
- Save all results: Always use -oA to save results in multiple formats for analysis and documentation.
- Scan UDP services: Don't forget UDP (-sU) - many critical services use UDP and are often overlooked.
- Version detection matters: Use -sV to identify exact service versions for vulnerability assessment.
- Leverage NSE: Use appropriate NSE scripts for deeper reconnaissance and vulnerability detection.
- Scan from multiple locations: For security assessments, scan from both internal and external perspectives.
- Regular scanning schedule: Establish regular scanning schedules for continuous security monitoring.
- Compare results over time: Use tools like ndiff to compare scan results and identify changes in network infrastructure.
Security Assessment Workflow
- Phase 1 - Discovery: Identify live hosts (nmap -sn network/24)
- Phase 2 - Quick Scan: Fast port scan (nmap -T4 --top-ports 1000 targets)
- Phase 3 - Comprehensive: Full port scan on interesting hosts (nmap -p- targets)
- Phase 4 - Service Detection: Identify versions (nmap -sV -p <discovered ports> targets)
- Phase 5 - OS Detection: Identify operating systems (nmap -O targets)
- Phase 6 - Vulnerability Scanning: Run vuln scripts (nmap --script=vuln targets)
- Phase 7 - Deep Dive: Run specific NSE scripts based on services found
- Phase 8 - Documentation: Compile results, analyze findings, create remediation plan
Common Use Cases
Quick Network Inventory
$ sudo nmap -sn -n 192.168.1.0/24 -oG - | grep "Up" | cut -d' ' -f2 > live_hosts.txt$ sudo nmap -iL live_hosts.txt -T4 --top-ports 100 -oA network_inventory
Two-phase approach: First, discover all live hosts and save IPs to a file. Second, perform a quick port scan on only the live hosts. This is much faster than scanning all 256 addresses.
Web Server Security Audit
$ sudo nmap -p 80,443,8080,8443 -sV --script=http-enum,http-headers,http-methods,http-security-headers,ssl-cert,ssl-enum-ciphers webserver.example.com
Comprehensive web server scan checking HTTP/HTTPS ports, enumerating directories, examining HTTP headers, testing HTTP methods, checking SSL certificates, and enumerating supported ciphers.
Database Server Check
$ sudo nmap -p 1433,3306,5432,27017 -sV --script=mysql-info,mysql-users,ms-sql-info,mongodb-info db-server.local
Scan common database ports (MSSQL, MySQL, PostgreSQL, MongoDB) and run database-specific NSE scripts to gather information about configurations and users.
Firewall Rule Testing
$ sudo nmap -sA -p 80,443 firewall-protected-host.com
TCP ACK scan to determine which ports are filtered by a firewall. ACK packets should generate RST responses from unfiltered ports and no response or ICMP unreachable from filtered ports.
Troubleshooting and Common Issues
Issue: "You requested a scan type which requires root privileges"
Solution: Many scan types (-sS, -sU, -O, etc.) require raw packet manipulation and need root/sudo access. Either use sudo or switch to -sT (TCP connect scan) which works without root but is slower and more detectable.
Issue: All ports show as "filtered"
Possible causes: (1) Host is behind a firewall dropping packets, (2) Host is actually down and -Pn was used, (3) Network path blocks your probes. Solutions: Try different scan types (-sT, -sA), verify host is actually up, check if your network allows outbound scanning, try scanning from different source IP.
Issue: UDP scan taking forever
This is normal behavior. UDP scans are inherently slow due to ICMP rate limiting and timeout requirements. Solutions: Only scan specific UDP ports (-p 53,161,500), increase parallelism (--min-parallelism), use faster timing (-T4 or -T5), or run multiple targeted scans in parallel.
Issue: Getting different results on repeated scans
Some services are dynamic or load-balanced. Solutions: Use -Pn to ensure host discovery doesn't vary, increase retries (--max-retries 3), use consistent timing templates, check if target has load balancing or dynamic port allocation.
Issue: NSE scripts timing out or failing
Scripts may fail on slow networks or overloaded targets. Solutions: Increase script timeout (--script-timeout 60s), use faster network connection, target fewer hosts simultaneously, check script documentation for specific requirements.
Related Tools and Integration
- ndiff: Compare nmap scans to identify changes over time - included with nmap
- Zenmap: Official GUI for nmap with network topology mapping and result comparison
- ncat: Netcat replacement with SSL, IPv6, SOCKS, and connection brokering
- nping: Packet generation and response analysis tool, like ping on steroids
- Masscan: Ultra-fast port scanner for scanning the entire internet (aggressive alternative to nmap)
- Nessus/OpenVAS: Vulnerability scanners that can import nmap XML results
- Metasploit: Penetration testing framework with nmap database integration (db_nmap)
- Wireshark: Packet analyzer useful for understanding what nmap is doing on the wire
- SIEM platforms: Many can ingest nmap XML for asset discovery and vulnerability correlation
Additional Resources
- Official Documentation: https://nmap.org/book/ (Nmap Network Scanning by Gordon Lyon)
- NSE Script Documentation: https://nmap.org/nsedoc/
- Nmap Mailing Lists: dev@nmap.org and nmap-hackers for technical discussions
- Legal Test Target: scanme.nmap.org (explicitly authorized for testing)
- Nmap GitHub: https://github.com/nmap/nmap (source code, issue tracking)
- Man Page: man nmap (comprehensive reference always available locally)