Nmap Commands: The Complete A–Z Guide to Network Reconnaissance
Master host discovery, port scanning, service detection, OS fingerprinting, NSE scripting, firewall evasion, and output automation — with 100+ copy-paste commands, hands-on labs, comparison tables, and 45+ FAQs.
100+ Commands45+ FAQs20+ Tables10 Labs15+ Sources⚡ 60-Second Summary
Nmap (Network Mapper) is a free, open-source tool created by Gordon Lyon (Fyodor) in 1997 for network discovery and security auditing. It sends crafted packets to hosts and analyzes the responses to reveal which machines are alive, which ports are open, which services and versions run on them, and even which operating system is in use.
- Host discovery: find live hosts on a network (
nmap -sn 192.168.1.0/24) - Port scanning: find open ports (
nmap -p- target) - Service detection: identify services and versions (
nmap -sV target) - OS detection: fingerprint the operating system (
nmap -O target) - Scripting: automate checks with NSE (
nmap -sC target)
Remember one command first: nmap -sV --top-ports 1000 <target> — it gives you live hosts, open ports, and service versions in a single pass.
Quick Answer: What Are Nmap Commands?
Nmap commands are command-line instructions used with the Network Mapper (Nmap) tool to discover hosts, scan ports, identify services, detect operating systems, and perform authorized security assessments. Nmap is widely used by network administrators and penetration testers for network inventory, security auditing, and troubleshooting.
Syntax:nmap [scan type] [options] <target>— for example,nmap -sS -sV 192.168.1.10performs a SYN scan with service version detection.
Featured Snippet Answers
Short, extractable answers designed for answer engines. Each is written to be quoted directly by Google, ChatGPT, Gemini, Claude, Perplexity, and Copilot.
What is Nmap?
Nmap (Network Mapper) is a free, open-source utility for network discovery and security auditing. It detects live hosts, open ports, running services and versions, operating systems, and can run scripted checks via the Nmap Scripting Engine (NSE). Created by Gordon Lyon (Fyodor) and first released in 1997, it is available for Windows, Linux, and macOS at nmap.org.
Is Nmap free?
Yes. Nmap is free and open-source software distributed under its own Nmap Public Source License (NPSL), a GPL-compatible license. The installer, source code, Zenmap GUI, Ncat, Nping, and Ndiff are all included free of charge.
Is Nmap legal?
Nmap itself is legal software used by network administrators, security teams, and penetration testers worldwide. However, how you use it matters: scanning systems you own or have explicit written authorization to test is legal; scanning systems you do not own may violate computer-misuse laws (such as the U.S. CFAA) and a provider’s terms of service. Always obtain authorization before scanning.
Why do ethical hackers use Nmap?
Ethical hackers use Nmap during the reconnaissance phase to build an accurate map of the target environment: which hosts are alive, which ports are open, which services and versions are exposed, and which operating systems are in use. This information guides vulnerability identification, prioritization, and exploitation planning — all within an authorized scope.
What is the most common Nmap command?
The most common Nmap command is nmap <target>, which performs a default scan: host discovery, SYN scan of the 1,000 most common TCP ports (or connect scan if not run as root), and service fingerprinting heuristics. A widely used practical variant is nmap -sV -sC <target>, which adds version detection and default NSE scripts.
Does Nmap detect vulnerabilities?
Nmap is primarily a discovery tool, but the Nmap Scripting Engine includes a vuln script category (e.g., vulners, vuln checks) that can test for known vulnerabilities. For full vulnerability assessment, Nmap results are typically combined with dedicated scanners such as OpenVAS, Nessus, or Nikto.
Beginner’s Guide to Nmap
What Is Port Scanning?
A port is a numbered logical endpoint (0–65535) that a service listens on — SSH on 22, HTTP on 80, HTTPS on 443, RDP on 3389. Port scanning is the process of sending packets to many ports on a host and observing how the host responds, to determine which ports are open (a service is accepting connections), closed (reachable but nothing is listening), or filtered (a firewall or packet filter is blocking probes).
Nmap’s philosophy is simple: the set of open ports on a host is its attack surface. Fewer open ports means fewer ways in; every open port is a potential entry point that needs identification, version checking, and hardening.
TCP vs UDP
| Property | TCP | UDP |
|---|---|---|
| Connection | Connection-oriented (handshake) | Connectionless (fire-and-forget) |
| Reliability | Guaranteed delivery, ordering | No guarantee, no ordering |
| Common services | HTTP, HTTPS, SSH, FTP, SMTP, RDP | DNS, DHCP, SNMP, NTP, TFTP, Syslog |
| Scanning difficulty | Easy — open ports reply to probes | Hard — no response is the norm, slow and rate-limited |
| Nmap flag | -sS (SYN) or -sT (connect) | -sU |
-p U:53,161,123,500) and use --max-retries 1 to speed them up.The TCP Three-Way Handshake
TCP connections start with a three-way handshake. Understanding it is essential because Nmap’s most famous scan type, the SYN scan (-sS), exploits exactly this process — and never completes it.
- SYN: the client sends a packet with the SYN flag set, asking to open a connection.
- SYN-ACK: if a service is listening, the server replies with SYN-ACK. If nothing is listening, the server sends RST (connection refused).
- ACK: the client acknowledges and the connection is established.
How -sS works: Nmap sends a SYN packet and watches the reply. SYN-ACK → port open; RST → port closed; nothing or ICMP unreachable → filtered. Because the handshake is never completed, it is fast, stealthy, and leaves no connection in server logs — which is why it is the default scan type for privileged users.
Why Reconnaissance Matters
Every penetration test begins with reconnaissance. In the MITRE ATT&CK framework, Reconnaissance (TA0043) is the first tactic, and Active Scanning (T1595) is its key technique. Attackers follow the same pattern: discover the network, enumerate services, fingerprint versions, then match findings to known exploits. If you never map your own attack surface, you cannot defend it — attackers will map it for you.
When to Use Nmap
✔ Do use Nmap
- Inventorying devices on your own network
- Auditing services before deployment
- Validating firewall changes
- Authorized penetration tests and red-team exercises
- Verifying that exposed services match your security policy
✘ Don’t use Nmap
- Against systems without explicit authorization
- On production networks with aggressive timing (-T5) without approval
- As a substitute for a proper vulnerability scanner
- Without saving output for audit trails and reports
Step-by-Step Installation Guide
Windows
- Download the installer from nmap.org/download.html (stable installer includes Zenmap GUI and Npcap).
- Run the installer. Accept the license, then choose “Install Npcap” when prompted — raw-packet scanning (-sS, -O, -sU) requires Npcap.
- Check “Add Nmap to PATH” during installation to run it from any terminal.
Linux
Nmap is packaged in every major distribution. Use your package manager:
sudo apt update && sudo apt install -y nmap
sudo dnf install -y nmap
sudo pacman -S nmap
sudo zypper install nmap
macOS
brew install nmap
Alternatively, download the official macOS installer (.dmg) from nmap.org — it does not require Homebrew.
Verify the Installation
nmap --version # Nmap version 7.95 ( https://nmap.org ) # Platform: x86_64-pc-linux-gnu # Compiled with: liblua-5.4.5 openssl-3.0.13 ...
The latest stable release is the 7.9x series — check nmap.org for the current version. A quick smoke test against your own loopback interface confirms everything works:
nmap -sT -p 22,80,443 127.0.0.1
Troubleshooting Common Installation Issues
| Symptom | Cause | Fix |
|---|---|---|
You requested a scan type which requires root privileges | -sS, -O, -sU need raw sockets | Re-run with sudo or use -sT (connect scan) without root |
Failed to resolve "hostname" | DNS cannot resolve the target | Use the IP address directly, add -n to skip DNS, or check your DNS config |
Warning: Nmap found no open ports | Host is up but all ports are filtered/closed, or a firewall drops probes | Try -Pn, add -sV, scan UDP, or check whether ICMP is blocked |
| Nmap not found after Windows install | PATH not updated | Reinstall with “Add to PATH” checked, or run from C:\Program Files (x86)\Nmap\ |
| Raw scans fail on Windows (“Npcap not installed”) | Npcap missing or not started | Install/repair Npcap; start the “Npcap” service; use -sT as a fallback |
| Very slow scans | Default Polite timing or high retries | Use -T4, --top-ports 1000, and --max-retries 2 |
Complete Nmap Command Reference
All commands below follow the general syntax nmap [scan type] [options] <target>. Replace <target> with an IP, hostname, range (192.168.1.1-50), CIDR (192.168.1.0/24), or a file of targets (-iL targets.txt).
6.1 Host Discovery (Finding Live Hosts)
| Command | Purpose | Example |
|---|---|---|
-sn | Ping scan — list live hosts without port scanning | nmap -sn 192.168.1.0/24 |
-PS | TCP SYN ping (default ports 80,443; custom with -PS22,80) | nmap -sn -PS22,80 10.0.0.0/24 |
-PA | TCP ACK ping — works through stateless firewalls | nmap -sn -PA 10.0.0.0/24 |
-PU | UDP ping (e.g., -PU53 uses DNS) | nmap -sn -PU53 10.0.0.0/24 |
-PE / -PP / -PM | ICMP echo / timestamp / netmask request pings | nmap -sn -PE 10.0.0.0/24 |
-PR | ARP ping — fastest option on a local subnet | nmap -sn -PR 192.168.1.0/24 |
-Pn | Treat all hosts as up; skip host discovery entirely | nmap -Pn -sV 10.0.0.5 |
-n | Never do DNS resolution (faster, less noisy) | nmap -sn -n 10.0.0.0/24 |
-R | Always resolve DNS names | nmap -sn -R 10.0.0.0/24 |
-sL | List scan — DNS-resolve targets, show no other output | nmap -sL -iL targets.txt |
-iL | Read targets from a file (one per line) | nmap -sn -iL hosts.txt |
--exclude | Exclude hosts from a scan | nmap -sn 10.0.0.0/24 --exclude 10.0.0.1 |
-PR) is the most reliable and fastest host-discovery method. Over the internet, combine -PS443, -PA80, and -PE because many hosts ignore ICMP.6.2 Port Scanning
| Command | Purpose | Example |
|---|---|---|
-sS | SYN “half-open” scan (default as root; fast, stealthy) | nmap -sS 192.168.1.10 |
-sT | TCP connect scan (default without root; completes handshakes) | nmap -sT 192.168.1.10 |
-sU | UDP scan — pairs with TCP scans | nmap -sU -p 53,123,161 192.168.1.10 |
-sA | ACK scan — maps firewall rules, never detects open ports | nmap -sA 192.168.1.10 |
-sW | Window scan — TCP window size reveals open/filtered state | nmap -sW 192.168.1.10 |
-sF / -sX / -sN | FIN / Xmas / Null scans — evade simple packet filters | nmap -sF 192.168.1.10 |
-sM | Maimon scan (FIN/ACK probe) | nmap -sM 192.168.1.10 |
-p | Scan specific ports; ranges; protocols | nmap -p 22,80,443,8080-8090 10.0.0.5 |
-p- | Scan all 65,535 TCP ports | nmap -p- -T4 10.0.0.5 |
-p U:<ports> | Scan UDP ports alongside TCP | nmap -sS -sU -p U:53,161,T:22,80 10.0.0.5 |
--top-ports <n> | Scan the n most common ports | nmap --top-ports 200 10.0.0.5 |
-F | Fast mode — top 100 ports only | nmap -F 10.0.0.5 |
-r | Scan ports sequentially instead of randomly | nmap -r -p 1-1000 10.0.0.5 |
--exclude-ports | Skip specific ports | nmap --exclude-ports 80,443 10.0.0.5 |
-T4 --min-rate 1000 on your own infrastructure, or start with --top-ports 1000 and expand only if needed.6.3 Service Detection
| Command | Purpose | Example |
|---|---|---|
-sV | Version detection — identify services and versions | nmap -sV 10.0.0.5 |
-sV --version-intensity <0-9> | Control probe aggressiveness (default 7) | nmap -sV --version-intensity 9 10.0.0.5 |
--version-light | Faster, less thorough version detection (intensity 2) | nmap -sV --version-light 10.0.0.5 |
--version-all | Maximum probes (intensity 9) for stubborn services | nmap -sV --version-all 10.0.0.5 |
--version-trace | Show all version-detection probe activity (debugging) | nmap -sV --version-trace 10.0.0.5 |
-sV -p <ports> | Version-scan only specific ports | nmap -sV -p 22,80,443 10.0.0.5 |
--script=banner | Grab raw banners from services | nmap --script=banner -p 21,25,80 10.0.0.5 |
6.4 OS Detection
| Command | Purpose | Example |
|---|---|---|
-O | OS fingerprinting via TCP/IP stack analysis (root) | nmap -O 10.0.0.5 |
-O --osscan-guess | Guess OS aggressively when fingerprint is inconclusive | nmap -O --osscan-guess 10.0.0.5 |
--max-os-tries <n> | Limit OS detection retries | nmap -O --max-os-tries 1 10.0.0.5 |
-A | Aggressive: OS detection + version + scripts + traceroute | nmap -A 10.0.0.5 |
--traceroute | Trace the network path to the target | nmap --traceroute 10.0.0.5 |
-6 | Enable IPv6 scanning | nmap -6 -sV fe80::1 |
--script=os-discovery (SNMP-based, non-intrusive) or banner analysis over raw -O fingerprinting.6.5 NSE Scripts (Nmap Scripting Engine)
| Command | Purpose | Example |
|---|---|---|
-sC | Run default script category (safe, useful checks) | nmap -sC 10.0.0.5 |
--script=<cat> | Run a category: auth, broadcast, default, discovery, dos, exploit, external, fuzzer, intrusive, malware, safe, version, vuln | nmap --script=safe 10.0.0.5 |
--script=<name> | Run one specific script | nmap --script=http-title 10.0.0.5 |
--script=<a,b> | Run multiple scripts | nmap --script=http-title,ssl-cert 10.0.0.5 |
--script-args | Pass arguments to scripts | nmap --script=http-brute --script-args userdb=users.txt 10.0.0.5 |
--script-help | Show help for a script | nmap --script-help=http-title |
--script-updatedb | Rebuild the NSE script database | nmap --script-updatedb |
--script=http-enum | Enumerate web directories/files | nmap --script=http-enum 10.0.0.5 |
--script=vulners | Cross-reference versions against the Vulners CVE database | nmap -sV --script=vulners 10.0.0.5 |
--script=dns-zone-transfer | Attempt DNS zone transfer | nmap --script=dns-zone-transfer --script-args dns-zone-transfer.domain=example.com |
--script=smb-enum-shares | Enumerate SMB shares | nmap --script=smb-enum-shares 10.0.0.5 |
--script=ssh2-enum-algos | Enumerate SSH algorithms (weak crypto check) | nmap --script=ssh2-enum-algos 10.0.0.5 |
exploit, dos, fuzzer, and intrusive can crash services, lock accounts, or trigger alerts. Only run them on systems you own, and never mix dos scripts into routine scans.6.6 Firewall Evasion & Stealth
| Command | Purpose | Example |
|---|---|---|
-f | Fragment packets (8 bytes) to evade simple filters | nmap -f 10.0.0.5 |
--mtu <n> | Custom fragment size (multiple of 8) | nmap --mtu 16 10.0.0.5 |
-D <decoy1,decoy2,...> | Cloak the scan with decoy source addresses | nmap -D 10.0.0.1,10.0.0.2,ME 10.0.0.5 |
--source-port <n> / -g | Scan from a specific source port (e.g., 53) | nmap --source-port 53 10.0.0.5 |
--data-length <n> | Append random data to packets | nmap --data-length 64 10.0.0.5 |
--ttl <n> | Set a custom IP TTL | nmap --ttl 128 10.0.0.5 |
--spoof-mac <mac> | Spoof the MAC address (0 = random) | nmap --spoof-mac 0 10.0.0.5 |
--proxies <urls> | Route scans through HTTP/SOCKS proxies | nmap --proxies http://proxy:8080 10.0.0.5 |
-sI <zombie> | Idle (zombie) scan — extremely stealthy, complex | nmap -sI 10.0.0.7 10.0.0.5 |
-b <ftp> | FTP bounce scan through an open FTP server | nmap -b [email protected] 10.0.0.5 |
--scanflags | Send custom TCP flag combinations | nmap --scanflags SYNURG 10.0.0.5 |
--randomize-hosts | Scan targets in random order | nmap --randomize-hosts 10.0.0.0/24 |
6.7 Output Options
| Command | Purpose | Example |
|---|---|---|
-oN <file> | Normal, human-readable output to file | nmap -oN scan.txt 10.0.0.5 |
-oX <file> | XML output (feeds other tools, ticketing) | nmap -oX scan.xml 10.0.0.5 |
-oG <file> | Grepable output (legacy scripting) | nmap -oG scan.gnmap 10.0.0.5 |
-oA <base> | All three formats at once (normal, XML, grepable) | nmap -oA lab-scan 10.0.0.0/24 |
-v / -vv | Verbose / extra verbose output | nmap -vv 10.0.0.5 |
-d / -dd | Debug output for troubleshooting | nmap -dd 10.0.0.5 |
--reason | Show why each port is in its state | nmap --reason 10.0.0.5 |
--stats-every <t> | Print periodic progress statistics | nmap --stats-every 30s 10.0.0.0/24 |
--open | Show only open ports in results | nmap --open 10.0.0.5 |
--resume <file> | Resume an interrupted scan from a logfile | nmap --resume scan.gnmap |
6.8 Timing & Performance Templates
| Template | Name | Use case |
|---|---|---|
-T0 | Paranoid | Extreme IDS evasion — one probe at a time, minutes between probes |
-T1 | Sneaky | Stealthy scans, ~15s between probes |
-T2 | Polite | Slower than normal; reduces load on the target |
-T3 | Normal | Default; parallel probes with timeouts |
-T4 | Aggressive | Fast scans on reliable networks — the standard for pentesting labs |
-T5 | Insane | Maximum speed; may miss ports and cause packet loss |
| Command | Purpose | Example |
|---|---|---|
--min-rate / --max-rate | Cap or floor packets per second | nmap --min-rate 1000 10.0.0.5 |
--host-timeout <t> | Give up on slow hosts after time | nmap --host-timeout 10m 10.0.0.0/24 |
--max-retries <n> | Limit retransmissions to speed up scans | nmap --max-retries 1 10.0.0.5 |
--min-parallelism | Force a minimum number of parallel probes | nmap --min-parallelism 50 10.0.0.5 |
--scan-delay <t> | Delay between probes (evasion) | nmap --scan-delay 5s 10.0.0.5 |
nmap -sS -sV -T4 --top-ports 1000 --max-retries 2 --open <target> — fast, thorough, and readable in one line.Practical Lab Tutorials (Run on Systems You Own)
These labs are designed for your own test network — a home router, a spare laptop, a lab VM (VirtualBox/VMware), or a cloud instance you control. Every command below is safe when scoped to your own assets.
Lab 1 — Discover Live Hosts on Your Test Subnet
Goal: build an inventory of every device on your lab network.
nmap -sn -PR 192.168.1.0/24
Nmap scan report for 192.168.1.1
Host is up (0.0012s latency).
Nmap scan report for 192.168.1.10
Host is up (0.0008s latency).
Nmap scan report for 192.168.1.20
Host is up (0.0015s latency).
# Nmap done: 256 IP addresses (3 hosts up) scanned in 2.31 secondsInterpretation: three hosts answered. Note that ARP-only discovery will miss devices that ignore ARP — repeat with -sn -PS22,80,443 -PE to cross-check. Compare results against your router’s DHCP lease table to spot unknown devices (a rogue-AP or BYOD check).
Lab 2 — Identify Open Services on a Lab Machine
Goal: enumerate exactly which services a lab VM exposes and their versions.
nmap -sS -sV -T4 --top-ports 1000 192.168.1.10
PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 9.6p1 Ubuntu 3ubuntu13 80/tcp open http Apache httpd 2.4.58 443/tcp open ssl/http Apache httpd 2.4.58 3306/tcp open mysql MySQL 8.0.36-0ubuntu0.22.04.1 MAC Address: 08:00:27:5B:1F:3A (Oracle VirtualBox)
Interpretation: the version strings (OpenSSH 9.6p1, Apache 2.4.58, MySQL 8.0.36) are your attack-surface summary. Research each one for known CVEs (NVD, CISA KEV catalog) and verify the running version matches your patch baseline.
Lab 3 — Detect Operating Systems
Goal: fingerprint the OS of a lab host using TCP/IP stack analysis.
sudo nmap -O 192.168.1.10
OS details: Linux 4.15 - 5.8 Network Distance: 1 hop
Interpretation: Nmap reports a fingerprint match range rather than an exact version. A broad match means the host sits behind a NAT, a firewall, or a virtualized stack that normalizes packets. Combine -O with --script=os-discovery (SNMP) and banner analysis for confirmation.
Lab 4 — Run Safe NSE Scripts
Goal: automate standard checks using only the safe script category.
nmap -sV --script=safe 192.168.1.10
nmap --script=http-title,http-headers -p 80,443 192.168.1.10 nmap --script=ssl-cert,ssl-enum-ciphers -p 443 192.168.1.10 nmap --script=ssh2-enum-algos -p 22 192.168.1.10
Interpretation: ssl-enum-ciphers reports weak ciphers and protocol versions (e.g., TLS 1.0); ssh2-enum-algos reveals weak key-exchange algorithms. These are the exact findings you would escalate into hardening recommendations.
-oA lab-name, and document what you changed. Repeatable, documented labs are what make real training portfolios — not screenshots of other people’s scans.Real Use Cases
Use Case 1 — Auditing a Small Office Network
Goal: produce a current inventory of every device and exposed service on a 200-device office network.
Approach: run an ARP-based host discovery, then a top-1000 service scan against live hosts, saving all formats.
nmap -sn -PR -oN hosts-up.txt 192.168.1.0/24 nmap -sS -sV -T4 --top-ports 1000 -iL hosts-up.txt -oA office-audit --open
Expected output / interpretation: a matrix of hosts × open ports. Flag anything not in the known-asset list, any unexpected service (e.g., a telnet listener), and every service whose version is older than the vendor’s current release.
Use Case 2 — Verifying Exposed Services Before Deployment
Goal: confirm that a new web server exposes only ports 80/443 to the internet and nothing else.
Approach: full TCP scan from an external vantage point (a cloud VM in a different region).
nmap -Pn -p- -T4 --min-rate 2000 --open 203.0.113.25
Interpretation: only 80/tcp and 443/tcp should appear. Any other open port means a security-group or firewall rule is wrong. This is the classic pre-deployment checklist step that prevents “the database was exposed for three months” incidents.
Use Case 3 — Checking Firewall Rules After Changes
Goal: verify that newly applied firewall rules actually block the ports they claim to block.
Approach: run an ACK scan (-sA) to map filter rules, then a SYN scan to confirm what passes.
nmap -sA -p 1-1000 --reason 10.0.0.1 nmap -sS -p 1-1000 --reason 10.0.0.1
Interpretation: unfiltered (ACK scan) means the firewall is not filtering that port; filtered means it is dropping probes. Comparing the two scans shows exactly where rules do and do not apply — before an attacker finds out for you.
Use Case 4 — Maintaining an Active Device Inventory
Goal: keep a weekly, scriptable record of every device and service on the network for asset management and compliance.
Approach: schedule the scan with cron (Linux) or Task Scheduler (Windows) and store XML output for your SIEM or CMDB.
0 2 * * 0 nmap -sn -PR 192.168.1.0/24 -oX /var/log/nmap/hosts-$(date +\%F).xml
Interpretation: diffing weekly XML reports (ndiff is built for exactly this) surfaces new devices, removed devices, and port changes — the raw material for change management and incident response.
Case Studies from Training Environments
Training Exercise: Reconnaissance-to-Inventory on an Isolated Lab Network
Context. During a student lab, participants were tasked with identifying active hosts on an isolated training network and producing a documented asset inventory. No production systems were involved; every target was a lab VM under the training organization’s control.
Approach. Students combined ARP host discovery (nmap -sn -PR) with service and version detection (nmap -sV) against the live hosts, then saved results with -oA and compared them against the expected inventory provided by the instructor.
Findings. The exercise consistently demonstrated three lessons: (1) ARP discovery alone misses hosts that ignore ARP — cross-checking with TCP/ICMP pings changed the host count; (2) version strings that look identical in a banner can differ in real patch level, which is why --script=vulners follow-ups were required; (3) hosts that appear “up” but show no open ports are usually filtering devices or firewalls, not dead endpoints.
Outcome. Every participant produced a scan-to-report workflow: live-host list → open-port matrix → service/version table → risk notes → remediation suggestions. The exercise showed how structured scanning directly supports asset management and security validation — and how easily a noisy, unordered scan fails to do so.
Generic training illustration. For publication, replace with your own dates, screenshots, participant counts, and real results.
The A7 Recon Framework
Our training methodology for teaching network reconnaissance in a disciplined, repeatable way:
A — Assess
- Define scope: list target IPs, domains, and exclusions in writing.
- Obtain authorization: written permission, including testing window and rules of engagement.
- Set expectations: agree on scan intensity, timing templates, and which scripts are allowed.
7 — The Seven Phases
Phases 1–2 · Discovery
nmap -sn -PR → live hosts; then -p- --min-rate 2000 for full port coverage. Deliverable: host × port matrix.
Phases 3–4 · Identification
-sV for versions, -O (or SNMP/banner heuristics) for OS. Deliverable: service/version table.
Phase 5 · Enumeration
--script=safe first, then targeted scripts per service (http-enum, smb-enum-shares, ssl-enum-ciphers).
Phases 6–7 · Assess & Report
Map findings to CVEs and the CISA KEV catalog; score with CVSS; write findings with evidence, impact, and remediation.
How students apply it: every A7 lab must end with a one-page report containing scope, commands used, raw output, interpretation, and a risk table. This forces the habit professionals need: the scan is only as valuable as the report that explains it.
Expert Commentary: A7 Security Hunters’ Perspective
“In training environments, we encourage students to understand why a scan is being performed before choosing command options. Interpreting results accurately is often more valuable than running additional scans. A student who can explain why a port shows
filteredunderstands more than one who simply collected a longer open-port list.”— A7 Security Hunters, training team
Read output, not just ports
State (open/closed/filtered) plus --reason tells you why — firewall rule, host down, or service crash. Always scan with --reason in learning labs.
Speed is the last variable
Only raise timing after you understand the network. -T4 on a slow link or old firewall creates false negatives that look like “no vulnerabilities”.
Documentation is the deliverable
A scan without saved output (-oA) and a written interpretation is not an assessment — it is noise. Reports are what clients, auditors, and courts read.
Research & Industry Statistics (2025 Reports)
Reconnaissance and vulnerability discovery sit at the start of almost every attack chain. These verified figures from the 2025 editions of the major industry reports explain why network mapping matters.
What This Means for Network Reconnaissance
- Vulnerability exploitation is a top-2 initial access vector. Attackers are finding exposed services faster than teams patch them. Nmap-style discovery is the same technique defenders must use to find their own exposed services first (Verizon DBIR 2025).
- Perimeter devices are the new bullseye. Edge devices and VPNs grew from 3% to 22% of vulnerability-exploitation targets — nearly an eightfold increase. Auditing every internet-facing port is no longer optional (Verizon DBIR 2025).
- Human element still dominates. Human involvement appeared in roughly 60% of breaches, underscoring that technical scans complement — never replace — awareness and process controls (Verizon DBIR 2025).
- Automation pays. Organizations using AI and automation extensively averaged $3.62M per breach versus $5.52M for those that did not — a $1.9M gap that makes automated, scheduled scanning and triage a direct cost-saver (IBM 2025).
Tool Comparisons
Nmap vs Masscan vs RustScan
| Feature | Nmap | Masscan | RustScan |
|---|---|---|---|
| Speed | High | Very High (up to ~10M pps) | Very High (Rust) |
| Service Detection | Yes (-sV) | Limited | No (delegates to Nmap) |
| NSE Scripts | Yes | No | No (pipes to Nmap) |
| OS Detection | Yes (-O) | No | No |
| Best For | General-purpose scanning and auditing | Massive internet-wide port discovery | Fast initial discovery that hands off to Nmap |
When to use which: Nmap is the daily workhorse for authorized assessments. Masscan (by Robert Graham) is for internet-wide or /0-scale sweeps where raw speed matters more than detail. RustScan gives near-instant port lists on big ranges and automatically invokes Nmap on open ports for follow-up.
Nmap vs Netcat vs Nping
| Feature | Nmap | Netcat (nc/ncat) | Nping |
|---|---|---|---|
| Port scanning | Full suite of techniques | Manual, one port at a time | No (raw packet tool) |
| Banner grabbing | Yes (via NSE banner) | Yes — classic nc host port | No |
| Packet crafting | Limited | No | Yes (ARP, ICMP, TCP, UDP) |
| Best For | Systematic assessments | Quick manual checks, debugging, file transfer | Latency measurement, packet tests |
Scan Type Comparison
| Scan | Flag | Root? | Stealth | Detects open ports | Best for |
|---|---|---|---|---|---|
| SYN | -sS | Yes | High (no full handshake) | Yes | Default choice for most scans |
| Connect | -sT | No | Low (completes handshake) | Yes | Non-root users, Windows |
| UDP | -sU | Yes | Medium | Yes | DNS/SNMP/NTP services |
| ACK | -sA | Yes | High | No (maps filters) | Firewall rule discovery |
| FIN/Xmas/NULL | -sF/-sX/-sN | Yes | High | Partially | Evading stateless filters (mostly legacy) |
| Idle | -sI | Yes | Very high | Yes | Zombie-based stealth (complex, rare) |
NSE Script Categories at a Glance
| Category | What it does | Safety |
|---|---|---|
safe | Non-intrusive checks (banners, TLS config, titles) | Safe on production |
default (-sC) | Common useful checks, all safe | Safe |
discovery | Directory, share, and host discovery | Mostly safe |
auth | Authentication bypass / credential checks | Can lock accounts |
vuln | Known-vulnerability checks (e.g., vulners) | Generally safe, noisy |
intrusive | Aggressive probes, brute force, exploitation | Lab only |
exploit | Actual exploitation attempts | Lab only |
dos | Denial-of-service testing | NEVER on production |
fuzzer | Protocol fuzzing | NEVER on production |
malware | Malware/backdoor detection | Generally safe |
Frequently Asked Questions (45+ Answers)
Is Nmap safe to use?
Yes — Nmap is safe software. What matters is scope: scanning your own or authorized systems is safe and standard practice; scanning others can be illegal and will likely be detected by their defenses.
Does Nmap detect vulnerabilities?
Directly, no — but its NSE vuln category (e.g., vulners) can flag known CVEs matching detected versions. It is discovery-first; pair it with a dedicated scanner for full coverage.
Can Nmap scan IPv6 networks?
Yes, with the -6 flag: nmap -6 -sV fe80::1%eth0. Remember that IPv6 address space is so large that host discovery differs fundamentally from IPv4.
What does -sS do?
-sS performs a SYN (half-open) scan: it sends SYN packets and never completes the handshake, so open ports are identified without a full TCP connection. Requires root privileges.
What is the difference between -sS and -sT?
-sS (SYN scan) is faster and stealthier but needs root; -sT (connect scan) completes full TCP handshakes, works as a normal user, and is the default without privileges.
What is the default Nmap scan?
nmap <target> performs host discovery, then scans the 1,000 most common TCP ports — SYN scan if run as root, connect scan otherwise — plus light service identification.
Does Nmap need root?
Only for raw-packet scans: -sS, -sU, -O, -sA, and the stealth scan types. As a normal user, connect scans (-sT) and most NSE scripts still work.
What do open, closed, and filtered mean?
Open: a service is listening. Closed: reachable but nothing is listening. Filtered: a firewall or filter dropped the probe, so Nmap cannot determine the state.
Why does Nmap show “filtered” for most ports?
Typically a host firewall, cloud security group, or ISP is dropping your packets. Try -Pn if the host is up, and remember that “filtered” is itself useful intelligence about the perimeter.
What is the fastest way to scan all 65,535 ports?
nmap -p- -T4 --min-rate 2000 <target>. On reliable networks this finishes in minutes. Add --max-retries 1 if the target drops packets.
Is Nmap detectable?
Yes. Default scans are trivially detectable by IDS/IPS; even decoys (-D) and fragmentation (-f) are often flagged by modern defenses. Detection is not a reason to skip authorization.
What is the Nmap Scripting Engine (NSE)?
NSE is Nmap’s built-in scripting engine that runs Lua scripts for detection, enumeration, vulnerability checks, and exploitation. Scripts are organized into categories like safe, vuln, auth, and discovery.
How do I run Nmap scripts?
Use --script=CATEGORY or --script=SCRIPTNAME, e.g., nmap --script=http-title 10.0.0.5. The -sC flag runs the default category.
What is -A in Nmap?
-A enables aggressive mode: OS detection (-O), version detection (-sV), default scripts (-sC), and traceroute — all in one command.
What is Zenmap?
Zenmap is Nmap’s official GUI, included in Windows/macOS installers. It offers point-and-click scanning, profile presets, and a topology view, and it runs the exact same Nmap engine underneath.
How do I scan a range of IPs?
Use CIDR (10.0.0.0/24), dash ranges (10.0.0.1-50), or a mix: nmap 10.0.0.1-50 10.0.1.1-20. A file list works too: nmap -iL targets.txt.
How do I scan a single port?
nmap -p 443 10.0.0.5. Combine ranges and protocols: -p 22,80,443,8000-9000 or -p U:53,T:80.
What is the -Pn flag?
-Pn skips host discovery and treats every target as up. Use it when ICMP and TCP pings are blocked — common for internet-facing hosts behind firewalls.
What is the difference between -sn and -Pn?
-sn does host discovery only (no port scan). -Pn skips host discovery and goes straight to port scanning every target. They are opposites in purpose.
How do I save Nmap output?
Use -oN file.txt (normal), -oX file.xml (XML), -oG file.gnmap (grepable), or -oA base for all three at once.
How do I convert Nmap XML to HTML?
Use the bundled xsltproc style: xsltproc nmap.xsl scan.xml -o scan.html, or tools like nmaptocsv and nmap2csv for spreadsheet output.
What is Npcap and why does Nmap need it on Windows?
Npcap is the Windows packet-capture driver Nmap uses for raw-packet scans. Without it, only TCP connect scans and DNS lookups work.
Can Nmap scan my own computer?
Yes — nmap 127.0.0.1 or nmap localhost is a great first test. Expect to see loopback-only services and your host firewall filtering the rest.
What is an idle scan (-sI)?
An extremely stealthy scan that bounces probes off a “zombie” host with a predictable IP ID sequence, hiding the real source. Complex and often impractical today, but a classic technique.
What is the difference between -T4 and -T5?
-T4 (Aggressive) is fast yet reliable for most networks. -T5 (Insane) maximizes speed but can drop probes, create false negatives, and trip detection — use sparingly.
How does Nmap determine the OS?
-O sends a series of specially crafted TCP/UDP/ICMP probes and compares subtle differences in the replies (TTL, window size, options, fragment handling) against a fingerprint database.
Why is my OS detection inaccurate?
NAT devices, load balancers, proxies, and hardened stacks normalize packets, destroying fingerprints. Use --osscan-guess or supplement with banners and SNMP discovery.
What is the -sC flag?
-sC runs Nmap’s default script category — a curated set of safe, useful checks covering TLS, HTTP, SMB, SSH, and more. Identical to --script=default.
What are the best Nmap scripts for web servers?
http-title, http-headers, http-enum, http-methods, ssl-cert, and ssl-enum-ciphers are the standard safe set for -p 80,443.
How do I scan for open UDP services?
nmap -sU -p 53,123,161,500 <target>. Restrict the port list — full UDP scans are slow because open ports rarely reply.
What is the most stealthy Nmap scan?
In practice, a slow SYN scan (-sS -T1) or an idle scan (-sI) is considered stealthiest, but both are still detectable by modern sensors. Low-and-slow with random ordering (--randomize-hosts) helps more than exotic flags.
Can Nmap scan through a firewall?
It can characterize what the firewall allows (-sA maps filters; -Pn handles dropped pings; -f and --source-port 53 bypass simple filters). It cannot bypass a properly configured next-gen firewall.
What is ndiff?
Ndiff is Nmap’s built-in diff tool for comparing scan results (ndiff scan1.xml scan2.xml) — perfect for tracking port and host changes over time.
What is Ncat?
Ncat is Nmap’s modern reimplementation of Netcat, bundled with Nmap. It handles port listening, connecting, proxying, and encrypted channels — a Swiss-army knife for scripting and testing.
Is Nmap available on Kali Linux?
Yes, Nmap is pre-installed on Kali Linux and available via sudo apt install nmap on Debian/Ubuntu derivatives.
How long does a typical scan take?
A top-1000 SYN scan of one host at -T4 takes seconds; a full -p- scan takes minutes; a /24 subnet sweep depends on hosts and timing. Always set --host-timeout for big ranges.
What is the -oA flag?
-oA basename writes normal (.nmap), XML (.xml), and grepable (.gnmap) output files in one run — best practice for audit trails.
Why does Nmap say a port is open but I can’t connect?
The port may be filtered at a different network layer, the service may crash after the probe, or the response was spoofed by an IPS. Re-verify manually with nc -vz host port.
What is the difference between Nmap and a vulnerability scanner?
Nmap maps what is present (hosts, ports, services, OS). Vulnerability scanners (Nessus, OpenVAS, Qualys) map what is vulnerable — matching findings to CVEs and configuration issues. They are complementary.
Can I scan a website domain with Nmap?
Yes: nmap -sV example.com. Note that DNS name resolution and the site’s hosting (shared hosting, CDN, WAF) will strongly influence results — often you are scanning the CDN edge, not the origin.
What is the –reason flag?
--reason prints the exact packet or condition that determined each port’s state (e.g., “syn-ack”, “port-unreachable”, “no-response”), which is invaluable for interpreting filtered ports.
How do I stop a running Nmap scan?
Press Ctrl+C once to print current results, twice to abort. Use --resume scan.gnmap to continue an interrupted scan later.
Does Nmap work on mobile/Android?
There are unofficial Android ports and Termux packages, but official support is for Windows, Linux, macOS, and Unix-like systems. Use a VM or dedicated machine for serious work.
What is the “banner” script used for?
nmap --script=banner -p 21,22,25,80 <target> grabs service banners, which often leak software names and versions useful for identifying outdated services.
Why should I use –top-ports instead of -p-?
--top-ports 1000 covers the ports that matter statistically in minutes, while -p- covers everything but takes far longer. Start common, expand when the assessment requires it.
Common Mistakes (and How to Fix Them)
✓ Fix: get written scope and rules of engagement before every scan.
✓ Fix: run
--reason and combine -sS with -sA to map rules.✓ Fix: use
-Pn and TCP-based pings (-PS443).-T5 --min-rate 10000 can crash fragile devices and trigger WAF/IPS blocks.✓ Fix: start at
-T3/-T4 with --max-rate caps; escalate only with approval.✓ Fix: always append
-oA scan-name.dos and exploit categories can take services down.✓ Fix: default to
safe/default; run intrusive scripts only in isolated labs.✓ Fix: combine
-sS, targeted -sU, and version detection.✓ Fix: summarize hosts, ports, risks, and remediations; keep raw output as an appendix.
Advanced Tips
1 · Master Timing Templates and Rate Limits
Templates (-T0…-T5) are presets; rate limits give precise control. For careful authorized scans, cap bandwidth rather than guessing:
nmap -sS -sV --max-rate 500 --min-rate 100 --host-timeout 20m 10.0.0.0/24
2 · Use NSE Categories Precisely
Run nmap --script-help=categories to list every category. A disciplined flow: safe → default → service-specific (http-*, smb-*, ssl-*) → vuln (via vulners) — never skip straight to intrusive.
3 · Exploit Output Formats for Automation
XML output feeds SIEMs, CMDBs, and custom parsers. A one-line inventory extractor with nmap + standard tools:
nmap -sn -oG - 192.168.1.0/24 | awk '/Up$/{print $2}' > hosts.txt
nmap -sV -iL hosts.txt -oG - | awk '/open/{for(i=4;i<=NF;i++) if($i ~ /open/) print $2","$i}'4 · Performance Tuning for Large Ranges
- Split work:
--max-hostgroup 256and--min-parallelism 64control concurrency. - Pre-filter with
-snbefore full scans so you never port-scan dead IPs. - Use
--host-timeoutso one slow host doesn't stall the sweep. - Consider
masscanfor the initial sweep, then Nmap for detail (see comparisons).
5 · Automate Repeatable Scans
A reusable audit script pattern (Bash) — schedule with cron and archive results:
#!/bin/bash
# Weekly authorized asset audit — A7 Security Hunters
DATE=$(date +%F)
NET="192.168.1.0/24"
nmap -sn -PR "$NET" -oN /var/log/nmap/hosts-$DATE.txt
nmap -sS -sV -T4 --top-ports 1000 -iL /var/log/nmap/hosts-$DATE.txt \
-oA /var/log/nmap/audit-$DATE --open
ndiff /var/log/nmap/audit-$(date -d "7 days ago" +%F).xml \
/var/log/nmap/audit-$DATE.xml > /var/log/nmap/changes-$DATE.txt6 · Integrate Nmap into a Workflow
Typical pipeline: Nmap discovery → Masscan sweep → Nmap -sV + NSE → Vulners CVE lookup → report. Tools like nmaptocsv, nmap-parse-output, and the python-libnmap library turn XML into spreadsheets and dashboards.
References & Authoritative Sources
Official downloads, documentation, and the Nmap Book by Gordon Lyon.
Complete book covering every scan type, option, and NSE script.
Index and reference for all NSE scripts and categories.
Graphical front-end and profile documentation.
22,052 incidents / 12,195 confirmed breaches; vulnerability exploitation reached 20% of initial access vectors (+34% YoY); credential abuse 22%; ransomware in 44% of breaches; third-party involvement doubled to 30%.
Global average breach cost $4.44M; ~$1.9M average savings for extensive AI/automation use ($3.62M vs $5.52M).
Authoritative list of vulnerabilities known to be exploited in the wild — the triage source for scan findings.
NIST SP 800-115 (Technical Guide to Information Security Testing and Assessment) covers scanning methodology.
CVE and CVSS scoring for correlating detected service versions.
EU-wide threat and reconnaissance trend reports.
Framework mapping for active scanning (T1595) and its place in attack chains.
Reference for how exposed services (e.g., SSRF, misconfigurations) become web vulnerabilities.
Cross-references Nmap version detection against the Vulners exploit/CVE database.
© A7 Security Hunters. Educational content — always scan only systems you own or are explicitly authorized to test. Last updated: August 2026.
