Nmap Usage

Nmap maps networks, finds live hosts, and discovers running services. Its scripting engine extends this further, from fingerprinting services to exploiting vulnerabilities. A scan runs through the following steps; many are optional and depend on the arguments given.

1. Enumerate targets
2. Discover live hosts
3. Reverse-DNS lookup
4. Scan ports
5. Detect versions
6. Detect OS
7. Traceroute
8. Run scripts
9. Write output

Port states

• Open — a service is listening on the port.
• Closed — nothing is listening, but the port is reachable (not blocked by a firewall).
• Filtered — Nmap can't tell if the port is open or closed because it can't reach it, usually due to a firewall dropping the probes or the replies.
• Unfiltered — the port is reachable but Nmap still can't tell open from closed. Seen with an ACK scan (-sA).
• Open|Filtered — Nmap can't decide between open and filtered.
• Closed|Filtered — Nmap can't decide between closed and filtered.

Protocols by layer

Layer	Protocols
Link	ARP, DSL, Bluetooth
Network	ICMP, IPsec, IPv4, IPv6
Transport	TCP, UDP
Application	HTTP, HTTPS, telnet, SSH, FTP, RDP

Specifying targets

• Range with -: 192.168.0.1-50
• Subnet with /: 192.168.0.1/24 (same as 192.168.0.1-255)
• Hostnames: google.com

Scan types

Scan flags start with -s plus a letter for the type.

• nmap -sL <IP> — list targets without scanning them.
• nmap -sT <IP> — TCP connect scan; completes the three-way handshake, then tears it down with RST-ACK.
• nmap -sS <IP> — TCP SYN ("stealth") scan; sends only SYN, never completes the handshake, replies to SYN/ACK with RST. Fewer logs on the target.
• nmap -sU <IP> — scan UDP services (DNS, DHCP, …). Faster than TCP since UDP is connectionless.
• nmap -sn <IP> — no port scan; used to discover which devices are up on a network.

Host discovery

• nmap -PR -sn <IP>/24 — ARP ping only, no port scan.
• nmap -PE -sn <IP>/24 — ICMP echo request (falls back to ARP on the local network).
• nmap -PP -sn <IP>/24 — ICMP timestamp request (type 13), expecting a type 14 reply.
• nmap -PM -sn <IP>/24 — ICMP address-mask query (type 17), expecting a type 18 reply.
• nmap -PS -sn <IP>/24 — TCP SYN to the target (default port 80, change with -PS22). Privileged users send raw SYN packets without completing the handshake; unprivileged users must complete it.

Common options

• -F — fast mode, the 100 most common ports.
• -p<range> — specific port range.
• -O <IP> — OS detection (an educated guess, not perfectly accurate).
• -sV <IP> — service/version detection on open ports.
• -A <IP> — aggressive: OS, version, script scan, traceroute.
• -Pn <IP> — scan hosts that appear down (e.g. no ICMP reply).

Timing and rate

• -T[0-5] — timing template: paranoid (0), sneaky (1), polite (2), normal (3), aggressive (4), insane (5).
• --min-parallelism <n> / --max-parallelism <n> — number of active port probes. A poor network can drop this to one; a flawless one can push it to hundreds.
• --min-rate <n> / --max-rate <n> — packets per second, applied across the whole scan rather than per host.
• --host-timeout <n> — maximum time to wait for a single host.

Output formats

• -oN <file> — normal (human-readable)
• -oX <file> — XML
• -oG <file> — grepable (for grep/awk)
• -oA <basename> — all major formats

Note: with sudo, Nmap defaults to SYN scan (-sS); as an unprivileged user it defaults to connect scan (-sT), because crafting raw SYN packets needs root.