🔍 nmap Quick Reference

nmap [scan type] [options] <target>
nmap -sV -p 22,80,443 192.168.1.10

nmap ("Network Mapper") discovers hosts on a network, finds their open ports, and
identifies the services and operating systems behind them. Sysadmins use it to audit their
own networks, check firewall rules and confirm what is really exposed.

Only scan systems you own or have written permission to test. Unauthorized scanning
can break policies or laws, and can trigger alarms or knock over fragile devices.

sudo apt install nmap            # Debian/Ubuntu
sudo dnf install nmap            # Fedora/RHEL family
brew install nmap                # macOS
nmap --version
Many scans (SYN scan, OS detection) need root: run them with sudo.

nmap 192.168.1.10                # one host
nmap example.com                 # a hostname
nmap 192.168.1.0/24              # a whole subnet (CIDR)
nmap 192.168.1.1-50              # a range
nmap 192.168.1.1,5,9             # a list
nmap 192.168.1.*                 # wildcard
nmap -iL targets.txt             # read targets from a file (one per line)
nmap 192.168.1.0/24 --exclude 192.168.1.1,192.168.1.2
nmap --excludefile skip.txt 10.0.0.0/24
nmap -6 fe80::1                  # IPv6

nmap -sn 192.168.1.0/24          # ping sweep only, no port scan
nmap -sn -PR 192.168.1.0/24      # ARP discovery on the local LAN (fast and reliable)
nmap -Pn 192.168.1.10            # skip discovery, treat the host as up (hosts that block ping)
nmap -PS22,80,443 host           # TCP SYN discovery on chosen ports
nmap -PA80 host                  # TCP ACK discovery
nmap -PE host                    # ICMP echo
nmap -sL 192.168.1.0/24          # just list targets and resolve names (sends nothing)
nmap -n 192.168.1.0/24           # no DNS lookups (faster)

-sS    TCP SYN ("half-open") scan. Fast, the default when run as root
-sT    TCP connect scan. The default without root; slower and more visible in logs
-sU    UDP scan. Slow, but many services (DNS, SNMP, DHCP) use UDP
-sA    ACK scan. Maps firewall rules (filtered vs unfiltered), not open ports
-sN / -sF / -sX   Null, FIN and Xmas scans (unreliable on Windows; useful for firewall tests)
-sV    Probe open ports to identify the service and version
-sC    Run the default safe scripts
-O     Try to detect the operating system
-A     Aggressive: -sV -sC -O and traceroute together
Combine them: sudo nmap -sS -sU -p T:80,443,U:53 host

nmap host                        # the 1,000 most common TCP ports (default)
nmap -p 80 host                  # one port
nmap -p 22,80,443 host           # a list
nmap -p 1-1024 host              # a range
nmap -p- host                    # all 65,535 TCP ports
nmap -F host                     # fast: the top 100 ports
nmap --top-ports 200 host
nmap -p U:53,161,T:80,443 host   # mix UDP (U:) and TCP (T:)
nmap -p http,https host          # by service name

open            A service is listening and answering
closed          Reachable, but nothing listening
filtered        A firewall drops or blocks probes, so nmap cannot tell
unfiltered      Reachable, but open/closed unknown (ACK scan)
open|filtered   Could be open or filtered (UDP and some stealth scans)

sudo nmap -sV host                        # service and version
sudo nmap -sV --version-intensity 9 host  # try harder (0 light, 9 all probes)
sudo nmap -sV --version-light host
sudo nmap -O host                         # OS guess
sudo nmap -O --osscan-guess host          # guess more aggressively
sudo nmap -A host                         # everything at once
sudo nmap -sV -p- host                    # every port, with versions

nmap -sC host                             # the "default" script set
nmap --script default host                # same
nmap --script safe host                   # only scripts that will not disturb services
nmap --script vuln host                   # check for known vulnerabilities (intrusive; authorized use only)
nmap --script "http-*" -p 80,443 host     # a wildcard family
nmap --script http-title -p 80 host       # page titles
nmap --script ssl-cert -p 443 host        # certificate details
nmap --script ssl-enum-ciphers -p 443 host   # supported TLS versions and ciphers
nmap --script ssh-hostkey -p 22 host
nmap --script dns-brute example.com       # subdomain guessing
nmap --script smb-os-discovery -p 445 host
nmap --script-help http-title             # what does a script do?
ls /usr/share/nmap/scripts/               # all installed scripts
sudo nmap --script-updatedb               # refresh the script index
Script categories: default, safe, discovery, version, vuln, auth, intrusive, brute, exploit.
Read a script's description (--script-help) before running anything intrusive.

-T0 ... -T5    Timing templates: 0 paranoid, 1 sneaky, 2 polite, 3 normal (default),
               4 aggressive, 5 insane
-T4            Sensible for a fast, reliable LAN
-T2            Gentler for fragile or slow targets
--min-rate 1000          Send at least 1000 packets per second
--max-rate 100           Never exceed 100 per second
--max-retries 1          Fewer retransmits (faster, may miss ports)
--host-timeout 30s       Give up on slow hosts
--scan-delay 500ms       Wait between probes
--min-parallelism 50     Probe more ports at once
Aggressive timing on a busy or fragile network can cause missed results or outages.

nmap host                                 # normal output to the screen
nmap -v host                              # verbose (-vv for more)
nmap -d host                              # debug
nmap --reason host                        # explain why each port has its state
nmap --open host                          # show only open ports
nmap --packet-trace host                  # show every packet sent and received
nmap -oN scan.txt host                    # normal text file
nmap -oX scan.xml host                    # XML (for tools and reports)
nmap -oG scan.gnmap host                  # grepable
nmap -oA scan host                        # all three formats: scan.nmap/.xml/.gnmap
nmap --append-output -oN scan.txt host
nmap --resume scan.gnmap                  # resume an interrupted scan
nmap --stats-every 10s host               # progress every 10 seconds
While a scan runs, press Enter for status (or v / d to change verbosity).

sudo nmap -sA host                        # which ports does the firewall let through?
sudo nmap -Pn -p 80,443 host              # firewall blocks ping, so skip discovery
sudo nmap --traceroute host               # route to the host
sudo nmap -sS -p 443 --reason host        # see if "filtered" comes from a drop or a reject
sudo nmap -sI zombie host                 # idle scan (advanced; rarely needed)
Use these on your own firewalls to verify rules, not to slip past someone else's.

# Who is on my network right now? (LAN, fast)
sudo nmap -sn 192.168.1.0/24

# Quick look at a server's common ports
nmap -F server.example.com

# Everything open on a host, with versions
sudo nmap -sV -p- -T4 192.168.1.10

# Just the open ports as a list
nmap -p- --open -oG - 192.168.1.10 | awk '/open/{print}' | head

# Is this port open? (script friendly: exit code is 0 either way, so grep)
nmap -p 443 --open -oG - host | grep -q "443/open" && echo open

# Check a web server's TLS setup
nmap --script ssl-enum-ciphers,ssl-cert -p 443 example.com

# Find devices with SSH open on the LAN
nmap -p 22 --open 192.168.1.0/24

# Find web servers on the LAN
nmap -p 80,443,8080 --open 192.168.1.0/24

# Inventory: hostnames, MACs and open ports of a subnet
sudo nmap -sS -O --top-ports 100 -oA inventory 192.168.1.0/24

# Compare two scans to see what changed (from the same tool suite)
ndiff yesterday.xml today.xml

# Turn XML into an HTML report
xsltproc scan.xml -o scan.html

# Scan from a target list and save everything
sudo nmap -sV -iL hosts.txt -oA results

# Watch for a new open port every hour
while true; do nmap -p- --open -oG - host | grep open; sleep 3600; done

ncat / nc              Simple port checks and connections (nc -zv host 22)
ss -tulpn              What is listening on THIS machine (no scan needed)
masscan                Very fast large-range port scanner
zenmap                 The graphical front end for nmap
ndiff                  Compare two nmap XML results
tcpdump / wireshark    See the packets nmap sends

"You requested a scan type which requires root"   Run it with sudo
Everything shows filtered       A firewall is dropping probes: try -Pn, another port, or scan from inside
Host seems down               It blocks ping: use -Pn or -PS with a known port
Scan is very slow             UDP scans and -p- are slow: use --top-ports, -T4, --min-rate, or -n
Different results each run     Packet loss or rate limiting: lower speed, add --max-retries 3
OS detection says "no exact match"   Needs one open and one closed port to guess well
Nothing on localhost          Scan 127.0.0.1 with sudo nmap -sS -p- 127.0.0.1, or use ss -tulpn

    Get written permission before scanning anything you do not own. A scan can look like an attack.

    Start gentle (-F or --top-ports 100), then dig deeper on the hosts and ports that matter.

    Use -oA to save every scan. Old results let you spot new open ports with ndiff.

    Use sudo for the SYN scan, OS detection and ARP discovery. Without root nmap falls back to slower methods.

    A "filtered" port is not the same as a closed one. It means something is blocking the probe.

    Use -Pn when hosts do not answer ping, but expect the scan to take longer.

    --script vuln and other intrusive scripts can crash old or fragile services. Use them only on systems you are allowed to test.

    Scan your own servers regularly from outside your network to confirm only the ports you intend are reachable.

    Keep nmap and its scripts updated: sudo nmap --script-updatedb after upgrading.

    On your own machine, ss -tulpn shows listening ports faster and more accurately than scanning yourself.