Usage Examples
Real-world Nmap commands organized by use case. Each example includes the command, a detailed explanation of what it does, and guidance on when to use it.
Basic Scanning
Quick port scan on a single target
1nmap 192.168.1.1
Scans the top 1000 most common TCP ports. This is the simplest possible Nmap command and the starting point for any reconnaissance.
Use as your first scan against any new target to get a quick overview of open services.
Scan an IP range
1nmap 192.168.1.1-254
Scans 254 hosts in the specified range. Nmap expands the range and processes each host individually, showing results as they arrive.
Use for host discovery and port scanning across a subnet. Faster than scanning each IP individually.
Scan a CIDR network
1nmap 10.0.0.0/24
Scans all 256 IP addresses in the /24 subnet. Nmap automatically expands CIDR notation into individual addresses.
Use when you know the network size and want to discover all live hosts and their services in one command.
Ping scan only (no ports)
1nmap -sn 192.168.1.0/24
Performs host discovery only, skipping port scanning. Uses ICMP, TCP SYN (443), and TCP ACK (80) to find live hosts.
Use to quickly map which hosts are online before deciding which ones to port-scan more deeply.
Advanced Port Scanning
Stealth SYN scan on all 65,535 ports
1nmap -sS -p- 10.0.0.1
Combines stealth SYN scanning with full port range coverage. Requires root privileges. Scans every single TCP port, which can take 10-30 minutes depending on network speed.
Use when you need complete coverage and have root access. Be patient — this is thorough but slow.
Aggressive scan with OS and version detection
1nmap -A -T4 10.0.0.1
-A enables OS detection, version detection, default NSE scripts, and traceroute. -T4 speeds it up. This is the most comprehensive single-target scan.
Use for deep reconnaissance on a single target when time permits. Provides maximum information in one scan.
Fast top-100 ports with no ping
1nmap -Pn --top-ports 100 10.0.0.0/24
Skips host discovery (-Pn) and scans only the 100 most common ports. Fast way to check a large network for obvious services.
Use for quick sweeps across large networks where ICMP ping is blocked by firewalls.
UDP scan for DNS and SNMP
1nmap -sU -p 53,161 10.0.0.1
UDP scanning is slow because connectionless protocols provide no acknowledgment. Limiting to specific ports makes it practical.
Use when you need to find UDP services. Always limit the port range — scanning all UDP ports takes hours.
NSE Script Scanning
Run all vulnerability scripts
1nmap --script vuln 10.0.0.1
Runs every script in the "vuln" category, which detects known vulnerabilities like EternalBlue, Heartbleed, and CVEs based on version banners.
Use after finding open services to quickly identify exploitable vulnerabilities. This is noisy but invaluable.
Run default scripts
1nmap -sC 10.0.0.1
Equivalent to --script=default. Runs safe, non-intrusive scripts that provide useful info like HTTP titles, SSL certs, and SSH hostkeys.
Use as a standard addition to every scan. Safe enough for production systems.
Grab HTTP titles on a subnet
1nmap --script http-title -p 80,8080,8443 10.0.0.0/24
Runs the http-title script against all specified web ports across the subnet. Great for quickly identifying exposed web applications.
Use during reconnaissance to map web applications and find interesting titles like "Admin Panel" or "phpMyAdmin".
Enumerate SMB shares
1nmap --script smb-enum-shares -p 445 10.0.0.1
Discovers SMB shares, their permissions, and contents. Often reveals sensitive files, backups, or credential stores.
Use against Windows targets or Samba servers to find exposed network shares.
Evasion & Stealth
Decoy scan with 10 random IPs
1nmap -D RND:10 -sS -p 22,80,443 10.0.0.1
Hides your real IP among 10 random decoy addresses. The target sees traffic from 11 sources and cannot easily identify the real scanner.
Use when you need to obscure the scanning source in target logs. Requires you to specify your real IP with ME if needed.
Fragment packets to evade IDS
1nmap -f -sS -p 80 10.0.0.1
Splits packets into tiny 8-byte fragments after the IP header. Some simple IDS signatures cannot reassemble fragments.
Use against simple packet filters or older IDS systems that lack fragment reassembly.
Spoof source port to 53 (DNS)
1nmap --source-port 53 -sS 10.0.0.1
Many firewalls allow traffic from port 53 because DNS is essential. By spoofing this source port, some simple filters may allow your scan through.
Use against stateless firewalls that whitelist well-known ports without full connection tracking.
Idle (zombie) scan
1nmap -sI 192.168.1.100:113 10.0.0.1
The ultimate stealth scan. Bounces probes through an idle "zombie" host so the target never sees your IP at all.
Use only when you have identified a suitable zombie host with predictable IPID sequencing. Very difficult to execute successfully on modern systems.
Output & Logging
Output to XML and normal formats
1nmap -oX scan.xml -oN scan.txt 10.0.0.1
Saves results in both XML (for tools) and normal text (for humans) simultaneously. You can output to all formats with -oA.
Use on every professional engagement. XML output integrates with Metasploit, Dradis, and other reporting tools.
Scan from a target list file
1nmap -iL targets.txt -oN results.txt
Reads target IPs or hostnames from a file instead of the command line. Useful for large-scope engagements with hundreds of targets.
Use when you have a pre-defined scope list from the client or discovered via reconnaissance.
Traceroute with full detection
1nmap -A --traceroute 10.0.0.1
Combines aggressive scanning with network path tracing. Shows each hop between you and the target, useful for understanding network topology.
Use to map network topology and identify intermediate firewalls, routers, or proxies.
Show reasons for port states
1nmap --reason 10.0.0.1
Displays exactly why Nmap classified each port as open, closed, or filtered. Shows responses like "syn-ack", "reset", or "no-response".
Use when debugging scan results or writing detailed reports that need to justify every finding.
Important