Nmap Section 6 of 13

Common Flags Reference

Nmap has over 100 command-line flags. This reference organizes the most essential ones into seven categories, each with a description and a working example you can copy and modify.

Scan Control

-sS

TCP SYN scan (stealth, default with root)

nmap -sS 10.0.0.1

-sT

TCP Connect scan (uses OS connect())

nmap -sT 10.0.0.1

-sU

UDP scan

nmap -sU -p 53 10.0.0.1

-sV

Service/version detection

nmap -sV 10.0.0.1

-O

OS detection (fingerprinting)

nmap -O 10.0.0.1

-A

Aggressive: enables -O, -sV, -sC, --traceroute

nmap -A 10.0.0.1

-sC

Run default NSE scripts

nmap -sC 10.0.0.1

-sn

Ping scan only (no ports)

nmap -sn 10.0.0.0/24

-Pn

Skip host discovery, treat all as online

nmap -Pn 10.0.0.1

Port Selection

-p <ports>

Scan specific ports (comma or range)

nmap -p 22,80,443 10.0.0.1

-p-

Scan all 65,535 TCP ports

nmap -p- 10.0.0.1

-p 1-1000

Scan port range

nmap -p 1-1000 10.0.0.1

--top-ports <n>

Scan the N most common ports

nmap --top-ports 100 10.0.0.1

-F

Fast scan: top 100 ports

nmap -F 10.0.0.1

-r

Scan ports in sequential order (not random)

nmap -r -p- 10.0.0.1

--port-ratio <ratio>

Scan ports more common than given ratio

nmap --port-ratio 0.01 10.0.0.1

Host Discovery

-PS<portlist>

TCP SYN ping on specified ports

nmap -PS22,80,443 10.0.0.1

-PA<portlist>

TCP ACK ping on specified ports

nmap -PA80 10.0.0.1

-PU<portlist>

UDP ping on specified ports

nmap -PU53 10.0.0.1

-PE

ICMP echo request ping

nmap -PE 10.0.0.1

-PP

ICMP timestamp request ping

nmap -PP 10.0.0.1

-PM

ICMP address mask request ping

nmap -PM 10.0.0.1

-PR

ARP ping (local networks only)

nmap -PR 10.0.0.0/24

-n

Never do DNS resolution

nmap -n 10.0.0.1

-R

Always do DNS resolution

nmap -R 10.0.0.1

Timing & Performance

-T<0-5>

Set timing template (0=paranoid, 5=insane)

nmap -T4 10.0.0.1

--min-parallelism <num>

Minimum probe parallelism

nmap --min-parallelism 100 10.0.0.1

--max-parallelism <num>

Maximum probe parallelism

nmap --max-parallelism 50 10.0.0.1

--min-rtt-timeout <time>

Minimum probe round trip time

nmap --min-rtt-timeout 100ms 10.0.0.1

--max-rtt-timeout <time>

Maximum probe round trip time

nmap --max-rtt-timeout 2s 10.0.0.1

--max-retries <tries>

Maximum number of port scan probe retransmissions

nmap --max-retries 3 10.0.0.1

--host-timeout <time>

Give up on target after this time

nmap --host-timeout 30m 10.0.0.0/24

--scan-delay <time>

Delay between probes to a host

nmap --scan-delay 5s 10.0.0.1

Evasion & Spoofing

-f

Fragment packets (8 bytes after header)

nmap -f 10.0.0.1

-D <decoy1,decoy2,...>

Hide scan among decoys

nmap -D RND:10,ME 10.0.0.1

-S <IP_Address>

Spoof source address

nmap -S 192.168.1.100 10.0.0.1

-e <iface>

Use specified network interface

nmap -e eth0 10.0.0.1

--source-port <portnum>

Spoof source port number

nmap --source-port 53 10.0.0.1

--data-length <num>

Append random data to packet payloads

nmap --data-length 200 10.0.0.1

--spoof-mac <mac>

Spoof MAC address

nmap --spoof-mac 0 10.0.0.1

--badsum

Send packets with bogus checksums

nmap --badsum 10.0.0.1

Output Formats

-oN <file>

Normal output (human readable)

nmap -oN scan.txt 10.0.0.1

-oX <file>

XML output

nmap -oX scan.xml 10.0.0.1

-oG <file>

Grepable output

nmap -oG scan.gnmap 10.0.0.1

-oA <basename>

Output in all major formats

nmap -oA scan 10.0.0.1

-v

Increase verbosity

nmap -v 10.0.0.1

-vv

More verbosity

nmap -vv 10.0.0.1

-d

Increase debugging level

nmap -d 10.0.0.1

--reason

Display reason for port state

nmap --reason 10.0.0.1

--open

Only show open (or possibly open) ports

nmap --open 10.0.0.1

--packet-trace

Show all packets sent and received

nmap --packet-trace 10.0.0.1

Target Specification

-iL <inputfilename>

Read targets from file

nmap -iL targets.txt

-iR <num hosts>

Choose random targets

nmap -iR 100

--exclude <host1,...>

Exclude hosts/networks

nmap --exclude 10.0.0.1 10.0.0.0/24

--excludefile <exclude_file>

Exclude list from file

nmap --excludefile exclude.txt 10.0.0.0/24

Info

For the complete flag reference, run nmap --help or consult the official Nmap manual at nmap.org/book/man.html

Next: NSE Scripts Back