Nmap Section 3 of 13

Scan Types

Nmap offers thirteen distinct scan techniques, each designed for different network conditions, target types, and stealth requirements. Choosing the right scan type is one of the most important decisions in any Nmap engagement.

Detailed Scan Type Reference

Click any scan type to expand and read its full technical explanation, including how it works under the hood, when to use it, and common pitfalls.

Scan Type Comparison

Use this table to quickly compare scan types across speed, stealth, privilege requirements, and best use cases.

Scan TypeSpeedStealthRootBest For
-sS (SYN)FastHighYesGeneral reconnaissance
-sT (Connect)MediumLowNoNon-root scanning
-sU (UDP)Very SlowMediumYesDNS, SNMP, VPN
-sN/sF/sXMediumMediumYesSimple stateless filters
-sA (ACK)FastHighYesFirewall rule mapping
-sI (Idle)SlowMaximumYesUltimate stealth
-sV (Version)SlowLowNoVulnerability assessment

The TCP Three-Way Handshake

Understanding the TCP handshake is essential for understanding why SYN scans are stealthy and why Connect scans are not. This is the foundation of all TCP scanning.

Normal Connection vs SYN Scan

Normal Three-Way Handshake

1. Client → ServerSYNI want to connect
2. Server → ClientSYN-ACKI am listening, ready
3. Client → ServerACKConnection established

The full connection is logged by the OS and the application.

SYN Scan (Stealth)

1. Scanner → TargetSYNProbe sent
2. Target → ScannerSYN-ACKPort is open
3. Scanner → TargetRSTConnection killed

No full connection ever exists. Often not logged by applications.

Important Considerations

Important

Stealth scans (-sS, -sN, -sF, -sX) require root/administrator privileges because they craft raw TCP packets. Without root, Nmap silently falls back to -sT.

Warning

NULL, FIN, and Xmas scans are unreliable against Windows targets and many network devices because these systems do not strictly follow RFC 793. They may show all ports as closed regardless of actual state.

Info

UDP scans (-sU) are extremely slow. Always limit the port range with -p when scanning UDP. Scanning all 65,535 UDP ports can take hours or days.

Tip

For daily use, the combination of -sS (SYN scan) + -sV (version detection) + -O (OS detection) covers 95% of reconnaissance needs on Linux and macOS targets.

Quick Reference Commands

bash
1nmap -sS 192.168.1.1
bash
1nmap -sT 192.168.1.1
bash
1nmap -sU -p 53,161,500 192.168.1.1
bash
1nmap -sA 192.168.1.1
bash
1nmap -sN 192.168.1.1
bash
1nmap -sn 192.168.1.0/24
bash
1nmap -sV 192.168.1.1
bash
1nmap -sS -sV -O 192.168.1.1
Next: Port States Back