Target specification 14
| Command | What it does |
|---|---|
nmap TARGET | Basic scanAny argument that is not an option counts as a target; a hostname is scanned at its first DNS address only. |
192.168.10.0/24 | Scan a CIDR blockAppending /NUMBITS keeps that many leading bits fixed; /24 covers 256 addresses, and /0 would target the whole Internet. |
192.168.0-255.1-254 | Scan octet rangesEach octet takes numbers, lists or ranges, so network and broadcast addresses can be left out; IPv6 has no octet ranges. |
nmap scanme.nmap.org 192.168.0.0/8 10.0.0,1,3-7.- | Mix several target typesHostnames, CIDR blocks and octet ranges can be given together on one command line, separated by spaces. |
-iL FILE | Input from fileEntries may be addresses, hostnames, CIDR blocks or octet ranges separated by spaces or newlines; a hyphen as the name reads standard input. |
-iR NUM | Scan random targetsPrivate, multicast and unallocated ranges are skipped automatically, and 0 keeps generating targets without end. |
--exclude HOSTS | Exclude hosts from a scanTakes normal target syntax, so single hosts, CIDR blocks or octet ranges can be cut out of a larger range. |
--excludefile FILE | Exclude hosts listed in a fileEntries are separated by newlines, spaces or tabs, and the file may carry comments that start with #. |
-6 | Enable IPv6 scanningPing, port and version scans and NSE work over IPv6; give targets as IPv6 addresses or hostnames. |
--resolve-all | Scan every resolved addressStill limited to one address family: IPv4 addresses unless -6 is given, then IPv6. |
-n | Skip reverse DNSLeaving out the name lookups can shorten a scan a lot, because DNS is often the slow step. |
-R | Reverse-resolve every targetBy default only hosts found to be up get a reverse DNS lookup. |
--dns-servers SERVERS | Use specific DNS serversReplaces the servers from resolv.conf or the Windows registry; ignored with --system-dns, and several servers are often faster. |
--system-dns | Use the system resolverResolves one address at a time through the operating system instead of Nmap's parallel queries, so it is slower. |
Host discovery 13
| Command | What it does |
|---|---|
-sn | Ping sweepPrints only the hosts that answered; traceroute and NSE host scripts can still be added to the run. |
-sL | List targets onlyReverse DNS still runs, so host names appear, and the total number of addresses is printed at the end. |
-Pn | Skip host discoveryEvery address given is then scanned as if it were up, so a /16 range means all 65,536 addresses. |
-PS | TCP SYN pingProbes port 80 unless a port list follows with no space, as in -PS22-25,80. |
-PA | TCP ACK pingA live host answers the unexpected ACK with a RST; pairing it with -PS helps past firewalls that only block incoming SYN. |
-PU | UDP pingWithout a port list it uses port 40125, an unusual port chosen because probing open ports is undesirable here. |
-PE | ICMP echo pingFirewalls and hosts often drop echo requests today, so discovery by ICMP alone seldom finds everything. |
-PP | ICMP timestamp pingUseful where administrators block echo requests but forget that other ICMP queries also reveal a host. |
-PM | ICMP address mask pingAnother ICMP query type that can find hosts when only echo requests are filtered. |
--disable-arp-ping | Turn off ARP discoveryOn a local Ethernet segment ARP or Neighbor Discovery runs even with -Pn; this stops it, which helps behind proxy ARP. |
--traceroute | Trace the path to hostsRuns after the scan, using its results to pick a port and protocol; it does not work with -sT or -sI. |
-PY | SCTP INIT pingSends an SCTP packet with an INIT chunk; a port list may follow with no space, otherwise port 80 is used. |
-PO | IP protocol pingSends packets with the given protocol numbers in the IP header; ICMP, IGMP and IP-in-IP get correct headers, others just the IP header. |
Scan techniques 15
Most scan types send raw packets and so need root on Unix; without those rights nmap falls back to the TCP connect scan.
| Command | What it does |
|---|---|
-sS | TCP SYN scanNever completes a connection, so it is quick and fairly stealthy; it needs raw-packet privileges, and without them -sT is the default. |
-sT | TCP connect scanAsks the operating system to open each connection, so it works without raw-packet privileges. |
-sU | UDP scanCan be combined with a TCP scan such as -sS in the same run; slow because hosts rate-limit ICMP port-unreachable replies. |
-sA | TCP ACK scanNever finds open ports; it maps firewall rules, showing which ports are filtered and whether the filter is stateful. |
-sW | TCP Window scanLike the ACK scan, but reads the window size of RST replies to tell open from closed on some systems. |
-sM | TCP Maimon scanSends FIN/ACK probes and otherwise works like the NULL, FIN and Xmas scans. |
-sN | TCP NULL scanSends packets with no flags set; RFC-compliant stacks reply only from closed ports. |
-sF | TCP FIN scanSends a lone FIN flag; one of three scans that exploit a loophole in the TCP RFC. |
-sX | TCP Xmas scanSets FIN, PSH and URG together; reads port states the same way as the NULL and FIN scans. |
--scanflags FLAGS | Custom TCP flags scanTakes a number or any mix of URG, ACK, PSH, RST, SYN and FIN, such as URGACKPSHRSTSYNFIN. |
-sI ZOMBIE | Idle scan through a zombieNo probe reaches the target from your own address; the zombie host's IP ID sequence reveals the open ports. |
-sY | SCTP INIT scanThe SCTP counterpart of a SYN scan, mostly relevant to SS7/SIGTRAN services. |
-sZ | SCTP COOKIE ECHO scanLess obvious than an INIT scan: open ports drop the chunk silently while closed ones answer with ABORT. |
-sO | IP protocol scanCycles through IP protocol numbers instead of ports, and still uses -p to choose which numbers to try. |
-b HOST | FTP bounce scanUses an FTP server that allows proxy connections to scan other hosts; most servers no longer support it. |
Port specification 9
| Command | What it does |
|---|---|
-p PORTS | Specific portsTakes single numbers and hyphen ranges such as 1-1023; a range with an open end defaults to 1 or 65535. |
-p- | All portsAn open-ended range runs from 1 to 65535; port 0 is scanned only when named explicitly. |
-p U:53,111,137,T:21-25,80,139,8080 | Mix UDP and TCP portsT:, U:, S: and P: prefixes assign ports to TCP, UDP, SCTP or IP protocol; add -sU and a TCP scan type to cover both. |
-p ftp,http* | Ports by service nameNames come from nmap-services; quote the argument so the shell does not expand the wildcard. |
--exclude-ports PORTS | Exclude ports from a scanUses the same syntax as -p; with -sO it excludes protocol numbers instead. |
-F | Fast scanCuts the default list of 1,000 most common ports per protocol down to 100. |
-r | Don't randomize portsPorts are scanned in sorted order instead of the default shuffled order. |
--top-ports N | Scan the most common portsPicks the N highest-ratio ports in nmap-services, after any --exclude-ports; N must be at least 1. |
--port-ratio RATIO | Scan ports above a frequencyThe ratio is a decimal from 0.0 to 1.0 compared with the frequencies in nmap-services. |
Service and version detection 6
| Command | What it does |
|---|---|
-sV | Service versionProbes the open ports found by a port scan to name the application and read its version. |
-A | Aggressive scanTurns on OS and version detection, the default scripts and a traceroute in one flag; it is intrusive and slow. |
--version-intensity LEVEL | Set probe intensityA number from 0 to 9 chooses how many probes to try; higher is more accurate but slower, and 7 is the default. |
--version-light | Light version scanShortcut for intensity 2: much faster, but a few less common services go unidentified. |
--version-all | Exhaustive version scanShortcut for intensity 9, so every probe is tried against each port. |
--allports | Version-scan every portOverrides the Exclude rule that normally skips TCP 9100, where some printers dump pages of junk. |
OS detection 3
| Command | What it does |
|---|---|
-O | OS detectionGuesses the operating system from TCP/IP stack fingerprints; works best with one open and one closed port. |
--osscan-limit | Skip unlikely OS targetsDoes not attempt OS detection unless a host has an open and a closed TCP port, saving time on big scans. |
--osscan-guess | Guess the OS harderPrints near-matches when no exact fingerprint is found, with a confidence percentage for each guess; --fuzzy is the same. |
Timing and performance 8
The -T templates run from 0 to 5; 3 is the default, so -T3 changes nothing on its own.
| Command | What it does |
|---|---|
-T4 | Fast timing templateRecommended for a quick, reliable LAN; it caps the per-probe delay and bounds the round-trip timeouts and retries. |
-T5 | Fastest timing templatePushes the scan hard and drops results on unreliable links; the most aggressive of the six -T levels. |
-T0 | Slowest timing templateSerializes the scan to one port at a time with a five-minute wait between probes, which helps slip past an IDS. |
--min-rate NUMBER | Set a minimum packet rateKeeps nmap sending at least this many packets per second, useful when a scan must finish by a deadline. |
--max-rate NUMBER | Cap the packet rateLimits sending to this many packets per second across the whole scan; fractional values such as 0.1 slow it right down. |
--host-timeout TIME | Give up on slow hostsSkips any host that is not finished within the given time; no results are printed for a host that times out. |
--max-retries NUMBER | Limit probe retransmissionsCaps how often a port-scan probe is resent; a low value speeds up rate-limited hosts, and 0 stops all retries. |
--scan-delay TIME | Wait between probesForces at least this gap between probes to one host, which copes with rate limiting and can slip under an IDS threshold. |
Script scanning 7
| Command | What it does |
|---|---|
-sC | Run default scriptsRuns the default set of NSE scripts, the same as --script=default; -A includes it. |
--script CATEGORY | Run chosen scriptsTakes a comma list of categories (default, safe, vuln and others), script names or directories, or a Boolean expression. |
--script-args ARGS | Pass arguments to scriptsA comma-separated list of name=value pairs; qualify a name with its script, as in xmpp-info.server_name. |
--script-args-file FILE | Read script arguments from a fileThe file may separate arguments by commas or newlines and needs no shell quoting; command-line args override it. |
--script-help SCRIPT | Show help for scriptsPrints each matching script name, its categories and description, so it also previews what a selection would run. |
--script-trace | Trace script trafficPrints the data each script sends and receives, one ISO layer above what --packet-trace shows. |
--script-updatedb | Rebuild the script databaseRefreshes scripts/script.db after NSE scripts are added, removed or recategorised; run on its own. |
Output and verbosity 13
| Command | What it does |
|---|---|
-oN FILE | Save normal outputWrites the plain-text report to a file while interactive output still goes to the screen. |
-oX FILE | Save XML outputWrites a parser-friendly XML file that GUIs, databases and other tools import. |
-oG FILE | Save grepable outputOne line per host for grep and awk; it is deprecated in favour of XML but still widely used. |
-oA BASENAME | Save all three formatsWrites BASENAME.nmap, BASENAME.xml and BASENAME.gnmap together, the habit worth forming before a long scan. |
-v | Verbose outputPrints open ports and progress as they are found; repeat as -vv for more detail. |
-d | Debug outputFloods the terminal with internal detail; raise the level with -dd up to -d9. |
--reason | Show why a port has its stateNames the packet that decided each port or host state, such as a RST from a closed port. |
--open | Show open ports onlyHides closed and filtered ports, and any host with no open or possibly-open port. |
--packet-trace | Trace every packetSummarises each packet sent or received; limit the ports with -p to keep the output readable. |
--stats-every TIME | Print periodic statusPrints a timing update to the screen and XML output after each interval, as with --stats-every 10s. |
--append-output | Append instead of overwriteAdds results to the named output files rather than clobbering them; XML files then need fixing up to parse. |
--resume FILE | Resume an aborted scanContinues a scan from a normal or grepable output file after it was interrupted. |
--iflist | List interfaces and routesPrints the interfaces and system routes nmap detected, then quits; handy for routing problems. |
Firewall and IDS evasion 12
| Command | What it does |
|---|---|
-f | Fragment packetsSplits the probe into tiny IP fragments so simple filters cannot read the TCP header; repeat for 16-byte fragments. |
--mtu MTU | Set the fragment sizePicks your own fragment offset in bytes rather than the default eight; do not pair it with -f. |
-D DECOYS | Cloak the scan with decoysMakes the target see scans from the listed decoy addresses too; put ME at your own position or use RND for random ones. |
-S IP | Set the source addressSends packets from the given IP, needed when nmap cannot work out your address; usually paired with -e and -Pn. |
-e INTERFACE | Choose the network interfaceTells nmap which interface to send and receive on when it cannot detect the right one by itself. |
-g PORT | Fix the source portSends from a constant port to abuse rules that trust traffic from 53 or 20; --source-port is the long form. |
--data-length NUMBER | Pad packets with random dataAppends that many random bytes to most packets instead of protocol payloads; 0 disables all padding. |
--ttl VAL | Set the IP time-to-liveWrites the given value into the IPv4 TTL field of every packet nmap sends. |
--spoof-mac MAC | Set a fake MAC addressUses the given MAC, vendor name or prefix for raw frames; 0 picks a random one, and it implies --send-eth. |
--randomize-hosts | Shuffle the target orderReorders each group of up to 16,384 hosts so the sweep looks less obvious to network monitors. |
--badsum | Send a bad checksumDeliberately wrong checksums are dropped by host stacks, so any reply comes from a firewall or IDS. |
--proxies URLS | Relay through proxiesChains HTTP or SOCKS4 proxies for the connections nmap makes; only NSE and version scans use them so far. |
Runtime interaction 4
| Command | What it does |
|---|---|
| vorV | Raise or lower verbosityPressing v during a running scan shows more, V shows less; lowercase keys increase printing, uppercase decrease it. |
| dorD | Raise or lower debug levelAdjusts how much debugging detail the running scan prints, the same convention as the verbosity keys. |
| porP | Turn packet tracing on or offSwitches the live packet-by-packet trace during a scan without restarting it. |
| ? | Show runtime helpPrints the list of keys you can press while a scan is running. |
No row on this page matches that filter.
Notes
Discovery to detail
-sn is a ping sweep that lists the hosts answering and runs no port scan — the way to map a subnet quickly. A plain scan then checks the 1,000 most common TCP ports; -p- covers all 65,535, which takes far longer. -sV reads the service and version on each open port, -O guesses the operating system from stack fingerprints, and -A switches on both plus scripts and a traceroute. -sU scans UDP, which is slow because closed ports usually stay silent.
Speed, scope and scripts
-T4 is the timing template to reach for on a reliable network; -T5 is faster still but loses results on flaky links, and -T0 crawls to stay under an IDS. --open hides everything except open ports, and -iL FILE reads targets from a file. --script CATEGORY runs a group of NSE scripts — categories such as default, safe or vuln — while -sC runs just the default set that -A already includes.
Saving results
-oN FILE writes the plain report, -oX FILE writes XML for other tools, and -oA BASENAME writes normal, XML and grepable at once — worth doing before a long scan. -v prints open ports and progress as they appear rather than at the end. Scanning networks you do not own or have written permission to test is illegal in many places; keep to systems you are authorised to examine.
Questions
Does Nmap need root or administrator rights?
Many scan types send raw packets and need root on Unix or an administrator account on Windows. -sT and a plain -sn ping sweep work without them, because they rely on ordinary system calls.
How do I scan every TCP port instead of the common ones?
Use -p- to cover all 65,535 ports. By default Nmap scans the 1,000 most common, and -F cuts that to the top 100 for a faster pass.
What does the -A flag turn on?
It enables OS detection (-O), version detection (-sV), the default scripts (-sC) and --traceroute in a single flag. It is thorough but noisy, so avoid it on networks where you lack permission.
Sources and checks
- Nmap Reference Guide: Runtime Interaction (nmap.org, Nmap 7.991) Runtime interaction keys
- Nmap Reference Guide: Port Specification and Scan Order (nmap.org, Nmap 7.991) Port specification
- Nmap Reference Guide: Target Specification (nmap.org, Nmap 7.991) Target specification
- Nmap Reference Guide: Host Discovery (nmap.org, Nmap 7.991) Host discovery
- Nmap Reference Guide: Output (nmap.org, Nmap 7.991) Output and verbosity
- Nmap Reference Guide: Nmap Scripting Engine (nmap.org, Nmap 7.991) Script scanning
6 more source pages
- Nmap Reference Guide: Timing and Performance (nmap.org, Nmap 7.991) Timing and performance
- Nmap Reference Guide: Port Scanning Techniques (nmap.org, Nmap 7.991) Scan techniques
- Nmap Reference Guide: Service and Version Detection (nmap.org, Nmap 7.991) Service and version detection
- Nmap Reference Guide: OS Detection (nmap.org, Nmap 7.991) OS detection
- Nmap Reference Guide: Miscellaneous Options (nmap.org, Nmap 7.991) Aggressive scan, IPv6 and other options
- Nmap Reference Guide: Firewall/IDS Evasion and Spoofing (nmap.org, Nmap 7.991) Firewall and IDS evasion
Every row on this page was matched to a line in the documentation above on . A binding that could not be found there is not listed.
1 row from the earlier version of this page was removed in that check: duplicates, and bindings the documentation does not list or lists differently.
Found a wrong or missing key? Tell us and it gets checked against the source. How we verify describes the process and its limits.