Reference guide for scanning networks with Nmap.
Table of Contents
1. What is Nmap?
2. How to Use Nmap
1. Command Line
3. Basic Scanning Techniques
1. Scan a Single Target
2. Scan Multiple Targets
3. Scan a List of Targets
4. Scan a Range of Hosts
5. Scan an Entire Subnet
6. Scan Random Hosts
7. Exclude Targets From a Scan
8. Exclude Targets Using a List
9. Perform an Aggresive Scan
10. Scan an IPv6 Target
4. Port Scanning Options
1. Perform a Fast Scan
2. Scan Specific Ports
3. Scan Ports by Name
4. Scan Ports by Protocol
5. Scan All Ports
6. Scan Top Ports
7. Perform a Sequential Port Scan
8. Attempt to Guess an Unknown OS
9. Service Version Detection
10. Troubleshoot Version Scan
11. Perform a RPC Scan
5. Discovery Options
1. Perform a Ping Only Scan
2. Do Not Ping
3. TCP SYN Ping
3. TCP ACK Ping
4. UDP Ping
5. SCTP INIT Ping
6. ICMP Echo Ping
7. ICMP Timestamp Ping
8. ICMP Address Mask Ping
9. IP Protocol Ping
10. ARP Ping
11. Traceroute
12. Force Reverse DNS Resolution
13. Disable Reverse DNS Resolution
14. Alternative DNS Lookup
15. Manually Specify DNS Server
16. Create a Host List
6. Firewall Evasion Techniques
1. Fragment Packets
2. Specify a Specific MTU
3. Use a Decoy
4. Idle Zombie Scan
5. Manually Specify a Source Port
6. Append Random Data
7. Randomize Target Scan Order
8. Spoof MAC Address
9. Send Bad Checksums
7. Advanced Scanning Functions
1. TCP SYN Scan
2. TCP Connect Scan
3. UDP Scan
4. TCP NULL Scan
5. TCP FIN Scan
6. Xmas Scan
7. TCP ACK Scan
8. Custom TCP Scan
9. IP Protocol Scan
10. Send Raw Ethernet Packets
11. Send IP Packets
8. Timing Options
1. Timing Templates
2. Set the Packet TTL
3. Minimum Number of Parallel Operations
4. Maximum Number of Parallel Operations
5. Minimum Host Group Size
6. Maximum Host Group Size
7. Maximum RTT Timeout
8. Initial RTT TImeout
10. Maximum Number of Retries
11. Host Timeout
12. Minimum Scan Delay
13. Maximum Scan Delay
14. Minimum Packet Rate
15. Maximum Packet Rate
16. Defeat Reset Rate Limits
9. Output Options
1. Save Output to a Text File
2. Save Output to a XML File
3. Grepable Output
4. Output All Supported File Types
5. Periodically Display Statistics
6. 1337 Output
10. Compare Scans
1. Comparison Using Ndiff
2. Ndiff Verbose Mode
3. XML Output Mode
11. Troubleshooting and Debugging
1. Get Help
2. Display Nmap Version
3. Verbose Output
4. Debugging
5. Display Port State Reason
6. Only Display Open Ports
7. Trace Packets
8. Display Host Networking
9. Specify a Network Interface
12. Nmap Scripting Engine
1. Execute Individual Scripts
2. Execute Multiple Scripts
3. Execute Scripts by Category
4. Execute Multiple Script Categories
5. Troubleshoot Scripts
6. Update the Script Database
Nmap (“Network Mapper”) is a free and open source utility for network discovery and security auditing. Many systems and network administrators also find it useful for tasks such as network inventory, managing service upgrade schedules, and monitoring host or service uptime. Nmap uses raw IP packets in novel ways to determine what hosts are available on the network, what services (application name and version) those hosts are offering, what operating systems (and OS versions) they are running. It was designed to rapidly scan large networks, but works fine against single hosts.
Nmap can be used in a variety of ways depending on the user’s level of technical expertise.
| Technical Expertise | Usage |
|---|---|
| Beginner | Zenmap the graphical user interface for Nmap |
| Intermediate | Command line |
| Advanced | Python scripting with the Python-Nmap package |
nmap [ <Scan Type> ...] [ <Options> ] { <target specification> }
The -s switch determines the type of scan to perform.
| Nmap Switch | Description |
|---|---|
| -sA | ACK scan |
| -sF | FIN scan |
| -sI | IDLE scan |
| -sL | DNS scan (a.k.a. list scan) |
| -sN | NULL scan |
| -sO | Protocol scan |
| -sP | Ping scan |
| -sR | RPC scan |
| -sS | SYN scan |
| -sT | TCP connect scan |
| -sW | Windows scan |
| -sX | XMAS scan |
nmap [target]
nmap [target1, target2, etc]
nmap -iL [list.txt]
nmap [range of IP addresses]
nmap [ip address/cdir]
nmap -iR [number]
nmap [targets] --exclude [targets]
nmap [targets] --excludefile [list.txt]
nmap -A [target]
nmap -6 [target]
nmap -F [target]
nmap -p [port(s)] [target]
nmap -p [port name(s)] [target]
nmap -sU -sT -p U:[ports],T:[ports] [target]
nmap -p 1-65535 [target]
nmap --top-ports [number] [target]
nmap -r [target]
nmap -O --osscan-guess [target]
nmap -sV [target]
nmap -sV --version-trace [target]
nmap -sR [target]
Host Discovery
The -p switch determines the type of ping to perform.
| Nmap Switch | Description |
|---|---|
| -PI | ICMP ping |
| -Po | No ping |
| -PS | SYN ping |
| -PT | TCP ping |
nmap -sn [target]
nmap -Pn [target]
nmap -PS [target]
nmap -PA [target]
nmap -PU [target]
nmap -PY [target]
nmap -PE [target]
nmap -PP [target]
nmap -PM [target]
nmap -PO [target]
nmap -PR [target]
nmap --traceroute [target]
nmap -R [target]
nmap -n [target]
nmap --system-dns [target]
Can specify a single server or multiple.
nmap --dns-servers [servers] [target]
nmap -sL [targets]
| Nmap Switch | Description |
|---|
| Nmap Switch | Description |
|---|---|
| -sV | Enumerates software versions |
| Nmap Switch | Description |
|---|---|
| -sC | Run all default scripts |
| Nmap Switch | Description |
|---|
The -t switch determines the speed and stealth performed.
| Nmap Switch | Description |
|---|---|
| -T0 | Serial, slowest scan |
| -T1 | Serial, slow scan |
| -T2 | Serial, normal speed scan |
| -T3 | Parallel, normal speed scan |
| -T4 | Parallel, fast scan |
Not specifying a T value will default to -T3, or normal speed.
| Nmap Switch | Description |
|---|
nmap -f [target]
nmap --mtu [MTU] [target]
nmap -D RND:[number] [target]
nmap -sI [zombie] [target]
nmap --source-port [port] [target]
nmap --data-length [size] [target]
nmap --randomize-hosts [target]
nmap --spoof-mac [MAC|0|vendor] [target]
nmap --badsum [target]
nmap -sS [target]
nmap -sT [target]
nmap -sU [target]
nmap -sN [target]
nmap -sF [target]
nmap -sA [target]
nmap -sA [target]
nmap --scanflags [flags] [target]
nmap -sO [target]
nmap --send-eth [target]
nmap --send-ip [target]
nmap -T[0-5] [target]
nmap --ttl [time] [target]
nmap --min-parallelism [number] [target]
nmap --max-parallelism [number] [target]
nmap --min-hostgroup [number] [targets]
nmap --max-hostgroup [number] [targets]
nmap --initial-rtt-timeout [time] [target]
nmap --max-rtt-timeout [TTL] [target]
nmap --max-retries [number] [target]
nmap --host-timeout [time] [target]
nmap --scan-delay [time] [target]
nmap --max-scan-delay [time] [target]
nmap --min-rate [number] [target]
nmap --max-rate [number] [target]
nmap --defeat-rst-ratelimit [target]
| Nmap Switch | Description |
|---|---|
-oN |
Normal output |
-oX |
XML output |
-oA |
Normal, XML, and Grepable format all at once |
nmap -oN [scan.txt] [target]
nmap -oX [scan.xml] [target]
nmap -oG [scan.txt] [target]
nmap -oA [path/filename] [target]
nmap --stats-every [time] [target]
nmap -oS [scan.txt] [target]
ndiff [scan1.xml] [scan2.xml]
ndiff -v [scan1.xml] [scan2.xml]
ndiff --xml [scan1.xml] [scan2.xml]
nmap -h
nmap -V
nmap -v [target]
nmap -d [target]
nmap --reason [target]
nmap --open [target]
nmap --packet-trace [target]
nmap --iflist
nmap -e [interface] [target]
nmap --script [script.nse] [target]
nmap --script [expression] [target]
nmap --script [category] [target]
nmap --script [category1,category2,etc]
nmap --script [script] --script-trace [target]
nmap --script-updatedb
Reference Sites
- [X] Nmap - The Basics
- [ ] Reference link 1
- [ ] Beginner’s Guide to Nmap
- [ ] Top 32 Nmap Command
- [ ] Nmap Linux man page
- [ ] 29 Practical Examples of Nmap Commands
- [ ] Nmap Scanning Types, Scanning Commands , NSE Scripts
- [ ] Nmap CheatSheet
- [ ] Nmap Cheat Sheet
- [ ] Nmap Cheat Sheet: From Discovery to Exploits
- [ ] Nmap: my own cheatsheet
- [ ] NMAP Commands Cheatsheet
- [ ] Nmap Cheat Sheet
- [ ] Nmap Cheat Sheet