A dense, scannable Nmap reference for authorized network discovery and service enumeration. Use it during the recon phase of a scoped assessment — not as a substitute for written authorization.
Host discovery
| Command | Description |
|---|---|
nmap -sn 10.0.0.0/24 | Ping sweep, no port scan (host discovery only) |
nmap -Pn target | Skip host discovery; treat host as online |
nmap -PS22,80,443 target | TCP SYN discovery on specific ports |
nmap -PA80,443 target | TCP ACK discovery (useful past some stateful filters) |
nmap -PU53,161 target | UDP discovery probes |
nmap -PE -PP -PM target | ICMP echo / timestamp / netmask discovery |
nmap -n target | Never do DNS resolution |
nmap --dns-servers 1.1.1.1 target | Force specific resolvers when -n is not wanted |
Methodology note: Start with -sn on the in-scope CIDR to build a live-host list, then promote only confirmed hosts into port scans. Skipping discovery with -Pn is correct when ICMP is blocked, but it wastes time on dead IPs if you spray it across a /16.
Port scanning
| Command | Description |
|---|---|
nmap -sS target | TCP SYN (stealth) scan — default with privileges |
nmap -sT target | TCP connect scan (no raw-socket privileges needed) |
nmap -sU target | UDP scan (slow; pair with --top-ports first) |
nmap -sA target | ACK scan to map firewall filtering behavior |
nmap -p 1-65535 target | Scan all TCP ports |
nmap -p- target | Shorthand for all 65535 TCP ports |
nmap --top-ports 100 target | Scan the 100 most common ports |
nmap -F target | Fast scan (top 100 ports) |
nmap -p T:22,80,443,U:53,161 target | Mixed TCP/UDP port list |
Workflow: Top-100 or -F first → note open ports → targeted -p- only on high-value hosts. Full UDP -sU -p- is rarely justified on day one.
Service & OS detection
| Command | Description |
|---|---|
nmap -sV target | Detect service versions |
nmap -sV --version-intensity 5 target | Heavier version probes (0–9) |
nmap -O target | OS detection |
nmap -A target | Aggressive: -sV -O, script scan, traceroute |
nmap -sC target | Default NSE script set (--script=default) |
nmap --script vuln target | vuln NSE category (noisy; scoped only) |
nmap --script "http-*" -p 80,443 target | Category/wildcard scripts on web ports |
Prefer -sV -sC over blanket -A when you need predictable, reviewable output. Reserve --script vuln for hosts already confirmed in scope and after softer fingerprinting.
Timing, evasion-adjacent controls & output
| Command | Description |
|---|---|
nmap -T4 target | Faster timing template (0=paranoid … 5=insane) |
nmap -T2 target | Slower timing for fragile or tightly monitored nets |
nmap --min-rate 500 target | Floor packet rate (use carefully) |
nmap --max-retries 2 target | Cap retransmits on filtered ports |
nmap -oN out.txt target | Normal output to file |
nmap -oX out.xml target | XML output |
nmap -oG out.gnmap target | Grepable output |
nmap -oA base target | All three formats (base.nmap/.xml/.gnmap) |
Always capture -oA during engagements so later tooling (Metasploit db_import, custom parsers) can consume the same run.
NSE scripting workflows
NSE is where Nmap stops being “just ports” and becomes structured enumeration.
| Goal | Example |
|---|---|
| HTTP titles / headers | nmap -p 80,443 --script http-title,http-headers,http-server-header target |
| TLS cert metadata | nmap -p 443 --script ssl-cert,ssl-enum-ciphers target |
| SMB dialect / shares (authz required) | nmap -p 445 --script smb-protocols,smb-enum-shares target |
| SSH host keys / auth methods | nmap -p 22 --script ssh-hostkey,ssh-auth-methods target |
| Script args | nmap --script http-enum --script-args http-enum.basepath=/api/ target |
Discipline: Prefer named scripts over --script vuln on first pass. Log script args in your notes — unreproducible NSE runs waste retest time.
Output parsing pipelines
After -oA engagement/host:
# Open TCP ports from grepable output
awk '/Ports:/{print}' engagement/host.gnmap
# Quick XML → service list with Nmap's companion (if installed)
xsltproc engagement/host.xml
# Feed XML into other tools that accept Nmap XML
# (example pattern only — use your lab's importer)
Keep one directory per host or per wave (wave1/, wave2/) so differential scans (what changed after a patch window) stay honest.
Recommended scan ladders (lab methodology)
- Discovery:
nmap -sn -n -oA disc <CIDR> - Fast ports:
nmap -Pn -sS -F -sV --version-light -oA fast <hosts> - Deep TCP on VIP hosts:
nmap -Pn -sS -p- -sV -sC -oA deep <vip> - UDP top ports:
nmap -Pn -sU --top-ports 50 -sV -oA udp <vip> - Targeted NSE: only for confirmed services you will actually test
Common mistakes
- Running
-A -T5 -p-against entire subnets on day one (noise + incomplete results). - Treating filtered ports as closed without a second timing/technique check.
- Importing stale XML from a prior engagement into the current workspace.
- Scanning out-of-scope cloud metadata IPs or neighbors because DHCP moved.
Ethics & authorization
Only scan systems you own or are explicitly authorized to test. Record scope (CIDRs, exclusions, rate limits) before the first packet. Nmap is a dual-use tool — methodology and paperwork are part of the skill.