Host discovery
| Command | Description |
|---|---|
nmap -sn 10.0.0.0/24 | Ping sweep, no port scan (host discovery only) |
nmap -Pn target | Skip host discovery, treat host as online |
nmap -PS22,80,443 target | TCP SYN discovery on specific ports |
nmap -n target | Never do DNS resolution |
Port scanning
| Command | Description |
|---|---|
nmap -sS target | TCP SYN (stealth) scan — the default with privileges |
nmap -sT target | TCP connect scan (no raw-socket privileges needed) |
nmap -sU target | UDP scan |
nmap -p 1-65535 target | Scan all TCP ports |
nmap -p- target | Shorthand for all 65535 ports |
nmap --top-ports 100 target | Scan the 100 most common ports |
nmap -F target | Fast scan (top 100 ports) |
Service & OS detection
| Command | Description |
|---|---|
nmap -sV target | Detect service versions |
nmap -O target | OS detection |
nmap -A target | Aggressive: -sV -O, script scan, traceroute |
nmap -sC target | Run the default NSE script set (--script=default) |
nmap --script vuln target | Run the vuln NSE script category |
Timing & output
| Command | Description |
|---|---|
nmap -T4 target | Faster timing template (0=paranoid … 5=insane) |
nmap -oN out.txt target | Normal output to file |
nmap -oX out.xml target | XML output |
nmap -oG out.gnmap target | Grepable output |
nmap -oA base target | All three formats at once (base.nmap/.xml/.gnmap) |
Always scan only systems you are authorised to test.