Nmap Complete Guide — Exhaustive options, effects, and
actions
This document explains Nmap command-line options (based on Nmap 7.98SVN help output) in clear terms,
what will happen when you use them, and recommended actions. Update the examples with your real
cases. Always have explicit permission before scanning.
TARGET SPECIFICATION
What it is: How to tell Nmap which hosts or networks to scan.
What will happen: Nmap expands your specification into individual IP addresses or hostnames and queues
them for scanning.
What to do: Use precise target lists, avoid scanning external targets without permission, and use --exclude
or --excludefile to skip sensitive hosts.
• Examples: [Link], [Link]/24, [Link];10.0.0-255.1-254
• -iL <inputfilename>: Read targets from a file (one per line)
• -iR <num hosts>: Scan random targets (use with extreme caution)
• --exclude / --excludefile: Skip hosts you don't want to touch
HOST DISCOVERY
What it is: The initial phase to determine whether targets are 'up' before port scanning.
What will happen: Nmap sends probes (ICMP, TCP/UDP, SCTP) according to your flags. If discovery finds
hosts down, subsequent port scans might be skipped unless you force them with -Pn.
What to do: If pings are blocked by a firewall, use -Pn to force scanning. For stealth, pick specific probe
types (PS/PA/PU) to mimic legitimate traffic.
• -sL: List targets without probing (verify expansion)
• -sn: Ping scan - find which hosts are up without port scans
• -Pn: Skip discovery and treat all hosts as up (use when ICMP blocked)
• -PS/-PA/-PU/-PY: Use TCP SYN/ACK/UDP/SCTP probes to discover hosts
• -n / -R: control DNS resolution behavior
• --traceroute: map path to each host (adds time)
SCAN TECHNIQUES
What it is: The packet-level methods used to test ports.
What will happen: Different scan types trigger different server behaviors and logs. SYN scans are stealthier;
connect() scans are more likely to be logged.
What to do: Use -sS for stealth when you have raw-socket privileges; use -sT when you don't. For UDP
services, -sU is necessary but expect slowness.
• -sS: TCP SYN (half-open) scan - stealthy, fast
• -sT: TCP connect() - reliable without raw sockets
• -sU: UDP scan - slow, needs tuning
• -sN/-sF/-sX: TCP Null/FIN/Xmas scans for firewall evasion
• -sI: Idle (zombie) scan - hides source using third party
• -sO: IP protocol scan - enumerates supported IP protocols
• -b: FTP bounce scan - rarely useful nowadays
PORT SPECIFICATION & ORDER
What it is: Controls which ports Nmap probes on each host.
What will happen: Narrow port lists scan faster; full scans (-p-) check all 65535 ports and take much longer.
What to do: For quick checks use --top-ports or -F; when investigating specific services, target known ports.
• -p <ports>: list ports and ranges (e.g., -p22,80,443 or -p1-65535)
• --exclude-ports: skip specified ports
• -F: fast mode (popular ports only)
• --top-ports <n>: scan the n most common ports
• --port-ratio <ratio>: scan based on port commonness
SERVICE & VERSION DETECTION
What it is: Probing open ports to identify running services and their versions.
What will happen: Nmap sends application-layer probes and parses responses to guess service names and
versions. This can be intrusive and take extra time.
What to do: Use -sV when you need version detail. Reduce intensity in fragile environments.
• -sV: perform version detection
• --version-intensity <0-9>: control aggressiveness (0 light -> 9 exhaustive)
• --version-light / --version-all: presets for intensity
NMAP SCRIPTING ENGINE (NSE)
What it is: A Lua-based scripting engine enabling scripts for discovery, vulnerability detection, brute force,
and more.
What will happen: Running scripts can produce lots of network traffic and may be intrusive.
What to do: Use --script=default for safe checks; run vuln scripts only with permission.
• -sC: shorthand for --script=default
• --script=<list or category>: run selected scripts or categories (e.g., vuln, auth)
• --script-args / --script-args-file: pass parameters to scripts
• --script-trace: show script communications for debugging
• --script-updatedb: refresh the scripts DB after changes
OS DETECTION
What it is: Attempts to determine the remote operating system by analyzing network behavior.
What will happen: Nmap sends probes and compares responses to a fingerprint database; results can be
inaccurate behind firewalls.
What to do: Use -O on trusted networks and combine with other evidence.
• -O: enable OS detection
• --osscan-limit / --osscan-guess: control probing scope and guessing level
TIMING & PERFORMANCE
What it is: Parameters that balance speed, reliability, and stealth.
What will happen: Faster settings increase noise and risk; slower settings are stealthier.
What to do: Use -T4 for fast LAN scans; -T3 or lower on sensitive networks. Tune rates for large scans.
• -T<0-5>: timing template (0 slowest, 5 fastest)
• --min-hostgroup / --max-hostgroup: parallel host grouping sizes
• --min-parallelism / --max-parallelism: probes in flight
• --max-retries / --host-timeout: control retries and total time
• --scan-delay / --max-scan-delay: force delays between probes
• --min-rate / --max-rate: control packets per second
FIREWALL / IDS EVASION & SPOOFING
What it is: Options to try to avoid detection, evade filtering, or disguise scans.
What will happen: Evasion may confuse defenders but is often blocked; it can be illegal.
What to do: Only use evasion on networks you control; prefer tuning timing and probes first.
• -f / --mtu <val>: fragment packets
• -D <decoys>: mix scans with decoy addresses to hide origin
• -S <addr>: spoof source address (requires network control)
• -e <iface>: choose source interface / IP
• --proxies <url1,...>: tunnel through proxies
• --spoof-mac <vendor/prefix>: change MAC reported by NIC
• --badsum: send packets with bad checksums (may break results)
OUTPUT FORMATS & LOGGING
What it is: How Nmap reports and saves scan results.
What will happen: XML output is machine-readable; -oA writes multiple formats. Protect output files as they
are sensitive.
What to do: Use -oA <basename> for full reporting; use --append-output to keep history.
• -oN / -oX / -oG / -oS: normal, XML, grepable, s|<rIpt output formats (note: replace < and > when writing)
• -oA <basename>: write normal, XML and grepable
• --append-output: append instead of overwrite
• --resume <file>: resume an aborted scan
MISCELLANEOUS & ADVANCED
What it is: Other useful flags and behaviors.
What will happen: Flags like -6 enable IPv6 scans; --privileged matters for raw sockets. Interactive legacy
options exist but are rarely used.
What to do: Read manpage for niche options and use --datadir to test custom script sets.
• -6: IPv6 scanning
• -A: aggressive (OS, version, script, traceroute)
• --datadir <dirname>: specify custom Nmap data location
• --send-eth / --send-ip: control raw sending method
• --privileged / --unprivileged: explicitly state assumptions
• -V / -h: version and help
PRACTICAL EXAMPLES & RECIPES
Quick local test
Command: nmap -Pn -sS -sV [Link]
Note: SYN scan + version detection on localhost; safe for testing.
LAN discovery
Command: nmap -v -sn [Link]/24
Note: Ping scan to identify live hosts on a LAN.
Common ports audit
Command: nmap -p 22,80,443 --open --reason [Link]
Note: Check common services and see why ports are marked open/closed.
Full TCP sweep
Command: nmap -p- -T4 target
Note: Scan all TCP ports; can take long on remote networks.
Run default NSE scripts
Command: nmap --script=default target
Note: Non-intrusive script checks.
Vuln script run (authorized)
Command: nmap --script=vuln target
Note: Runs vulnerability scripts; may be intrusive.
SAFETY, LEGAL, AND ETHICAL NOTES
Scanning systems without authorization may be illegal. Always get explicit written permission before
scanning third-party systems. Keep scan logs and findings secure, and use lab environments for aggressive
testing.
QUICK REFERENCE
Common flags: -Pn -sS -sT -sU -p <ports> -sV -O -A -T4 --script=default -oA <basename>
Timing: -T0..-T5 (slow..fast). Use -T4 for LAN, -T3 for internet.