NMAP

Complete Tutorial & Command Reference

Every Flag · Every Mode · Full Comments

Version Nmap 7.x / 2024

Audience Beginners → Advanced

Focus All flags with inline comments

Use Case Recon · Audit · CTF · Pentesting

■ Always obtain written permission before scanning any network you do not own.
NMAP COMPLETE TUTORIAL Nmap Network Scanner Reference

Table of Contents
1. What is Nmap?
2. Installation
3. Basic Syntax
4. Target Specification
5. Host Discovery (Ping Scanning)
6. Port Scanning Techniques
7. Service & Version Detection
8. OS Detection
9. Timing & Performance
10. Firewall / IDS Evasion & Spoofing
11. Output Formats
12. Nmap Scripting Engine (NSE)
13. Advanced & Miscellaneous Flags
14. IPv6 Scanning
15. Practical Examples & Cheat Sheet

For educational & authorized use only Page 2

NMAP COMPLETE TUTORIAL Nmap Network Scanner Reference

1. What is Nmap?
Nmap (Network Mapper) is a free, open-source tool for network discovery and security auditing. It uses raw IP
packets to determine hosts alive on a network, what services (application name and version) those hosts offer,
what OSes (and OS versions) they run, what type of packet filters/firewalls are in use, and dozens of other
characteristics.

Originally written by Gordon Lyon (Fyodor), Nmap is a standard tool in every penetration tester's, sysadmin's,
and defender's toolkit.

2. Installation
Linux (Debian/Ubuntu)

$ sudo apt update && sudo apt install nmap -y

# Installs nmap from the official repos

Linux (RHEL/Fedora)

$ sudo dnf install nmap

macOS

$ brew install nmap

# Requires Homebrew: [Link]

Windows

# Download installer from: [Link]

# Installs Nmap + Npcap (packet capture driver)

Verify installation:

$ nmap --version
Nmap version 7.94 ( [Link] )

For educational & authorized use only Page 3

NMAP COMPLETE TUTORIAL Nmap Network Scanner Reference

3. Basic Syntax

$ nmap [Scan Type(s)] [Options] {target specification}

# Examples:
$ nmap [Link]
$ nmap -sV -p 1-1000 [Link]/24
$ nmap -A -T4 [Link]

Nmap requires root/administrator privileges for most raw-packet scan types (SYN, OS detection, etc.). Run with
sudo on Linux/macOS.

For educational & authorized use only Page 4

NMAP COMPLETE TUTORIAL Nmap Network Scanner Reference

4. Target Specification
Nmap accepts a wide variety of target formats. Targets can be mixed freely on the command line.

Flag / Option Description & Comment

-iL <file> Read target hosts/networks from a file (one per line). Useful for large scope engagements.

-iR <num> Choose <num> random targets. Useful for internet-wide research. -iR 0 = infinite.

--exclude <host1,...> Comma-separated list of hosts/CIDRs to exclude from the scan. Prevents accidental scanning of out-of-scope ta

--excludefile <file> Exclude targets listed in a file (one per line). Same as --exclude but file-based.

[Link] Single IPv4 host.

[Link]-254 Range of IPs from .1 to .254 on the 192.168.1.x subnet.

[Link]/24 CIDR notation — scans all 256 addresses in [Link] to [Link].

10.0.0-5.1-254 Octet ranges — generates all combinations between the ranges.

[Link] Hostname — Nmap resolves DNS then scans resulting IP(s).

192.168.1.* Wildcard — equivalent to [Link]/24.

Examples

$ nmap [Link] [Link] [Link]

# Scan three individual hosts

$ nmap [Link]/8
# Scan the entire class-A private range (16 million IPs) — very slow!

$ nmap -iL [Link] --exclude [Link]

# Read from file but skip the gateway

For educational & authorized use only Page 5

NMAP COMPLETE TUTORIAL Nmap Network Scanner Reference

5. Host Discovery (Ping Scanning)

Before port scanning, Nmap checks if hosts are alive. This phase can be customised or skipped entirely.

Flag / Option Description & Comment

-sn Ping Scan — disable port scan. Only do host discovery. Formerly -sP. Shows which hosts are up without port de

-Pn Treat all hosts as online — skip host discovery. Essential when ICMP is blocked by firewall. Every specified hos

-PS [portlist] TCP SYN ping to listed ports (default 80). Host is considered up if SYN/ACK or RST returned. Good alternative

-PA [portlist] TCP ACK ping to listed ports (default 80). Sends ACK packet — RST reply means host is up. Often passes thro

-PU [portlist] UDP ping to listed ports (default 40125). Empty UDP packet sent; ICMP port-unreachable response means host

-PY [portlist] SCTP INIT ping. Sends INIT chunk; INIT-ACK or ABORT means host is up. Useful for SCTP-aware systems.

-PE ICMP Echo request ping (traditional ping). Blocked by many firewalls but fastest when allowed.

-PP ICMP Timestamp request. Alternative to Echo; may pass firewalls that only block Echo.

-PM ICMP Address Mask request. Rarely blocked, but many modern OSes don't respond.

-PO [protos] IP Protocol Ping — sends packets with specified IP protocol numbers. Probes multiple protocols simultaneously

-PR ARP Ping (auto on local Ethernet). Extremely reliable on LAN; bypasses firewall entirely since ARP is layer-2.

-n Never do DNS resolution. Speeds up scanning when hostnames are not needed.

-R Always resolve DNS for every target IP, even if host appears down.

--dns-servers <s1,s2> Specify custom DNS servers instead of system default. Useful to test internal DNS or avoid ISP DNS logging.

--system-dns Use the OS DNS resolver instead of Nmap's internal resolver (slower, but uses /etc/[Link] exactly).

--traceroute Trace hop path to each host after scan. Shows network path using post-scan probes.

Examples

$ nmap -sn [Link]/24

# Quick host discovery — no port scan, just find live hosts

$ nmap -Pn -p 22,80,443 [Link]

# Skip ping, assume host is up, scan only ports 22/80/443

$ nmap -PS22,80,443 -PA80 [Link]/24

# Use TCP SYN ping on 22/80/443 AND TCP ACK ping on 80

For educational & authorized use only Page 6

NMAP COMPLETE TUTORIAL Nmap Network Scanner Reference

6. Port Scanning Techniques

Nmap supports over a dozen scan types. The choice of scan type affects stealth, accuracy, speed, and the
required privilege level.

Flag / Option Description & Comment

-sS TCP SYN Scan (Stealth Scan). Default for root. Sends SYN, reads SYN/ACK (open) or RST (closed). Never com

-sT TCP Connect Scan. Full 3-way handshake via OS syscall. Used when SYN scan is unavailable (non-root). Slow

-sU UDP Scan. Sends empty UDP packets (or protocol-specific payloads). Open ports may not reply; closed ports re

-sA TCP ACK Scan. Sends ACK packet. Does NOT determine open/closed — only whether port is filtered by firewa

-sW TCP Window Scan. Like ACK scan but also examines TCP window field to distinguish open from closed on som

-sM TCP Maimon Scan. FIN/ACK probe. Named after Uriel Maimon. Same behavior as FIN scan on most systems.

-sN TCP Null Scan. Sends packet with no flags set. Open/filtered ports don't reply; closed ports return RST. Bypass

-sF TCP FIN Scan. Sends FIN flag. Same interpretation as Null scan. Stealthy but unreliable on Windows.

-sX TCP Xmas Scan. Sets FIN+PSH+URG flags (lights up like a Christmas tree). Same as FIN/Null — stealthy, non

-sI <zombie> Idle (Zombie) Scan. Uses a third-party 'zombie' host with predictable IP ID to scan target completely blindly. Mos

-sY SCTP INIT Scan. Like SYN scan for SCTP protocol. Sends INIT chunk; INIT-ACK = open, ABORT = closed.

-sZ SCTP COOKIE-ECHO Scan. Sends COOKIE-ECHO; no response = open/filtered, ABORT = closed. Harder to d

-sO IP Protocol Scan. Determines which IP protocols (TCP, UDP, ICMP, IGMP, etc.) are supported by target. Iterate

-b <FTP relay> FTP Bounce Scan. Uses FTP server's PORT command to proxy a port scan. Old technique; most FTP servers n

-p <portlist> Specify ports to scan. Examples: -p 22 | -p 22,80,443 | -p 1-1024 | -p U:53,T:80 | -p- (all 65535 ports).

-p- Scan all 65,535 TCP ports. Equivalent to -p 1-65535. Important: default scan only covers 1000 common ports!

-F Fast mode — scan only the 100 most common ports instead of 1000.

-r Scan ports in sequential (consecutive) order instead of randomised order.

--top-ports <n> Scan the n most common ports as determined by Nmap's frequency data (nmap-services file).

--port-ratio <ratio> Scan ports with frequency ratio higher than <ratio> (0.0 to 1.0). Alternative to --top-ports.

Port States Explained

State Meaning

open Application is actively accepting connections on this port.

closed Port is accessible but no application listening. Useful for OS detection.

filtered Firewall/filter is blocking probes — Nmap can't determine open/closed.

unfiltered Port is accessible but Nmap can't determine open/closed (only ACK scan).

open|filtered Nmap can't distinguish — common for UDP and stealthy scans.

closed|filtered Only seen in Idle scan — can't distinguish closed from filtered.

For educational & authorized use only Page 7

NMAP COMPLETE TUTORIAL Nmap Network Scanner Reference

Examples

$ sudo nmap -sS -p- [Link]

# Full SYN stealth scan on ALL 65535 ports (needs root)

$ nmap -sT -p 22,80,443,8080 [Link]

# TCP connect scan on specific ports (no root needed)

$ sudo nmap -sU --top-ports 100 [Link]

# UDP scan of top 100 UDP ports (slow, be patient)

$ sudo nmap -sS -sU -p T:80,U:53 [Link]

# Combined TCP SYN + UDP scan simultaneously

For educational & authorized use only Page 8

NMAP COMPLETE TUTORIAL Nmap Network Scanner Reference

7. Service & Version Detection

Version detection probes open ports to identify the service name, version, and sometimes additional info like
hostname, device type, or OS.

Flag / Option Description & Comment

-sV Enable version detection. Nmap sends a series of probes to open ports and matches responses against nmap-s

Control probe intensity. 0 = only most likely probes; 9 = every probe in the database. Higher = slower but more a
--version-intensity <0-9>

--version-light Alias for --version-intensity 2. Faster but misses some services.

--version-all Alias for --version-intensity 9. Tries every single probe. Use when default misses the service.

--version-trace Print detailed debug info about version scan activity. Useful for diagnosing why a service isn't detected.

$ nmap -sV [Link]

# Detect service versions on default 1000 ports

$ nmap -sV --version-intensity 9 -p- [Link]

# Maximum intensity version scan on ALL ports

$ nmap -sV --version-trace [Link] 2>&1 | head -50

# Debug version detection output

For educational & authorized use only Page 9

NMAP COMPLETE TUTORIAL Nmap Network Scanner Reference

8. OS Detection
Nmap's OS detection uses a database of over 2,600 OS fingerprints. It sends a series of TCP/UDP/ICMP
packets and analyses the responses to match the target's TCP/IP stack behaviour.

Flag / Option Description & Comment

-O Enable OS detection. Requires at least one open and one closed TCP port. Needs root/admin privileges.

--osscan-limit Limit OS detection to hosts with at least one open and one closed port. Skips hosts unlikely to yield reliable resu

--osscan-guess Guess more aggressively when OS detection is uncertain. Prints best match even if confidence is low. Useful fo

--max-os-tries <n> Set maximum number of OS detection attempts against each target (default: 5). Reduce for speed, increase for

$ sudo nmap -O [Link]

# Basic OS detection

$ sudo nmap -O --osscan-guess [Link]

# Aggressive guessing for uncertain targets

$ sudo nmap -A [Link]

# -A = -O + -sV + --traceroute + default scripts (all-in-one)

For educational & authorized use only Page 10

NMAP COMPLETE TUTORIAL Nmap Network Scanner Reference

9. Timing & Performance

Nmap's timing templates (-T) and individual timing options control the balance between speed and
stealth/reliability.

Template Behaviour

-T0 (Paranoid) Extremely slow — 5 min between probes. Designed to evade IDS. Single port scanned at a time.

-T1 (Sneaky) Very slow — 15 sec between probes. Still IDS-evasion focused but faster than T0.

-T2 (Polite) Slows scan 10x below default. Uses less bandwidth, less likely to crash services.

-T3 (Normal) Default timing. Balances speed and reliability. Nmap's best guess for typical networks.

-T4 (Aggressive) Assumes fast, reliable network. Reduced timeouts. Good for CTFs and local networks.

-T5 (Insane) Maximum speed. May miss results on slow networks. Use only on fast local LANs.

Fine-Grained Timing Controls

Flag / Option Description & Comment

--min-hostgroup <size>Minimum parallel hosts scanned simultaneously.

--max-hostgroup <size>Maximum parallel hosts scanned simultaneously.

--min-parallelism <n> Minimum number of parallel probes Nmap maintains.

--max-parallelism <n> Maximum parallel probes. Set to 1 for sequential scanning.

--min-rtt-timeout <ms>Minimum round-trip timeout. Prevents too-short timeouts on fast networks.

--max-rtt-timeout <ms>Maximum round-trip timeout. Prevents waiting too long for slow hosts.

--initial-rtt-timeout Initial
<ms>RTT timeout before adaptive algorithm takes over.

--max-retries <n> Cap retransmission attempts per port. Default 10. Set to 1 for speed.

--host-timeout <time> Skip host if scan takes longer than <time> (e.g. 30m). Prevents hanging.

--scan-delay <time> Add delay between probes to a host. Used for rate limiting / IDS evasion.

Maximum delay between probes. Nmap adapts delay; this caps it.
--max-scan-delay <time>

--min-rate <n> Send packets no slower than n per second. May reduce accuracy on lossy networks.

--max-rate <n> Send packets no faster than n per second. Good for bandwidth-limited targets.

--defeat-rst-ratelimitIgnore RST rate limiting when measuring open|filtered UDP ports.

$ nmap -T4 --max-retries 1 --min-rate 1000 [Link]/24

# Fast aggressive scan with rate limiting

$ nmap -T0 --scan-delay 5s [Link]

# Ultra-slow IDS-evasion scan with 5-second delay between probes

For educational & authorized use only Page 11

NMAP COMPLETE TUTORIAL Nmap Network Scanner Reference

10. Firewall / IDS Evasion & Spoofing

These techniques help bypass firewalls and intrusion detection systems (IDS). ■ Only use on networks you
have permission to scan.

Flag / Option Description & Comment

-f Fragment IP packets into 8-byte pieces. Many older firewalls/IDS fail to reassemble fragmented packets, letting

-f -f (or --mtu 16) Double-fragment into 16-byte pieces for extra evasion.

--mtu <n> Set custom packet fragment size (must be multiple of 8). Lower = more fragments = harder to inspect.

-D <decoy1,decoy2,...>Cloak scan with decoys. Sends packets from real IP AND spoofed decoy IPs simultaneously. Makes it hard to id

-S <IP> Spoof source IP address. Responses go to spoofed IP, so you won't receive them — combine with --packet-trac

-e <interface> Specify which network interface to use for sending/receiving packets.

-g <portnum> Spoof source port number. Some firewalls allow traffic from 'trusted' ports like 53 (DNS) or 20 (FTP data). -g 53
(or --source-port)

--proxies <url,...> Relay TCP connections through HTTP/SOCKS4 proxy chain. Note: Only affects TCP connect scans; does not a

--data <hex> Append custom hex payload to packets. Can confuse fingerprinting.

--data-string <string>Append ASCII string payload to packets.

--data-length <n> Append n random bytes to packets. Makes packet sizes non-standard — may evade size-based signatures.

--ip-options <opts> Send packets with specified IP options (e.g. RR, LSRR, SSRR). Can cause packets to take unusual routes.

--ttl <n> Set IP TTL field to n. Can be used to make packets expire before reaching intermediate IDS.

--randomize-hosts Randomise order of targets to avoid sequential scanning pattern detection.

--spoof-mac <mac> Spoof source MAC address. Use 0 for random MAC, or specify OUI prefix or full MAC. Only works on local Ethe

--badsum Send packets with deliberately bad TCP/UDP/SCTP checksums. Most firewalls drop these; real hosts send RST

$ sudo nmap -sS -f -D RND:10 -T2 [Link]

# Fragmented SYN scan with 10 random decoys, slow timing

$ sudo nmap -sS -g 53 [Link]

# Use source port 53 to bypass DNS-trusting firewall rules

$ sudo nmap --spoof-mac 0 -sS [Link]

# Random MAC address spoof (local network only)

For educational & authorized use only Page 12

NMAP COMPLETE TUTORIAL Nmap Network Scanner Reference

11. Output Formats

Nmap can save results in multiple formats simultaneously. Always save output during penetration tests — you
can't re-scan after the engagement.

Flag / Option Description & Comment

-oN <file> Normal output — human-readable text. Same as what appears in terminal. Good for reading directly.

-oX <file> XML output — machine-parseable. Used by Metasploit, Nessus importers, and custom scripts. Best for program

-oG <file> Grepable output — one host per line. Easy to grep/awk for specific info. Deprecated but widely used in scripts.

-oS <file> ScRipT KiDDiE output — leet-speak format. Joke format, rarely useful.

-oA <basename> Output in ALL three main formats at once (-oN, -oX, -oG) using [Link], [Link], [Link]

-v Increase verbosity. Shows discovered open ports in real time. Use -vv for even more detail.

-vv Very verbose. Shows packet-level details, timing info, and reason for each port state.

-d Increase debugging level. Use -dd, -ddd etc. for progressively more internal debug info.

--reason Show the reason each port is in its state (e.g. 'syn-ack', 'rst', 'no-response'). Very useful for understanding result

--open Only show open (or possibly open) ports. Hides closed and filtered ports — cleaner output for large scans.

--packet-trace Show every packet sent and received. Useful for debugging firewall behaviour, but very verbose.

--iflist List network interfaces and routes detected by Nmap. Useful for -e interface selection.

--append-output Append to output files instead of overwriting. Useful for incremental scans.

--resume <file> Resume a previously aborted scan from the grepable or XML output file.

--noninteractive Disable interactive keyboard commands during scan (useful in scripts/automation).

Apply XSL stylesheet to XML output for HTML rendering in browser.

--stylesheet <path/URL>

--webxml Use Nmap's web stylesheet ([Link] for XML output.

--no-stylesheet Remove any stylesheet reference from XML output.

$ nmap -sV -oA full_scan [Link]/24

# Save results as full_scan.nmap, full_scan.xml, full_scan.gnmap

$ nmap -sS -p- --open -oN open_ports.txt [Link]

# Scan all ports, show only open, save to text file

$ nmap --resume full_scan.gnmap

# Resume interrupted scan

$ grep 'open' full_scan.gnmap | awk '{print $2}'

# Extract IPs with open ports from grepable output

For educational & authorized use only Page 13

NMAP COMPLETE TUTORIAL Nmap Network Scanner Reference

12. Nmap Scripting Engine (NSE)

NSE allows users to write (and share) scripts to automate network tasks. Scripts are written in Lua and cover
vulnerability detection, exploitation, authentication brute-force, service enumeration, and more. Scripts live in
/usr/share/nmap/scripts/.

Flag / Option Description & Comment

-sC Run default scripts — equivalent to --script=default. Safe, informative scripts that run against every open port.

Run specified scripts. Can be: name (http-title), category (vuln, safe, auth, brute, discovery, dos, exploit, externa
--script <name|cat|dir|expr>

Pass arguments to scripts. Example: --script-args [Link]='Mozilla'. Each script documents its args in its
--script-args <n=v,...>

Read script arguments from a file instead of command line.

--script-args-file <file>

--script-trace Show all data sent and received by scripts. Useful for debugging custom scripts.

--script-updatedb Update the script database (nmap-script-db) after adding new scripts. Run after manually adding .nse files.

--script-help <name> Show help for a specific script or category without running a scan.

Script Categories
Category Description

auth Scripts dealing with authentication credentials (bypass, bruteforce).

broadcast Discover hosts/services via broadcast — not sent to specific target.

brute Brute-force credential attacks against services (ssh-brute, ftp-brute, etc.).

default Safe, fast, useful scripts run with -sC. Best signal-to-noise ratio.

discovery Enumerate network info: DNS, SNMP, NetBIOS, HTTP, SMB enumeration.

dos Denial of service tests. ■ Intrusive — may crash services.

exploit Actively exploit vulnerabilities. ■ May cause damage.

external Uses third-party services (Whois, Shodan) — sends data out.

fuzzer Send randomised or crafted inputs to find bugs.

intrusive Likely to crash, consume resources, or be logged. Not safe for production.

malware Detect signs of malware, backdoors, or rootkits.

safe Low risk, unlikely to crash or adversely affect target. Use freely.

version Run by -sV to help identify service versions more accurately.

vuln Check for specific known vulnerabilities (EternalBlue, Shellshock, etc.).

Common NSE Script Examples

For educational & authorized use only Page 14

NMAP COMPLETE TUTORIAL Nmap Network Scanner Reference

$ nmap -sC -sV [Link]

# Default scripts + version detection — the everyday pentester combo

$ nmap --script vuln [Link]

# Run all vulnerability detection scripts

$ nmap --script smb-vuln-ms17-010 -p 445 [Link]

# Check for EternalBlue / WannaCry vulnerability (MS17-010)

$ nmap --script http-title,http-methods -p 80,443,8080 [Link]/24

# Get HTTP page titles and allowed methods across subnet

$ nmap --script ssh-brute --script-args userdb=[Link],passdb=[Link] -p 22 [Link]

# SSH brute force (only on authorised targets!)

$ nmap --script 'safe and discovery' [Link]

# Run all safe discovery scripts

$ nmap --script-help http-shellshock

# View script documentation without running scan

For educational & authorized use only Page 15

NMAP COMPLETE TUTORIAL Nmap Network Scanner Reference

13. Advanced & Miscellaneous Flags

Flag / Option Description & Comment

-A Aggressive scan: enables -O (OS detection) + -sV (version) + -sC (default scripts) + --traceroute. One flag for co

Abort NSE scripts running longer than <time> to prevent hanging on slow/broken services.
--script-timeout <time>

--send-eth Send packets at Ethernet layer (layer 2) using raw sockets. Bypasses OS IP stack. Required for some scan type

--send-ip Send packets at IP layer (layer 3) through OS raw socket API. Default on non-Ethernet interfaces.

--privileged Assume user has full raw socket privileges even if not root. Useful in capability-based systems.

--unprivileged Assume no raw socket privileges — use only connect() calls and limited techniques.

-6 Enable IPv6 scanning. Target must be specified as IPv6 address or hostname resolving to AAAA record.

-V (capital V) Print Nmap version number and exit.

-h Print help summary and exit. Quick reference for flags.

--datadir <dir> Override directory containing nmap data files (nmap-services, nmap-os-db, etc.).

--servicedb <file> Use custom service file instead of nmap-services.

--versiondb <file> Use custom version detection probes file instead of nmap-service-probes.

--log-errors Log errors and warnings to output files in addition to stderr.

--adler32 Use deprecated Adler32 checksum algorithm in SCTP scans (compatibility mode).

--release-memory Release memory before quitting (debugging aid for memory leak detection).

For educational & authorized use only Page 16

NMAP COMPLETE TUTORIAL Nmap Network Scanner Reference

14. IPv6 Scanning

Nmap supports IPv6 with the -6 flag. Most scan types and NSE scripts work with IPv6. Host discovery is
different — no broadcast; use multicast or known addresses.

$ nmap -6 ::1
# Scan IPv6 localhost

$ nmap -6 2001:db8::1
# Scan specific IPv6 host

$ nmap -6 -sV -p 22,80,443 fe80::1%eth0

# Scan link-local address on eth0 interface

$ nmap -6 --script ipv6-node-info [Link]

# Query IPv6 node information

$ nmap -6 -sn ff02::1%eth0

# Ping all-nodes multicast — host discovery on IPv6 LAN

Note: IPv6 CIDR notation (e.g. 2001:db8::/32) is not supported by Nmap for target ranges. Use -iL with a list of
individual IPv6 addresses instead.

For educational & authorized use only Page 17

NMAP COMPLETE TUTORIAL Nmap Network Scanner Reference

15. Practical Examples & Cheat Sheet

Use Case Command

Quick host discovery nmap -sn [Link]/24

Fast top-100 port scan nmap -F [Link]

Full port scan (all 65535) sudo nmap -sS -p- [Link]

Version + default scripts nmap -sC -sV [Link]

Full aggressive scan sudo nmap -A -T4 [Link]

UDP top ports sudo nmap -sU --top-ports 50 [Link]

OS detection sudo nmap -O [Link]

Vuln scan nmap --script vuln [Link]

SMB vulnerability check nmap --script smb-vuln* -p 445 [Link]

HTTP enumeration nmap --script http-enum -p 80,443 [Link]

Save all formats nmap -oA results [Link]

Firewall evasion with decoys sudo nmap -sS -D RND:5 -f [Link]

Slow IDS evasion sudo nmap -sS -T0 --scan-delay 10s [Link]

Subnet + open ports only nmap -sS --open -oG - [Link]/24

Custom source port (DNS bypass) sudo nmap -sS -g 53 [Link]

Ping scan without DNS nmap -sn -n [Link]/24

Resume aborted scan nmap --resume [Link]

Script help nmap --script-help http-title

Pro Tips
■ Always use -oA on real engagements — save everything before forgetting.

■ Combine -sS -sU to scan both TCP and UDP in one pass.
■ sudo nmap -sS is faster and stealthier than nmap -sT — get root.

■ Run nmap --script-updatedb after downloading new NSE scripts.

■ Use -v during long scans — see live results as ports are discovered.

■ For web apps, always add -p 80,443,8080,8443,8888 explicitly.

■ -Pn is essential when targeting hosts behind strict firewalls.

■ Combine Nmap output with tools like nmaptocsv or nmap-formatter for reporting.

■ LEGAL DISCLAIMER: Scanning networks without explicit written permission is illegal in most
jurisdictions. This document is for educational purposes and authorised security testing only. Always
obtain written permission from the asset owner before conducting any network scans.

For educational & authorized use only Page 18