Nmap

Nmap (Network Mapper) is the de facto standard open-source utility for network discovery and security auditing. It determines which hosts are up, which ports are open, which services (and versions) are listening, and what operating system is running — all by sending crafted packets and analyzing the responses. ¹

Nmap accepts target ranges in any octet (e.g., 10.10.0-255.1-255 scans 10.10.0.1–10.10.255.255).

Port states

Nmap classifies ports into six states:

• open — A service is actively accepting connections.
• closed — The port is reachable but nothing is listening.
• filtered — A firewall or filter prevents Nmap from determining the state.
• unfiltered — The port is reachable but Nmap cannot tell if it is open or closed (seen in ACK scans).
• open|filtered — Nmap cannot determine if the port is open or filtered (seen in UDP and FIN/Xmas/Null scans).
• closed|filtered — Nmap cannot determine if the port is closed or filtered (seen in IP ID idle scans).

Host discovery

When run as root, Nmap uses ARP for local discovery and a combination of ICMP Echo, TCP SYN to 443, TCP ACK to 80, and ICMP Timestamp requests for remote discovery. As an unprivileged user, it falls back to TCP SYN packets to ports 80 and 443 for both local and remote discovery. ²

Flag	Discovery method
-PA	TCP ACK
-PE	ICMP Echo
-PM	ICMP Address Mask
-PP	ICMP Timestamp
-PR	ARP only
-PS	TCP SYN (default port 80, or list e.g. -PS80,8080)
-PU	UDP (reply only on closed ports via ICMP Port Unreachable)
-Pn	Skip discovery; treat all hosts as up

Windows note: The Windows Firewall blocks ICMP by default, so -Pn is often necessary when scanning modern Windows systems.

Scan types

Only one scan type may be used at a time, except that UDP scan (-sU) can be combined with any TCP scan.

Flag	Type	Notes
-sS	SYN scan	Default; sends SYN, waits for SYN/ACK, then RST. Requires root.
-sT	TCP connect scan	Full three-way handshake. Only option for unprivileged users.
-sU	UDP scan	Sends empty UDP packets; most ports return open|filtered. Very slow.
-sA	ACK scan	All ports should RST; useful for mapping firewall rules, not service state.
-sN	Null scan	No TCP flags set. Bypasses stateless firewalls.
-sF	FIN scan	Similar to null scan.
-sX	Xmas scan	FIN, URG, PSH set. Similar to null scan.
-sW	Window scan	Like ACK but examines TCP window size in RSTs for anomalies.
-sM	Maimon scan	FIN+ACK; mostly of historical interest.
-sI	Idle/Zombie scan	Spoofed scan via an idle zombie host; extremely slow and stealthy.
-sL	List scan	Lists targets without sending packets.
-sn	Ping scan	Host discovery only (no port scan).

Top ports and nmap-services

By default, Nmap scans the top 1,000 ports for each protocol requested. This catches roughly 93% of open TCP ports and 49% of open UDP ports. -F (fast scan) scans only the top 100 ports (78% TCP, 39% UDP). To scan a different number, use --top-ports N. ³

The port rankings come from the nmap-services file — a registry of port names, numbers, protocols, and an empirical “port frequency” score measuring how often each port was found open during large-scale Internet scans. The file lives at /usr/share/nmap/nmap-services on most Linux systems. ⁴

To see the ports ranked by frequency (most common first):

sort -r -k3 /usr/share/nmap/nmap-services

To list the top N ports that Nmap would actually scan (e.g., top 100 TCP):

nmap -sT --top-ports 100 -v -oG -

Or to see all 1,000 defaults: nmap -sT --top-ports 1000 -v -oG - (same for UDP with -sU). ⁵

Effectiveness table (TCP vs UDP ports needed to reach a given coverage rate):

Coverage	TCP ports	UDP ports
50%	10	1,075
80%	122	7,981
90%	576	11,307
95%	1,558	13,035
99%	3,328	15,094

⁶

The top 5 TCP ports by frequency: HTTP (80), telnet (23), HTTPS (443), FTP (21), SSH (22). The top 5 UDP ports: IPP (631), SNMP (161), NetBIOS-NS (137), NTP (123), NetBIOS-DGM (138). ⁷

Key flags

Flag	Purpose
-A	Aggressive: -O -sC -sV --traceroute
-O	OS detection (needs at least one open and one closed port)
-sV	Service/version detection
-sC	Default NSE scripts
-p-	All 65535 ports
-F	Fast scan (top 100 ports)
-T0–-T5	Timing (0 = 5 min between ports; 3 = default; 4 = CTF speed)

Note: -T4 uses an aggressive timing profile that can cause port discovery to happen out-of-order — ports may be reported in a non-sequential sequence as probes race each other. This is normal and not a scan artifact. | -v / -vv | Verbosity | | -n | Skip DNS resolution | | -R | Reverse DNS even for offline hosts | | -r | Sequential port order (not random) | | -e | Network interface | | -g / --source-port | Source port (can bypass some stateless firewalls) | | -S | Spoof source IP (requires -e and -Pn; only useful if you can capture replies) | | -D | Decoy scan (e.g., -D RND,ME) | | -f / -ff | Fragment packets into 8-byte (-f) or 16-byte (-ff) chunks | | --mtu | Custom MTU (must be multiple of 8; --mtu 8 = -f) | | --data-length | Pad packets to uniform length | | --scanflags | Custom TCP flags (e.g., --scanflags URGPSHFIN = -sX) | | --spoof-mac | Spoof MAC address (only useful on same subnet) | | --badsum | Invalid checksums (some IDS respond to these) | | --proxies | Chain of HTTP/SOCKS4 proxies | | --top-ports | Scan N most common ports | | --open | Only show open ports | | --reason | Explain why Nmap reached a conclusion | | --script | Run NSE scripts by name, category, or wildcard | | --script-help | Show help for a script | | --min-rate / --max-rate | Packets per second | | --min-parallelism / --max-parallelism | Parallel probes | | --scan-delay | Delay between probes | | --version-intensity | 0–9; how aggressive -sV is | | --dns-servers | Custom DNS servers | | --ip-options | IP options (record-route, timestamp, loose/strict source routing) | | --ttl | Custom TTL | | -iL | Input file of targets | | -oA / -oG / -oN / -oX | Output: All / Grepable / Normal / XML |

Nmap Scripting Engine (NSE)

NSE scripts extend Nmap with vulnerability detection, brute-forcing, and deeper discovery. Categories include:

• auth — Authentication probing and bypasses
• broadcast — Broadcast probes
• brute — Brute-force attacks
• default — Curated, fast, reliable scripts (-sC)
• discovery — Additional info gathering
• dos — May crash services
• exploit — Active exploitation
• external — Sends data to third parties
• fuzzer — Fuzzing
• intrusive — Noisy / risky
• malware — Malware detection
• safe — Low risk
• version — Called by -sV (cannot be called directly)
• vuln — Vulnerability checks (prone to false positives)

Targeted reconnaissance

SMB/CIFS

nmap -vv -sT \
     --script smb-enum-shares.nse,smb-enum-users.nse \
     -p445 $TARGET_IP

Gotcha: smb-enum-users.nse is Windows-specific — against UNIX-like hosts running Samba it typically returns no users. Fall back to enum4linux (RID cycling) or smbmap for user enumeration on Samba targets. ⁸

Vulnerability scanning with vulners

The stock vuln NSE category runs built-in vulnerability checks. For per-service CVE matching against the vulners.com database, install the third-party vulners.nse script into Nmap’s script directory; it then runs as part of --script vuln output (shown as a vulners: block per port, keyed off detected CPEs). The CVE list is version-based only — treat hits as leads, not confirmations, since backported patches (common on Ubuntu/Debian) produce false positives. ⁹

NFS

nmap -v -sT --script nfs-ls,nfs-statfs,nfs-showmount \
     -p$PORT $IP

SOCKS5 proxying

Nmap can route traffic through a SOCKS5 proxy via proxychains. Only full TCP connect scans (-sT) work through a proxy. ¹⁰

Shell escape

If Nmap can be run with sudo NOPASSWD, create a file containing os.execute("/bin/sh") and run nmap --script=$FILE to break out to a root shell.

Related

• sort-ip-addresses

• tcp — transport protocol scanned by Nmap

• wireshark — packet analysis for Nmap traffic

• bash-port-scanning — zero-binary port scanning

• arp-scanning — stealthier layer-2 host discovery

• netcat — banner grabbing and simple port checks

• shell-stabilization — what to do after the shell lands

• nbtscan — lightweight NetBIOS name-service scanner that complements Nmap’s nbstat.nse

• telnet — what a finding on TCP 23 often means; Nmap’s the tool that finds it

• nfs — showmount / rpcbind enumeration pairs with Nmap’s nfs-* NSE scripts

• oracle-sql-server — TNS listener on TCP 1521, found via Nmap service scans

Sources

• Nmap Reference Guide
• Port Scanning Basics
• Port Scanning Techniques
• Host Discovery
• Firewall/IDS Evasion
• NSE Usage
• Idle Scan
• UDP Scan
• TCP Window Scan
• nmap-services File
• Port Selection Strategies
• Nmap Top Ports Reference

Footnotes

1. Nmap Reference Guide ↩

2. Host Discovery ↩

3. nmap-book-port-selection-strategies ↩

4. nmap-book-nmap-services ↩

5. nullsec-nmap-top-ports ↩

6. nmap-book-port-selection-strategies ↩

7. nullsec-nmap-top-ports ↩

8. NSE Usage and Examples ↩

9. NSE Usage and Examples ↩

10. Firewall/IDS Evasion and Spoofing ↩