Nmap

Nmap (Network Mapper) is the de facto standard open-source utility for network discovery and security auditing. It determines which hosts are up, which ports are open, which services (and versions) are listening, and what operating system is running — all by sending crafted packets and analyzing the responses. ¹

Nmap accepts target ranges in any octet (e.g., 10.10.0-255.1-255 scans 10.10.0.1–10.10.255.255).

Port states

Nmap classifies ports into six states:

• open — A service is actively accepting connections.
• closed — The port is reachable but nothing is listening.
• filtered — A firewall or filter prevents Nmap from determining the state.
• unfiltered — The port is reachable but Nmap cannot tell if it is open or closed (seen in ACK scans).
• open|filtered — Nmap cannot determine if the port is open or filtered (seen in UDP and FIN/Xmas/Null scans).
• closed|filtered — Nmap cannot determine if the port is closed or filtered (seen in IP ID idle scans).

Host discovery

When run as root, Nmap uses ARP for local discovery and a combination of ICMP Echo, TCP SYN to 443, TCP ACK to 80, and ICMP Timestamp requests for remote discovery. As an unprivileged user, it falls back to TCP SYN packets to ports 80 and 443 for both local and remote discovery. ²

Flag	Discovery method
-PA	TCP ACK
-PE	ICMP Echo
-PM	ICMP Address Mask
-PP	ICMP Timestamp
-PR	ARP only
-PS	TCP SYN (default port 80, or list e.g. -PS80,8080)
-PU	UDP (reply only on closed ports via ICMP Port Unreachable)
-Pn	Skip discovery; treat all hosts as up

Windows note: The Windows Firewall blocks ICMP by default, so -Pn is often necessary when scanning modern Windows systems.

Scan types

Only one scan type may be used at a time, except that UDP scan (-sU) can be combined with any TCP scan.

Flag	Type	Notes
-sS	SYN scan	Default; sends SYN, waits for SYN/ACK, then RST. Requires root.
-sT	TCP connect scan	Full three-way handshake. Only option for unprivileged users.
-sU	UDP scan	Sends empty UDP packets; most ports return open|filtered. Very slow.
-sA	ACK scan	All ports should RST; useful for mapping firewall rules, not service state.
-sN	Null scan	No TCP flags set. Bypasses stateless firewalls.
-sF	FIN scan	Similar to null scan.
-sX	Xmas scan	FIN, URG, PSH set. Similar to null scan.
-sW	Window scan	Like ACK but examines TCP window size in RSTs for anomalies.
-sM	Maimon scan	FIN+ACK; mostly of historical interest.
-sI	Idle/Zombie scan	Spoofed scan via an idle zombie host; extremely slow and stealthy.
-sL	List scan	Lists targets without sending packets.
-sn	Ping scan	Host discovery only (no port scan).

Key flags

Flag	Purpose
-A	Aggressive: -O -sC -sV --traceroute
-O	OS detection (needs at least one open and one closed port)
-sV	Service/version detection
-sC	Default NSE scripts
-p-	All 65535 ports
-F	Fast scan (top 100 ports)
-T0–-T5	Timing (0 = 5 min between ports; 3 = default; 4 = CTF speed)

Note: -T4 uses an aggressive timing profile that can cause port discovery to happen out-of-order — ports may be reported in a non-sequential sequence as probes race each other. This is normal and not a scan artifact. | -v / -vv | Verbosity | | -n | Skip DNS resolution | | -R | Reverse DNS even for offline hosts | | -r | Sequential port order (not random) | | -e | Network interface | | -g / --source-port | Source port (can bypass some stateless firewalls) | | -S | Spoof source IP (requires -e and -Pn; only useful if you can capture replies) | | -D | Decoy scan (e.g., -D RND,ME) | | -f / -ff | Fragment packets into 8-byte (-f) or 16-byte (-ff) chunks | | --mtu | Custom MTU (must be multiple of 8; --mtu 8 = -f) | | --data-length | Pad packets to uniform length | | --scanflags | Custom TCP flags (e.g., --scanflags URGPSHFIN = -sX) | | --spoof-mac | Spoof MAC address (only useful on same subnet) | | --badsum | Invalid checksums (some IDS respond to these) | | --proxies | Chain of HTTP/SOCKS4 proxies | | --top-ports | Scan N most common ports | | --open | Only show open ports | | --reason | Explain why Nmap reached a conclusion | | --script | Run NSE scripts by name, category, or wildcard | | --script-help | Show help for a script | | --min-rate / --max-rate | Packets per second | | --min-parallelism / --max-parallelism | Parallel probes | | --scan-delay | Delay between probes | | --version-intensity | 0–9; how aggressive -sV is | | --dns-servers | Custom DNS servers | | --ip-options | IP options (record-route, timestamp, loose/strict source routing) | | --ttl | Custom TTL | | -iL | Input file of targets | | -oA / -oG / -oN / -oX | Output: All / Grepable / Normal / XML |

SOCKS5 proxying

Nmap can route traffic through a SOCKS5 proxy via proxychains. Only full TCP connect scans (-sT) work through a proxy. ³

Shell escape

If Nmap can be run with sudo NOPASSWD, create a file containing os.execute("/bin/sh") and run nmap --script=$FILE to break out to a root shell.

Sub-pages

• nmap-port-selection — which ports Nmap scans by default, the nmap-services frequency rankings, and TCP/UDP coverage rates
• nmap-nse — the Nmap Scripting Engine: categories, SMB/NFS targeted recon, vulners CVE matching

Related

• sort-ip-addresses

• tcp — transport protocol scanned by Nmap

• wireshark — packet analysis for Nmap traffic

• bash-port-scanning — zero-binary port scanning

• arp-scanning — stealthier layer-2 host discovery

• netcat — banner grabbing and simple port checks

• shell-stabilization — what to do after the shell lands

• nbtscan — lightweight NetBIOS name-service scanner that complements Nmap’s nbstat.nse

• telnet — what a finding on TCP 23 often means; Nmap’s the tool that finds it

• nfs — showmount / rpcbind enumeration pairs with Nmap’s nfs-* NSE scripts

• oracle-sql-server — TNS listener on TCP 1521, found via Nmap service scans

Sources

• Nmap Reference Guide
• Port Scanning Basics
• Port Scanning Techniques
• Host Discovery
• Firewall/IDS Evasion
• Idle Scan
• UDP Scan
• TCP Window Scan

Footnotes

1. Nmap Reference Guide ↩

2. Nmap Project — Host Discovery ↩

3. Nmap Project — Firewall/IDS Evasion and Spoofing ↩