Skip to main content
Nmap is the default tool for working out what’s actually alive on a network and what’s listening on it. Most scans fall into one of two buckets: finding hosts in the first place, and then scanning the ports on a host you already know exists. Everything else, OS detection, scripting, evasion, builds on top of those two basics.

Host Discovery

Figures out which hosts on a network are up, without touching any ports. The first step on a fresh subnet.

Port Scanning

Probes a known host to see what’s listening and, optionally, what service and version is running behind each port.
-Pn skips the initial ping check entirely. Windows hosts block ICMP by default, so if a scan comes back with nothing, try -Pn before assuming the host is down.

​
The Basics

Before getting into flags, nmap works perfectly fine with no options at all. Pointed at a target, it runs a default SYN scan against the top 1000 ports and reports what’s open.
TARGET accepts a few different formats depending on what you’re scanning:
If you’re not sure where to start on a box, nmap -A TARGET is a reasonable default: it adds service versions, OS detection, and script scanning on top of the basic scan in a single command.

​
Host Discovery

Before scanning any ports, it’s often worth just figuring out what’s alive on the network. These scans skip port scanning entirely and rely on different probe types depending on how stealthy you need to be.
ARP requests get logged by most IDS setups since they’re unavoidable on a local network. A TCP SYN ping is quieter and works the same way: a RST back means the host is alive.

​
Port Scanning

Once you know a host is up, the next question is what’s actually listening on it. The scan type you pick trades off speed, reliability, and how noisy it is on the wire.
UDP scans are painfully slow by default. sudo nmap -sU --min-rate 10000 pushes packets out much faster at the cost of some accuracy.
For a fast first look rather than a full scan:
To go the other direction and get everything in one pass:

​
Service and OS Detection

Knowing a port is open is only half the picture. Version and OS detection tell you what’s actually running behind it, which is usually what you need to start looking for a known vulnerability.
-sV --version-intensity 8 pushes version detection to its most thorough setting. It’s slower, but worth it when a lighter scan leaves a service unidentified.

​
Scripting Engine (NSE)

Nmap ships with a huge library of scripts for everything from banner grabbing to active vulnerability checks, stored under /usr/share/nmap/scripts/. Running the right one against the right port often turns up more than the scan itself.
To find a script when you only remember part of the name:

​
Firewall and IDS Evasion

None of these reliably bypass a modern, well-configured IDS. They raise the bar against basic signature matching, not a determined analyst watching the traffic.
Fragmenting packets splits them below the size some filters inspect at:
Spoofing decoy source addresses makes the real scanning host harder to pick out of the noise:
Combine both with a custom source port to round it out:

​
Flags Reference

​
Parsing Results

Grep-friendly output (-oG) is the easiest format to pull quick stats out of without writing a parser. This one-liner tallies up how often each service version shows up across a whole scan:
awesome-nmap-grep has more parsing one-liners along these lines for .gnmap output.
No package manager access on the target but need nmap anyway? A static nmap binary runs without installing anything.

​
Quick Reference Tools

Nmap Reference Guide

The official Nmap documentation, useful for anything not covered here.

awesome-nmap-grep

Parsing tricks and one-liners for working with .gnmap output.
Only scan networks and hosts you’re authorized to test. Unauthorized scanning can be treated as a network intrusion attempt even without any exploitation involved.