Nmap Command Reference

nmap -sn 192.168.1.0/24

Ping sweep: find all live hosts on the subnet without a port scan.

nmap -sn -PR 192.168.1.0/24

ARP discovery only: fast on local networks and useful when host firewalls block other probes.

nmap -sn -PE -PP -PM TARGET

ICMP discovery using Echo, Timestamp, and Address Mask requests.

nmap -sn -PS22,80,443 -PA80,443 TARGET

TCP SYN and ACK discovery on common ports when ICMP is blocked.

nmap -sn -PU53,161 TARGET

UDP discovery on DNS and SNMP ports.

nmap -Pn TARGET

Skip discovery and treat hosts as online when ping is blocked.

nmap -sL 10.0.0.0/24

List scan: reverse DNS lookup only; no packets are sent to targets.

nmap -sS TARGET

TCP SYN scan: fast and commonly recommended; requires raw socket privileges.

nmap -sU --top-ports 200 TARGET

UDP scan on the top 200 ports; useful for SNMP, DNS, and TFTP services.

nmap -sS -sU -p T:1-1000,U:53,111,161,500 TARGET

Combined TCP and UDP scan with separate port selections.

nmap -sI zombie_ip TARGET

Idle scan using a permitted intermediary host; results do not originate directly from your IP.

nmap -p- TARGET

Scan all 65,535 TCP ports.

nmap -p 80,443,8080,8443 TARGET

Scan specific web ports only.

nmap -p 1-1024 TARGET

Scan a port range, such as all privileged ports.

nmap --top-ports 100 TARGET

Scan only the 100 most common ports for fast recon.

nmap -p- --min-rate=1000 TARGET

Full TCP port scan with a minimum packet rate.

nmap -p T:80,443,U:53,161 TARGET

Mix TCP and UDP ports in one command.

nmap -sV TARGET

Probe open ports to determine service and version.

nmap -sV --version-intensity 9 TARGET

Maximum version detection using all available probes.

nmap -sV --version-light TARGET

Light version scan at intensity 2 for faster results.

nmap -sC TARGET

Run the default NSE scripts; equivalent to --script=default.

nmap -sC -sV -p 22,80,443 TARGET

Classic combination: version detection and default scripts on selected ports.

nmap -A TARGET

Aggressive scan: version detection, default scripts, OS detection, and traceroute.

nmap -O TARGET

OS detection; accuracy improves with at least one open and one closed port.

nmap -O --osscan-guess TARGET

Print the best OS guess even when the fingerprint is uncertain.

nmap -O --osscan-limit TARGET

Attempt OS detection only on hosts with suitable open and closed ports.

nmap --script=default TARGET

Run default scripts; safe and informative for many assessments.

nmap --script=vuln TARGET

Run vulnerability detection scripts to identify CVEs and misconfigurations.

nmap --script=safe TARGET

Run scripts marked safe.

nmap --script="vuln and safe" TARGET

Run scripts that are both in the vulnerability and safe categories.

nmap -p 445 --script=smb-enum-shares,smb-enum-users,smb-os-discovery TARGET

SMB enumeration: shares, users, and OS information.

nmap -p 80,443 --script=http-enum,http-headers,http-methods,http-title TARGET

HTTP enumeration: directories, headers, methods, and page titles.

nmap -p 53 --script=dns-zone-transfer --script-args dns-zone-transfer.domain=DOMAIN TARGET

Attempt a DNS zone transfer against an authorized domain.

nmap -p 21 --script=ftp-anon,ftp-bounce,ftp-syst TARGET

FTP enumeration: anonymous access, bounce behavior, and system information.

nmap -p 25 --script=smtp-enum-users,smtp-open-relay TARGET

Check SMTP user enumeration and open-relay behavior.

nmap -p 3306 --script=mysql-enum,mysql-info,mysql-empty-password TARGET

MySQL information, user enumeration, and empty-password checks.

nmap -p 443 --script=ssl-enum-ciphers,ssl-cert,ssl-heartbleed TARGET

SSL/TLS audit: ciphers, certificate information, and Heartbleed checks.

nmap --script=smb-vuln-ms17-010 -p 445 TARGET

Check for the MS17-010 vulnerability on an authorized SMB host.

nmap --script=http-brute --script-args http-brute.path=/admin,userdb=users.txt,passdb=pass.txt -p 80 TARGET

Test an authorized HTTP login with custom wordlists and a target path.

nmap --script=http-put --script-args http-put.url=/uploads/shell.php,http-put.file=shell.php -p 80 TARGET

Test whether an authorized server permits HTTP PUT uploads.

nmap -f TARGET

Fragment packets into small pieces.

nmap --mtu 16 TARGET

Set a custom MTU; the value must be a multiple of 8.

nmap -D RND:10 TARGET

Generate 10 random decoy addresses.

nmap -D decoy1,decoy2,decoy3,ME TARGET

Use specific decoys; ME marks your position.

nmap -S SPOOFED_IP -e eth0 -Pn TARGET

Spoof the source IP; results will not return to your host.

nmap -g 53 TARGET

Use source port 53 for testing source-port filtering.

nmap --data-length 25 TARGET

Append random data to packets.

nmap --scan-delay 5s TARGET

Wait five seconds between probes.

nmap --badsum TARGET

Send packets with invalid checksums to test intermediary behavior.

nmap -T4 --min-rate=1000 -p- TARGET

Fast full scan with aggressive timing and a minimum packet rate.

nmap --min-parallelism 100 TARGET

Keep at least 100 probes in parallel.

nmap --max-retries 1 TARGET

Limit retransmissions to one for faster, less reliable scans.

nmap --host-timeout 30s TARGET

Skip hosts that take more than 30 seconds.

nmap -oN scan.txt TARGET

Normal, human-readable output.

nmap -oX scan.xml TARGET

XML output for parsers and security tools.

nmap -oG scan.gnmap TARGET

Grepable output for shell pipelines.

nmap -oA scan TARGET

Write normal, XML, and grepable output together.

nmap -oG - TARGET | grep "open" | awk '{print $2}'

Extract IP addresses with open ports from grepable output.

nmap -v --reason TARGET

Show verbose output and why each port is open, closed, or filtered.

nmap -p- --min-rate=1000 -T4 TARGET -oN allports.txt

Initial recon: fast full port discovery.

nmap -p OPEN_PORTS -sC -sV -oA detailed TARGET

Deep scan discovered ports with scripts and version detection.

nmap -p 80,443,8080,8443 -sV --script="http-*" TARGET

Full HTTP enumeration on common web ports.

nmap -p 53,88,135,139,389,445,464,636,3268,3269 -sV -sC TARGET

Domain controller scan covering DNS, Kerberos, RPC, SMB, LDAP, and Global Catalog.

nmap -sV --script=vuln -p OPEN_PORTS TARGET -oA vulnscan

Run vulnerability scripts on discovered open ports.

nmap -sS -T1 -f -D RND:5 -g 53 --data-length 25 TARGET

Slow SYN scan with fragmentation, decoys, source-port testing, and padding.

nmap -sn 10.0.0.0/24 -oG - | grep "Up" | awk '{print $2}' > live_hosts.txt

Discover live hosts and save them for a later scan.

nmap -iL live_hosts.txt -p- --min-rate=1000 -oA full_scan

Run a full port scan against hosts read from a file.