Skip to content

Cheatsheet

Nmap

Scan types, port selection, output and timing switches, in the order you reach for them.

28 entries5 groupsRevised 18 Jan 2026Full Nmap documentation

Discovery

Establish what is present before scanning ports.

  • Ping sweep a subnetnmap -sn 192.0.2.0/24
  • ARP-style local discovery (needs privileges)sudo nmap -sn 192.0.2.0/24
  • TCP SYN ping on allowed portsnmap -PS22,80,443 192.0.2.0/24
  • Treat hosts as up (ICMP blocked)nmap -Pn 192.0.2.10
  • List targets only, send nothingnmap -sL 192.0.2.0/24

Ports & protocols

  • Top 1000 ports (default)nmap 192.0.2.10
  • All 65535 TCP portsnmap -p- 192.0.2.10
  • Port list and rangesnmap -p 22,80,443,8000-8100 192.0.2.10
  • Top N ports by frequencynmap --top-ports 100 192.0.2.10
  • UDP on a short listsudo nmap -sU -p 53,123,161 192.0.2.10
  • Mixed TCP+UDPsudo nmap -sSU -p U:53,T:53,443 192.0.2.10

Scan techniques

  • TCP connect (no raw sockets)nmap -sT 192.0.2.10
  • SYN half-open (privileged)sudo nmap -sS 192.0.2.10
  • Version detectionnmap -sV 192.0.2.10
  • Default NSE scriptsnmap -sC 192.0.2.10
  • OS detectionsudo nmap -O --osscan-limit 192.0.2.10
  • Why a port is filterednmap -Pn --reason -p 80 192.0.2.10
  • One named script with argsnmap --script http-headers --script-args http-headers.path=/ 192.0.2.10

Output & performance

  • All formats with a prefixnmap -oA scans/host-01 192.0.2.10
  • XML onlynmap -oX scans/host.xml 192.0.2.10
  • Append open ports for notesgrep 'open' scans/host-01.gnmap
  • Timing template (stay <=T3 on production)nmap -T3 192.0.2.10
  • Cap parallelism and retriesnmap --max-parallelism 20 --max-retries 1 192.0.2.10
  • Don't let one host stall the runnmap --host-timeout 5m --script-timeout 20s 192.0.2.10
  • Resume from previous statenmap --resume

Privilege checklist

  • Grant raw-socket capability oncesudo setcap cap_net_raw,cap_net_admin=eip $(which nmap)
  • Confirm version and pathsnmap --version
  • Test before a long scannmap -v -p 22,80 192.0.2.10