10 Most Basic Nmap Commands Every Beginner Should Know

Nmap has a reputation for having an intimidating number of flags and options, but the truth is that a huge portion of real-world usage relies on a fairly small set of core commands. If you’re just getting started with network scanning, learning these ten commands well will cover the vast majority of everyday scanning needs, while also giving you a solid foundation to build on toward more advanced techniques later.

This guide walks through each command with explanations of what’s happening under the hood, expected output, when to use it, and common mistakes beginners make with each one.

Before You Start: A Note on Authorization

Every command in this guide should only be run against systems you own or have explicit written permission to scan. Unauthorized port scanning can violate computer misuse laws in many jurisdictions, even when no damage is done. For practice, Nmap’s project maintains scanme.nmap.org specifically as a legal target for learning and testing.

1. Basic Host Scan

nmap scanme.nmap.org

This is the simplest possible Nmap command. Without any flags, Nmap performs a default scan of the 1,000 most commonly used ports using a TCP SYN scan (if run with sufficient privileges) or a TCP connect scan otherwise.

Expected output:

Starting Nmap 7.94 ( https://nmap.org ) at 2026-08-16 10:00 UTC
Nmap scan report for scanme.nmap.org (45.33.32.156)
Host is up (0.087s latency).
Not shown: 996 closed ports
PORT     STATE SERVICE
22/tcp   open  ssh
80/tcp   open  http
9929/tcp open  nping-echo
31337/tcp open  Elite

Common beginner mistake: Assuming this shows every possible port. By default, only the top 1,000 most common ports are checked, not the full 65,535.

2. Scanning a Specific Port

nmap -p 80 scanme.nmap.org

The -p flag restricts the scan to a specific port (or list/range of ports), which is much faster when you only care about one particular service.

Expected output:

PORT   STATE SERVICE
80/tcp open  http

You can also specify multiple ports or ranges:

nmap -p 22,80,443 scanme.nmap.org
nmap -p 1-100 scanme.nmap.org

3. Scanning All 65,535 Ports

nmap -p- scanme.nmap.org

The -p- flag tells Nmap to scan the entire port range instead of just the default top 1,000. This is significantly slower but gives complete visibility, and is especially important during thorough security assessments where an obscure open port could be exactly what an attacker is looking for.

Common beginner mistake: Running this against a large network without adjusting timing, leading to scans that take hours. Combine with -T4 or --min-rate for reasonable full-range scans.

4. Detecting Service Versions

nmap -sV scanme.nmap.org

The -sV flag enables version detection, probing open ports further to determine what software (and often which version) is running behind them.

Expected output:

PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 6.6.1p1 Ubuntu
80/tcp   open  http    Apache httpd 2.4.7

This is one of the most valuable flags for security work, since knowing the exact software version is often the first step toward identifying known vulnerabilities.

5. OS Detection

nmap -O scanme.nmap.org

The -O flag attempts to fingerprint the target’s operating system by analyzing subtle differences in how its TCP/IP stack responds to specially crafted packets.

Expected output:

Device type: general purpose
Running: Linux 3.X|4.X
OS CPE: cpe:/o:linux:linux_kernel:3
OS details: Linux 3.2 - 4.9

Note: This requires root/administrator privileges, and results are probabilistic — Nmap reports its best guess along with a confidence indicator, not a guaranteed fact.

6. Running a Default Script Scan

nmap -sC scanme.nmap.org

The -sC flag runs Nmap’s default set of NSE (Nmap Scripting Engine) scripts, which perform safe, non-intrusive checks like grabbing banners, page titles, and basic configuration details.

Expected output includes extra lines beneath each port:

PORT   STATE SERVICE
80/tcp open  http
|_http-title: Go ahead and ScanMe!

7. Aggressive Scan (All-in-One)

nmap -A scanme.nmap.org

The -A flag is a convenient shortcut that combines several detection features at once: OS detection, version detection, default script scanning, and traceroute. It’s a fast way to get a comprehensive picture of a target in a single command, though it’s also noisier and more detectable than running these individually with more careful timing.

Expected output is a combination of everything shown in the previous examples, plus a traceroute section at the end.

8. Scanning Without Host Discovery (Ping Skip)

nmap -Pn scanme.nmap.org

By default, Nmap first checks whether a host appears to be “up” before scanning its ports, typically using ICMP echo requests. Many firewalls block these probes, which can cause Nmap to incorrectly report a live host as down and skip it entirely. The -Pn flag tells Nmap to skip this check and scan ports regardless.

Common beginner mistake: Getting a “Host seems down” message for a target that’s actually online, without realizing the ping probe itself is being blocked. Adding -Pn almost always resolves this.

9. Saving Scan Output to a File

nmap -oN scan_results.txt scanme.nmap.org

The -oN flag saves scan output in Nmap’s normal human-readable format to a file, useful for record-keeping or later review. Other common output formats include:

nmap -oX scan_results.xml scanme.nmap.org   # XML format, useful for parsing
nmap -oG scan_results.gnmap scanme.nmap.org  # Grepable format, useful for quick text searches
nmap -oA scan_results scanme.nmap.org        # Saves all three formats at once

Expected result: A new file appears in the current directory containing the same information that would otherwise only print to the terminal.

10. Scanning Multiple Targets or an Entire Subnet

nmap 192.168.1.1-50

This scans a range of IP addresses (in this case, 192.168.1.1 through 192.168.1.50).

Alternatively, using CIDR notation to scan an entire subnet:

nmap 192.168.1.0/24

Or scanning a list of specific, unrelated targets in one command:

nmap scanme.nmap.org 192.168.1.10 example.com

Or reading targets from a file:

nmap -iL targets.txt

Where targets.txt contains one hostname or IP address per line.

Expected output repeats the standard scan report format once per discovered host in the specified range.

Quick Reference Table

Troubleshooting Common Beginner Issues

“Host seems down” for a target you know is online Fix: Add -Pn to skip the ping check, as many hosts block ICMP without actually being offline.

Scan takes forever to finish Fix: Avoid combining -p- with -A on large networks; narrow scope or add -T4 for faster timing.

“Failed to resolve” errors Fix: Double-check the hostname spelling and confirm DNS resolution works separately (e.g., ping example.com or nslookup example.com).

Permission denied on certain scan types Fix: Some flags like -O and default SYN scanning require root/administrator privileges — try running with sudo on Linux/macOS.

Common Flag Combinations Worth Memorizing

Beyond the ten standalone commands, a handful of combinations come up constantly enough that they’re worth committing to memory early on:

nmap -sV -p- --min-rate=1000 192.168.1.10

A thorough but reasonably fast full-port scan with version detection, good for a “give me everything” pass against a single host of interest.

nmap -sn 192.168.1.0/24 -oG - | grep Up

A quick way to list only the live hosts on a subnet, piping grepable output through grep for a clean list of “Up” hosts without extra noise.

nmap --top-ports 20 192.168.1.0/24

A fast sweep across an entire subnet checking only the twenty most commonly seen ports — useful for a very quick first look before deciding where to focus deeper scanning effort.

Best Beginner Habits to Build Early

• Always note the scan command used alongside any saved results, since results without context (what flags were used, when, against what) lose most of their value over time.
• Get comfortable reading -oN output before jumping to XML parsing, since understanding the plain-text format makes it much easier to sanity-check automated tooling later.
• Practice interpreting “closed” vs “filtered” distinctly — a beginner mistake is treating them as the same thing, when they actually imply very different things about what’s happening at the network boundary.
• Get used to re-running scans with -Pn as a troubleshooting reflex whenever a host that should be up reports as down, since this single flag resolves a large share of early confusion.

Security Best Practices

• Only scan networks and hosts you own or have explicit, documented authorization to test.
• Start with lighter scans (-sV on specific ports) before jumping to aggressive full-range scans, especially on unfamiliar or production networks.
• Save output (-oA) for every meaningful scan as part of good record-keeping practice, particularly in professional engagements.
• Be mindful that -A and full port range scans generate significantly more network traffic and are easier for intrusion detection systems to flag.

Bonus: Combining Commands into a Practical Workflow

Once each command is understood individually, they’re rarely used in isolation during a real assessment. Here’s a simple, realistic progression a beginner might follow when exploring a new network:

# Step 1: Discover which hosts are alive on the subnet
nmap -sn 192.168.1.0/24

# Step 2: Basic scan of a specific host of interest
nmap 192.168.1.10

# Step 3: Confirm results even if host discovery seems to fail
nmap -Pn 192.168.1.10

# Step 4: Dig deeper into services running on open ports
nmap -sV -sC 192.168.1.10

# Step 5: Save everything for later reference
nmap -sV -sC -oA host_10_results 192.168.1.10

This progression — discover, confirm, enumerate, document — mirrors the natural workflow that more advanced scanning techniques (covered in the companion articles on scan types and NSE scripting) build upon.

Understanding Nmap’s Output Sections

For beginners, it helps to know what each part of typical Nmap output actually means:

Starting Nmap 7.94 ( https://nmap.org ) at 2026-08-16 10:00 UTC
Nmap scan report for scanme.nmap.org (45.33.32.156)
Host is up (0.087s latency).
Not shown: 996 closed ports
PORT     STATE SERVICE
22/tcp   open  ssh
80/tcp   open  http
Nmap done: 1 IP address (1 host up) scanned in 4.32 seconds

• “Host is up”: Confirms the target responded to host discovery probes, along with round-trip latency.
• “Not shown: 996 closed ports”: Nmap hides ports in the same state (here, closed) by default to keep output readable, only listing the interesting ones explicitly.
• PORT/STATE/SERVICE table: The core result — each row is a port, its detected state, and Nmap’s best guess at the service name based on the standard port-to-service mapping (not necessarily version-confirmed unless -sV was used).
• Final summary line: Confirms how many hosts were scanned, how many were up, and total scan duration.

Frequently Asked Questions

What’s the difference between the default scan and -A? The default scan only checks port states across the top 1,000 ports. The -A flag adds OS detection, version detection, script scanning, and traceroute on top of the same port discovery, providing a much more detailed picture at the cost of scan time and stealth.

Why does Nmap sometimes require sudo and sometimes not? Certain scan and detection techniques (like SYN scanning and OS detection) need raw socket access, which requires elevated privileges on most operating systems. Basic Connect scans don’t need this and will run under a normal user account.

How do I know which port range to use if I don’t know what’s running on a target? Start with the default top-1,000 port scan, since it covers the vast majority of commonly used services. If nothing interesting turns up and a fuller picture is needed, follow up with -p- for complete coverage.

Can these basic commands be used for network troubleshooting, not just security testing? Yes — system administrators regularly use basic Nmap scans to confirm a service is actually listening on the expected port, verify firewall rules are behaving as intended, or check whether a recent configuration change had unintended side effects.

What should a total beginner practice on before scanning real infrastructure? scanme.nmap.org is explicitly provided by the Nmap project for this purpose, along with setting up local virtual machines (like an intentionally vulnerable VM) on a private, isolated network for hands-on practice without any authorization concerns.

Conclusion

These ten commands form the practical backbone of everyday Nmap usage. Mastering them — understanding not just the syntax but what’s actually happening on the wire with each one — builds the foundation needed to move on to more advanced topics like scripting with NSE, scanning type selection for evasion or firewall analysis, and full Python-based automation. Every advanced Nmap workflow ultimately builds on these fundamentals.