Nmap has a reputation for having an intimidating number of flags and options, but the truth is that a huge portion of real-world usage relies on a fairly small set of core commands. If you’re just getting started with network scanning, learning these ten commands well will cover the vast majority of everyday scanning needs, while also giving you a solid foundation to build on toward more advanced techniques later.
This guide walks through each command with explanations of what’s happening under the hood, expected output, when to use it, and common mistakes beginners make with each one.
Before You Start: A Note on Authorization
Every command in this guide should only be run against systems you own or have explicit written permission to scan. Unauthorized port scanning can violate computer misuse laws in many jurisdictions, even when no damage is done. For practice, Nmap’s project maintains scanme.nmap.org specifically as a legal target for learning and testing.
1. Basic Host Scan
nmap scanme.nmap.org
This is the simplest possible Nmap command. Without any flags, Nmap performs a default scan of the 1,000 most commonly used ports using a TCP SYN scan (if run with sufficient privileges) or a TCP connect scan otherwise.
Expected output:
Starting Nmap 7.94 ( https://nmap.org ) at 2026-08-16 10:00 UTC
Nmap scan report for scanme.nmap.org (45.33.32.156)
Host is up (0.087s latency).
Not shown: 996 closed ports
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
9929/tcp open nping-echo
31337/tcp open Elite
Common beginner mistake: Assuming this shows every possible port. By default, only the top 1,000 most common ports are checked, not the full 65,535.
2. Scanning a Specific Port
nmap -p 80 scanme.nmap.org
The -p flag restricts the scan to a specific port (or list/range of ports), which is much faster when you only care about one particular service.
Expected output:
PORT STATE SERVICE
80/tcp open http
You can also specify multiple ports or ranges:
nmap -p 22,80,443 scanme.nmap.org
nmap -p 1-100 scanme.nmap.org
3. Scanning All 65,535 Ports
nmap -p- scanme.nmap.org
The -p- flag tells Nmap to scan the entire port range instead of just the default top 1,000. This is significantly slower but gives complete visibility, and is especially important during thorough security assessments where an obscure open port could be exactly what an attacker is looking for.
Common beginner mistake: Running this against a large network without adjusting timing, leading to scans that take hours. Combine with -T4 or --min-rate for reasonable full-range scans.
4. Detecting Service Versions
nmap -sV scanme.nmap.org
The -sV flag enables version detection, probing open ports further to determine what software (and often which version) is running behind them.
Expected output:
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 6.6.1p1 Ubuntu
80/tcp open http Apache httpd 2.4.7
This is one of the most valuable flags for security work, since knowing the exact software version is often the first step toward identifying known vulnerabilities.
5. OS Detection
nmap -O scanme.nmap.org
The -O flag attempts to fingerprint the target’s operating system by analyzing subtle differences in how its TCP/IP stack responds to specially crafted packets.
Expected output:
Device type: general purpose
Running: Linux 3.X|4.X
OS CPE: cpe:/o:linux:linux_kernel:3
OS details: Linux 3.2 - 4.9
Note: This requires root/administrator privileges, and results are probabilistic — Nmap reports its best guess along with a confidence indicator, not a guaranteed fact.
6. Running a Default Script Scan
nmap -sC scanme.nmap.org
The -sC flag runs Nmap’s default set of NSE (Nmap Scripting Engine) scripts, which perform safe, non-intrusive checks like grabbing banners, page titles, and basic configuration details.
Expected output includes extra lines beneath each port:
PORT STATE SERVICE
80/tcp open http
|_http-title: Go ahead and ScanMe!
7. Aggressive Scan (All-in-One)
nmap -A scanme.nmap.org
The -A flag is a convenient shortcut that combines several detection features at once: OS detection, version detection, default script scanning, and traceroute. It’s a fast way to get a comprehensive picture of a target in a single command, though it’s also noisier and more detectable than running these individually with more careful timing.
Expected output is a combination of everything shown in the previous examples, plus a traceroute section at the end.
8. Scanning Without Host Discovery (Ping Skip)
nmap -Pn scanme.nmap.org
By default, Nmap first checks whether a host appears to be “up” before scanning its ports, typically using ICMP echo requests. Many firewalls block these probes, which can cause Nmap to incorrectly report a live host as down and skip it entirely. The -Pn flag tells Nmap to skip this check and scan ports regardless.
Common beginner mistake: Getting a “Host seems down” message for a target that’s actually online, without realizing the ping probe itself is being blocked. Adding -Pn almost always resolves this.
9. Saving Scan Output to a File
nmap -oN scan_results.txt scanme.nmap.org
The -oN flag saves scan output in Nmap’s normal human-readable format to a file, useful for record-keeping or later review. Other common output formats include:
nmap -oX scan_results.xml scanme.nmap.org # XML format, useful for parsing
nmap -oG scan_results.gnmap scanme.nmap.org # Grepable format, useful for quick text searches
nmap -oA scan_results scanme.nmap.org # Saves all three formats at once
Expected result: A new file appears in the current directory containing the same information that would otherwise only print to the terminal.
10. Scanning Multiple Targets or an Entire Subnet
nmap 192.168.1.1-50
This scans a range of IP addresses (in this case, 192.168.1.1 through 192.168.1.50).
Alternatively, using CIDR notation to scan an entire subnet:
nmap 192.168.1.0/24
Or scanning a list of specific, unrelated targets in one command:
nmap scanme.nmap.org 192.168.1.10 example.com
Or reading targets from a file:
nmap -iL targets.txt
Where targets.txt contains one hostname or IP address per line.
Expected output repeats the standard scan report format once per discovered host in the specified range.
Quick Reference Table
| # | Command | Purpose |
|---|---|---|
| 1 | nmap <target> | Basic scan of top 1000 ports |
| 2 | nmap -p 80 <target> | Scan a specific port |
| 3 | nmap -p- <target> | Scan all 65,535 ports |
| 4 | nmap -sV <target> | Detect service versions |
| 5 | nmap -O <target> | Detect operating system |
| 6 | nmap -sC <target> | Run default NSE scripts |
| 7 | nmap -A <target> | All-in-one aggressive scan |
| 8 | nmap -Pn <target> | Skip host discovery/ping check |
| 9 | nmap -oN file.txt <target> | Save results to a file |
| 10 | nmap 192.168.1.0/24 | Scan an entire subnet |
Troubleshooting Common Beginner Issues
“Host seems down” for a target you know is online Fix: Add -Pn to skip the ping check, as many hosts block ICMP without actually being offline.
Scan takes forever to finish Fix: Avoid combining -p- with -A on large networks; narrow scope or add -T4 for faster timing.
“Failed to resolve” errors Fix: Double-check the hostname spelling and confirm DNS resolution works separately (e.g., ping example.com or nslookup example.com).
Permission denied on certain scan types Fix: Some flags like -O and default SYN scanning require root/administrator privileges — try running with sudo on Linux/macOS.
Common Flag Combinations Worth Memorizing
Beyond the ten standalone commands, a handful of combinations come up constantly enough that they’re worth committing to memory early on:
nmap -sV -p- --min-rate=1000 192.168.1.10
A thorough but reasonably fast full-port scan with version detection, good for a “give me everything” pass against a single host of interest.
nmap -sn 192.168.1.0/24 -oG - | grep Up
A quick way to list only the live hosts on a subnet, piping grepable output through grep for a clean list of “Up” hosts without extra noise.
nmap --top-ports 20 192.168.1.0/24
A fast sweep across an entire subnet checking only the twenty most commonly seen ports — useful for a very quick first look before deciding where to focus deeper scanning effort.
Best Beginner Habits to Build Early
- Always note the scan command used alongside any saved results, since results without context (what flags were used, when, against what) lose most of their value over time.
- Get comfortable reading
-oNoutput before jumping to XML parsing, since understanding the plain-text format makes it much easier to sanity-check automated tooling later. - Practice interpreting “closed” vs “filtered” distinctly — a beginner mistake is treating them as the same thing, when they actually imply very different things about what’s happening at the network boundary.
- Get used to re-running scans with
-Pnas a troubleshooting reflex whenever a host that should be up reports as down, since this single flag resolves a large share of early confusion.
Security Best Practices
- Only scan networks and hosts you own or have explicit, documented authorization to test.
- Start with lighter scans (
-sVon specific ports) before jumping to aggressive full-range scans, especially on unfamiliar or production networks. - Save output (
-oA) for every meaningful scan as part of good record-keeping practice, particularly in professional engagements. - Be mindful that
-Aand full port range scans generate significantly more network traffic and are easier for intrusion detection systems to flag.
Bonus: Combining Commands into a Practical Workflow
Once each command is understood individually, they’re rarely used in isolation during a real assessment. Here’s a simple, realistic progression a beginner might follow when exploring a new network:
# Step 1: Discover which hosts are alive on the subnet
nmap -sn 192.168.1.0/24
# Step 2: Basic scan of a specific host of interest
nmap 192.168.1.10
# Step 3: Confirm results even if host discovery seems to fail
nmap -Pn 192.168.1.10
# Step 4: Dig deeper into services running on open ports
nmap -sV -sC 192.168.1.10
# Step 5: Save everything for later reference
nmap -sV -sC -oA host_10_results 192.168.1.10
This progression — discover, confirm, enumerate, document — mirrors the natural workflow that more advanced scanning techniques (covered in the companion articles on scan types and NSE scripting) build upon.
Understanding Nmap’s Output Sections
For beginners, it helps to know what each part of typical Nmap output actually means:
Starting Nmap 7.94 ( https://nmap.org ) at 2026-08-16 10:00 UTC
Nmap scan report for scanme.nmap.org (45.33.32.156)
Host is up (0.087s latency).
Not shown: 996 closed ports
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
Nmap done: 1 IP address (1 host up) scanned in 4.32 seconds
- “Host is up”: Confirms the target responded to host discovery probes, along with round-trip latency.
- “Not shown: 996 closed ports”: Nmap hides ports in the same state (here, closed) by default to keep output readable, only listing the interesting ones explicitly.
- PORT/STATE/SERVICE table: The core result — each row is a port, its detected state, and Nmap’s best guess at the service name based on the standard port-to-service mapping (not necessarily version-confirmed unless
-sVwas used). - Final summary line: Confirms how many hosts were scanned, how many were up, and total scan duration.
Frequently Asked Questions
What’s the difference between the default scan and -A? The default scan only checks port states across the top 1,000 ports. The -A flag adds OS detection, version detection, script scanning, and traceroute on top of the same port discovery, providing a much more detailed picture at the cost of scan time and stealth.
Why does Nmap sometimes require sudo and sometimes not? Certain scan and detection techniques (like SYN scanning and OS detection) need raw socket access, which requires elevated privileges on most operating systems. Basic Connect scans don’t need this and will run under a normal user account.
How do I know which port range to use if I don’t know what’s running on a target? Start with the default top-1,000 port scan, since it covers the vast majority of commonly used services. If nothing interesting turns up and a fuller picture is needed, follow up with -p- for complete coverage.
Can these basic commands be used for network troubleshooting, not just security testing? Yes — system administrators regularly use basic Nmap scans to confirm a service is actually listening on the expected port, verify firewall rules are behaving as intended, or check whether a recent configuration change had unintended side effects.
What should a total beginner practice on before scanning real infrastructure? scanme.nmap.org is explicitly provided by the Nmap project for this purpose, along with setting up local virtual machines (like an intentionally vulnerable VM) on a private, isolated network for hands-on practice without any authorization concerns.
Conclusion
These ten commands form the practical backbone of everyday Nmap usage. Mastering them — understanding not just the syntax but what’s actually happening on the wire with each one — builds the foundation needed to move on to more advanced topics like scripting with NSE, scanning type selection for evasion or firewall analysis, and full Python-based automation. Every advanced Nmap workflow ultimately builds on these fundamentals.
