I’ve lost count of how many times I’ve opened a terminal, typed nmap, and then blanked on the exact flag I needed. After years of running scans for lab work, home-lab hardening, and CTF practice, I finally sat down and organized every command I actually reach for into one reference. This is that reference — a working cheat sheet, not a marketing brochure.
If you’re new to Nmap, this guide will get you scanning safely and correctly within minutes. If you’re experienced, treat this as the page you bookmark and never have to Google “nmap flag for X” again.
What Nmap Actually Is
Nmap (Network Mapper) is a free, open-source tool for network discovery and security auditing. I use it to answer three questions on any network I’m authorized to test:
- What hosts are alive?
- What ports are open on those hosts?
- What services and versions are running behind those ports?
It’s been around since 1997, and it’s still the first tool I install on any fresh Kali or Ubuntu box.
A note before we start: Only scan networks and hosts you own or have explicit written permission to test. Unauthorized scanning can violate laws like the Computer Fraud and Abuse Act (US) or equivalent legislation elsewhere. Everything in this guide assumes a lab environment, a CTF range, or a signed scope of work.
Installing Nmap
On Debian/Ubuntu/Kali:
sudo apt update && sudo apt install nmap -y
On macOS (via Homebrew):
brew install nmap
On Windows, download the installer from the official Nmap site — it bundles Npcap, which handles raw packet capture on Windows.
Verify the install:
nmap --version
Basic Syntax
Every Nmap command follows this shape:
nmap [scan type] [options] [target]
The simplest possible scan:
nmap 192.168.1.1
This runs a default SYN scan (if you have root/sudo) against the 1,000 most common ports.
Target Specification
Nmap is flexible about how you specify targets:
nmap 192.168.1.1 # single IP
nmap 192.168.1.1 192.168.1.5 # multiple IPs
nmap 192.168.1.1-50 # IP range
nmap 192.168.1.0/24 # CIDR notation
nmap scanme.nmap.org # hostname
nmap -iL targets.txt # read targets from a file
nmap -iR 100 # scan 100 random hosts
I use -iL targets.txt constantly in lab work — one host per line in the file, and Nmap chews through the whole list.
To exclude hosts from a scan:
nmap 192.168.1.0/24 --exclude 192.168.1.1
nmap 192.168.1.0/24 --excludefile exclude-list.txt
Host Discovery Flags
Before scanning ports, I often just want to know what’s alive:
| Flag | Purpose |
|---|---|
-sn | Ping scan only, no port scan |
-Pn | Skip host discovery, treat all hosts as up |
-PS | TCP SYN ping |
-PA | TCP ACK ping |
-PU | UDP ping |
-PE | ICMP echo ping |
-PR | ARP ping (default on local networks) |
nmap -sn 192.168.1.0/24
I cover this in depth in my dedicated host discovery article, but the short version: -sn is my go-to for a quick “who’s on this network right now” check.
Port Scanning Techniques
| Flag | Scan Type | Notes |
|---|---|---|
-sS | TCP SYN scan | Default, fast, stealthy, needs root |
-sT | TCP Connect scan | No root needed, completes full handshake |
-sU | UDP scan | Slow but necessary for DNS, SNMP, etc. |
-sA | ACK scan | Maps firewall rulesets |
-sF | FIN scan | Stealth scan, evades some filters |
-sX | XMAS scan | Sets FIN, PSH, URG flags |
-sN | NULL scan | No flags set at all |
-sW | Window scan | Similar to ACK, examines window size |
sudo nmap -sS 192.168.1.10
I go deep into each of these in my port scanning techniques article — the short version is: -sS for daily use, -sT when you don’t have root, -sU when the target might be running DNS or SNMP.
Port Selection
nmap -p 80 192.168.1.10 # single port
nmap -p 80,443,8080 192.168.1.10 # specific ports
nmap -p 1-1000 192.168.1.10 # port range
nmap -p- 192.168.1.10 # all 65535 ports
nmap -F 192.168.1.10 # fast scan, top 100 ports
nmap --top-ports 20 192.168.1.10 # top 20 most common ports
For serious engagements, I always run -p- at least once. Default scans only check the top 1,000 ports, and I’ve personally found services hiding on obscure high ports that a “quick scan” would have missed entirely.
Service and Version Detection
nmap -sV 192.168.1.10 # detect service versions
nmap -sV --version-intensity 9 # more aggressive probing
nmap -sV --version-light # faster, less thorough
I almost never run a scan without -sV in real engagements — knowing that port 80 is running nginx 1.18.0 rather than just “port 80 open” changes what I do next.
OS Detection
sudo nmap -O 192.168.1.10
sudo nmap -O --osscan-guess 192.168.1.10
OS detection needs at least one open and one closed port to work reliably, and it requires root privileges because it crafts raw packets.
The Aggressive Scan
When I want everything at once — OS detection, version detection, script scanning, and traceroute — I reach for:
sudo nmap -A 192.168.1.10
This is convenient but noisy. I never use -A when stealth matters; it’s a scan designed for thoroughness, not subtlety.
Timing Templates
nmap -T0 192.168.1.10 # paranoid, very slow
nmap -T1 192.168.1.10 # sneaky
nmap -T2 192.168.1.10 # polite
nmap -T3 192.168.1.10 # normal (default)
nmap -T4 192.168.1.10 # aggressive
nmap -T5 192.168.1.10 # insane
I default to -T4 on my home lab and internal test networks where speed matters more than stealth. I’ve written a full breakdown of when each template actually makes sense in my timing templates article.
Nmap Scripting Engine (NSE)
nmap -sC 192.168.1.10 # default script set
nmap --script=vuln 192.168.1.10 # vulnerability scripts
nmap --script=http-title 192.168.1.10 # single script
nmap --script-updatedb # update script database
nmap --script-help=http-title # get help on a script
Scripts live in /usr/share/nmap/scripts/ on most Linux installs. I dedicate a full article to writing and using these, because NSE is honestly what makes Nmap more than just a port scanner.
Output Formats
nmap -oN scan.txt 192.168.1.10 # normal output
nmap -oX scan.xml 192.168.1.10 # XML output
nmap -oG scan.gnmap 192.168.1.10 # grepable output
nmap -oA scan_results 192.168.1.10 # all formats at once
I always use -oA on real assessments. Having the XML available means I can feed it into other tools later without re-scanning.
Firewall and IDS Evasion
nmap -f 192.168.1.10 # fragment packets
nmap -D RND:5 192.168.1.10 # decoy scan, 5 random decoys
nmap -g 53 192.168.1.10 # source port manipulation
nmap --data-length 25 192.168.1.10 # append random data
nmap --spoof-mac 0 192.168.1.10 # spoof MAC address
I cover the theory and legality context of these in my dedicated evasion techniques article. They’re powerful, but they’re also the flags most likely to trigger an angry phone call if used outside an authorized scope.
Verbosity and Debugging
nmap -v 192.168.1.10 # verbose
nmap -vv 192.168.1.10 # more verbose
nmap -d 192.168.1.10 # debugging output
nmap --reason 192.168.1.10 # show reason for port state
nmap --packet-trace 192.168.1.10
When a scan gives me a result I don’t trust, --reason and --packet-trace are the first two flags I add.
Practical Example: A Real Workflow
Here’s roughly how I chain commands together on a fresh target in a lab environment:
# Step 1: find live hosts
nmap -sn 192.168.1.0/24 -oG live-hosts.txt
# Step 2: full port sweep on a discovered host
sudo nmap -p- -T4 192.168.1.10 -oN full-ports.txt
# Step 3: deep dive on discovered open ports
sudo nmap -sV -sC -p 22,80,443 192.168.1.10 -oN service-detail.txt
# Step 4: check for known vulnerabilities
sudo nmap --script=vuln -p 80,443 192.168.1.10 -oN vuln-check.txt
Each step narrows focus and adds detail rather than blasting every flag at once — this keeps scans efficient and results readable.
Python Integration
For scripted workflows, I use python-nmap, a wrapper around the Nmap binary:
pip install python-nmap
import nmap
scanner = nmap.PortScanner()
scanner.scan('192.168.1.10', '22-443', arguments='-sV')
for host in scanner.all_hosts():
print(f"Host: {host} ({scanner[host].hostname()})")
print(f"State: {scanner[host].state()}")
for proto in scanner[host].all_protocols():
ports = scanner[host][proto].keys()
for port in sorted(ports):
service = scanner[host][proto][port]
print(f" Port {port}/{proto}: {service['state']} - {service['name']} {service.get('version', '')}")
This is genuinely useful when you need to fold Nmap results into a larger automation pipeline — I use something similar in my own tooling to pipe scan output into a report generator.
Common Troubleshooting
“You requested a scan type which requires root privileges” — run with sudo, or switch to -sT which doesn’t need raw socket access.
Scan seems to hang forever — you’re probably scanning a host that’s silently dropping packets. Add -Pn to skip host discovery, or lower to -T2 if the network itself is unstable.
All ports show as filtered — a firewall is very likely dropping your probes. Try -sA to distinguish “filtered by firewall” from “genuinely closed.”
UDP scan takes forever — this is normal. UDP scanning is inherently slow because of how ICMP rate-limiting works; narrow your port range with -p instead of scanning all 65535.
Limitations Worth Knowing
Nmap can’t see through a well-configured firewall that drops rather than rejects packets — you’ll get “filtered” instead of a clear answer. It also can’t guarantee accuracy against hosts running port knocking, aggressive IDS/IPS systems, or heavily rate-limited services. Version detection is probabilistic, not certain — always verify anything security-critical manually.
Security Best Practices
- Always get written authorization before scanning anything you don’t own.
- Start with
-snbefore committing to a full port scan — know your scope first. - Use
-oAto keep records of every scan you run; you’ll thank yourself later. - Rate-limit aggressive scans (
-T2or-T1) on production networks to avoid service disruption. - Never run vulnerability scripts (
--script=vuln) against systems without explicit permission — some scripts can be intrusive.
Frequently Asked Questions
Does Nmap require root privileges? Some scan types do (SYN scan, OS detection, most NSE scripts that need raw sockets), because they craft raw packets at the network layer. TCP Connect scans (-sT) work without root since they use the standard OS socket API.
Is Nmap legal to use? Yes, the tool itself is legal everywhere. What’s not legal in most jurisdictions is using it against systems you don’t own or don’t have explicit permission to test.
What’s the difference between Nmap and Masscan? I cover this in detail in a separate comparison article, but briefly: Nmap is more thorough and feature-rich; Masscan is built purely for speed at internet scale.
Can Nmap detect all open ports reliably? Not always — heavily firewalled or rate-limited targets can produce false negatives. Combining scan types (SYN + ACK, for example) gives a more complete picture.
Wrapping Up
This cheat sheet covers roughly 90% of what I actually type into a terminal during real scanning work. Bookmark it, print it, whatever works — but more importantly, practice these commands against something like scanme.nmap.org (which Nmap’s creators explicitly allow scanning) or your own home-lab VMs. Reading commands and running them are two very different skills, and Nmap rewards the people who actually type the syntax until it’s muscle memory.
In the rest of this series, I break each of these categories down individually with much more depth — port scanning techniques, host discovery, OS fingerprinting, NSE scripting, evasion, output formats, timing, and vulnerability scanning. Consider this the map; the rest of the series is the territory.
