What is nmap?
nmap (Network Mapper) is a powerful open-source tool widely used in network security for:
- Discovering live hosts on a network
- Identifying open ports and running services
- Detecting service versions and operating systems
- Finding vulnerabilities in networked systems
- Mapping network architecture
nmap operates through a command-line interface and provides a broad range of scanning options that make it useful for both basic network inventory and advanced security assessments.
Basic Syntax
nmap <TARGET>
# Examples:
nmap 192.168.1.1 # single IP
nmap 192.168.1.0/24 # entire subnet
nmap 10.0.0.1-50 # IP range
nmap target.example.com # domain name
Host Discovery
Before scanning ports, nmap determines which hosts are alive.
# Ping scan — host discovery only, no port scan
nmap -sn 192.168.66.0/24
# Reports live hosts in the subnet that respond to ping (ICMP)
# List targets without scanning (dry run)
nmap -sL 192.168.1.0/24
# TCP SYN discovery on specific ports
nmap -PS22,80,443 192.168.1.0/24
# TCP ACK discovery
nmap -PA80 192.168.1.0/24
# UDP discovery
nmap -PU53 192.168.1.0/24
Port Scanning Types
TCP Connect Scan (-sT)
Performs a complete three-way TCP handshake. Visible in server logs, but works without elevated privileges.
nmap -sT 192.168.124.148
TCP SYN Scan / Stealth Scan (-sS)
Sends only the SYN packet — the first step of the TCP handshake. Does not complete the connection, making it less visible in application logs. Requires root/admin privileges.
nmap -sS 192.168.124.148
SYN Scan:
Nmap ---SYN--> Target
Nmap <--SYN+ACK-- Target (port open)
Nmap ---RST--> Target (never completes handshake)
UDP Scan (-sU)
Scans for open UDP ports. Slower than TCP scanning because UDP is connectionless.
nmap -sU 192.168.124.148
Controlling Which Ports to Scan
# Scan specific ports
nmap -p 80,443 192.168.1.1
# Scan a port range
nmap -p 1-2000 192.168.1.1
# Scan from port 1 to 25
nmap -p-25 192.168.1.1
# Scan ALL ports (1-65535)
nmap -p- 192.168.1.1
# Fast mode — only the 100 most common ports
nmap -F 192.168.1.1
Service and Version Detection
# Detect service versions running on open ports
nmap -sV 192.168.124.148
# Combine UDP scan with version detection
nmap -sU -sV 192.168.124.148
Version detection identifies the exact software and version running on each open port, enabling targeted vulnerability lookups.
OS Detection
# Attempt OS fingerprinting
nmap -O 192.168.124.148
# OS detection combined with UDP scan
nmap -sU -O 192.168.124.148
nmap uses various indicators — TCP/IP stack behavior, timing characteristics, and response patterns — to make an educated guess about the target's operating system.
Aggressive Scan (-A)
The -A flag enables OS detection, version detection, script scanning, and traceroute in a single command.
nmap -A 192.168.124.148
# Combine with UDP
nmap -sU -A 192.168.124.148
Forcing a Scan on Non-Responsive Hosts
If a host does not respond to ICMP during host discovery, nmap marks it as down and skips port scanning. Use -Pn to override this and treat all hosts as online.
nmap -Pn -A 192.168.124.148
Timing Templates
nmap provides six timing templates controlling how aggressively it scans:
| Template | Name | Total Duration (example) |
|---|---|---|
-T0 | Paranoid | ~9.8 hours |
-T1 | Sneaky | ~27.5 minutes |
-T2 | Polite | ~40 seconds |
-T3 | Normal (default) | ~0.15 seconds |
-T4 | Aggressive | ~0.13 seconds |
-T5 | Insane | Fastest possible |
# Slow scan to avoid detection
nmap -T1 192.168.1.1
# Fast aggressive scan in a lab
nmap -T4 -A 192.168.1.1
Fine-grained timing controls:
# Control parallel probes
--min-parallelism 10 --max-parallelism 100
# Control packet rate
--min-rate 100 --max-rate 1000
# Timeout for slow hosts
--host-timeout 30s
Saving Scan Results
# Normal human-readable output
nmap -A 192.168.1.1 -oN scan_results.txt
# XML output (for tools like Metasploit import)
nmap -A 192.168.1.1 -oX scan_results.xml
# Grepable output
nmap -A 192.168.1.1 -oG scan_results.grep
# Save in all formats simultaneously
nmap -A 192.168.1.1 -oA scan_basename
Verbosity and Debugging
# Verbose output
nmap -v 192.168.1.1
# More verbose
nmap -vv 192.168.1.1
# Maximum verbosity
nmap -v4 192.168.1.1
# Debug level (increasing detail)
nmap -d 192.168.1.1
nmap -d9 192.168.1.1
You can also press v during an active scan to increase verbosity in real time.
Complete Flag Reference
| Option | Description |
|---|---|
-sL | List scan — list targets without scanning |
-sn | Ping scan — host discovery only |
-sT | TCP connect scan — complete three-way handshake |
-sS | TCP SYN scan — only first step of handshake (stealth) |
-sU | UDP scan |
-F | Fast mode — 100 most common ports |
-p <range> | Specify port range; -p- for all 65535 ports |
-Pn | Treat all hosts as online |
-O | OS detection |
-sV | Service version detection |
-A | OS detection, version detection, scripts, traceroute |
-T<0-5> | Timing template |
--min-parallelism | Minimum parallel probes |
--max-parallelism | Maximum parallel probes |
--min-rate | Minimum packet rate |
--max-rate | Maximum packet rate |
--host-timeout | Maximum time to wait per host |
-v | Verbosity (use -vv or -v4 for more) |
-d | Debugging (use -d9 for maximum) |
-oN <file> | Normal output |
-oX <file> | XML output |
-oG <file> | Grepable output |
-oA <basename> | Output in all major formats |