nmap
Networking
Usage
nmap [-sV] -p <ports> <target>Sweeps a host to see which ports answer; `-sS` and `-O` need root, and scanning a machine you do not own is recorded as an attack in its logs and is illegal in some countries, so keep it to your own networks.
Common flags
| Flag | Meaning |
|---|---|
| -p 22,80,443 / -p- | Specific ports / all 65535 of them. |
| --top-ports 100 | The hundred most common ports, a good first pass. |
| -sS | SYN scan: fast and quiet, but needs root. |
| -sT | Full TCP connect scan, the fallback when you are not root. |
| -sV | Ask each open port what software and version it is. |
| -sn | Host discovery only, no port scan. |
| -Pn | Assume the host is up, for targets that ignore ping. |
| -oN <file> / -oX <file> | Save plain-text / XML output. |
Examples
nmap -p 22,80,443 192.168.1.10Check three ports on one machine.
nmap -sn 192.168.1.0/24List which addresses on the LAN are answering.
sudo nmap -sS -sV --top-ports 100 10.0.0.5Fast scan with service detection.
When a connection fails, these narrow down how far it got — name not resolving, no route, or a blocked port.
How to read this
- Square brackets [ ] mark a part you may leave out.
- An ellipsis … means you can list more than one.
- Flags are case-sensitive — in some commands -r and -R do different things.
Questions
Q. What does nmap do?
Sweeps a host to see which ports answer; `-sS` and `-O` need root, and scanning a machine you do not own is recorded as an attack in its logs and is illegal in some countries, so keep it to your own networks.
Q. How do I type it?
nmap [-sV] -p <ports> <target> — square brackets mark the parts you can leave out.
Q. How many flags are worth knowing?
8 are listed here; the full set is in man nmap. This command sits under Networking.
Related commands
man page: man nmap