This Nmap cheat sheet gives you the commands you actually use during a pentest, a CTF or a network audit: target selection, host discovery, scan types, port selection, service and OS detection, NSE scripts, timing, output and firewall evasion. Copy the commands, replace the target, and only scan systems you own or are explicitly authorized to test.
Quick-Start Commands
If you only remember five commands, make it these:
# Fast scan of the 100 most common ports
nmap -F 10.10.10.5
# Default scripts + version detection on the top 1000 ports
nmap -sC -sV 10.10.10.5
# Scan all 65,535 TCP ports quickly (lab/CTF)
sudo nmap -p- --min-rate 5000 -T4 10.10.10.5
# Find live hosts on a subnet without port scanning
sudo nmap -sn 192.168.1.0/24
# Aggressive scan: OS, versions, default scripts and traceroute
sudo nmap -A 10.10.10.5Target Specification
| Command | What it does |
|---|---|
nmap 10.10.10.5 | Scan a single IP |
nmap scanme.nmap.org | Scan a hostname |
nmap 192.168.1.0/24 | Scan a CIDR range |
nmap 192.168.1.1-50 | Scan an IP range |
nmap -iL targets.txt | Read targets from a file |
nmap 192.168.1.0/24 --exclude 192.168.1.1 | Exclude a host from the scan |
Host Discovery
| Option | What it does |
|---|---|
-sn | Ping scan only: list live hosts, no port scan |
-Pn | Skip host discovery and treat every host as up (useful when ICMP is blocked) |
-PS22,80,443 | TCP SYN ping on the given ports |
-PA80 | TCP ACK ping |
-PU53 | UDP ping |
-PE | ICMP echo request ping |
-PR | ARP ping (default for local Ethernet networks when run as root) |
-n | Never do DNS resolution (faster) |
--traceroute | Trace the network path to each host |
Scan Techniques
| Option | Scan type | Notes |
|---|---|---|
-sS | TCP SYN (“half-open”) | Default when run as root; fast and relatively quiet |
-sT | TCP connect | Default without root privileges; completes the handshake |
-sU | UDP scan | Slow but essential (DNS, SNMP, TFTP…) |
-sA | TCP ACK | Maps firewall rules (filtered vs unfiltered) |
-sN / -sF / -sX | Null, FIN, Xmas | Can slip past some stateless filters; unreliable against Windows |
-sV | Version detection | Identifies service and version behind each port |
-O | OS detection | Requires root; works best with at least one open and one closed port |
Port Selection
| Option | What it does |
|---|---|
-p 22 | Scan a single port |
-p 22,80,443 | Scan a list of ports |
-p 1-1000 | Scan a port range |
-p- | Scan all ports 1–65535 |
-p U:53,T:80 | Mix UDP and TCP ports (use with -sU -sS) |
-F | Fast mode: top 100 ports |
--top-ports 1000 | Scan the N most common ports |
--open | Only show open (or possibly open) ports |
Service, Version and OS Detection
| Option | What it does |
|---|---|
-sV | Probe open ports to determine service and version |
--version-intensity 0-9 | How many probes to try (0 = light, 9 = all) |
--version-light | Shortcut for intensity 2 (faster) |
-O | Operating system detection |
--osscan-guess | Guess the OS more aggressively |
-A | Enables OS detection, version detection, default scripts and traceroute |
Nmap Scripting Engine (NSE)
NSE turns Nmap from a port scanner into an enumeration tool. Scripts are grouped into categories such as default, safe, discovery, auth, vuln, brute and intrusive.
# Run the default script set (same as --script=default)
nmap -sC 10.10.10.5
# Run specific scripts
nmap --script http-title,http-headers -p 80,443 10.10.10.5
# Run a whole category
nmap --script vuln 10.10.10.5
# Run all SMB enumeration scripts against port 445
nmap --script "smb-enum-*" -p 445 10.10.10.5
# Pass arguments to a script
nmap --script http-enum --script-args http-enum.basepath=/app/ -p 80 10.10.10.5
# Read a script's documentation
nmap --script-help ssh-auth-methodsCategories like brute, intrusive and dos can lock accounts or disrupt services, so only run them when your scope explicitly allows it.
Timing and Performance
| Option | What it does |
|---|---|
-T0 / -T1 | Paranoid / Sneaky: very slow, used for IDS evasion |
-T2 | Polite: slows down to use less bandwidth |
-T3 | Normal (default) |
-T4 | Aggressive: good choice on fast, reliable networks and labs |
-T5 | Insane: fastest, may miss ports |
--min-rate 1000 | Send at least N packets per second |
--max-retries 1 | Limit probe retransmissions |
--host-timeout 30m | Give up on a host after the given time |
--scan-delay 1s | Wait between probes |
Output Options
| Option | What it does |
|---|---|
-oN scan.txt | Normal, human-readable output |
-oX scan.xml | XML output (for tools and reports) |
-oG scan.gnmap | Grepable output |
-oA scan | Save in all three main formats at once |
-v / -vv | Increase verbosity (see results as they arrive) |
--reason | Show why a port is in a given state |
--packet-trace | Show every packet sent and received |
--stats-every 30s | Print progress periodically |
--resume scan.gnmap | Resume an interrupted scan |
Firewall and IDS Evasion
These options are useful for testing how well your own firewall and IDS detect scans. Use them only within an authorized scope.
| Option | What it does |
|---|---|
-f | Fragment packets |
--mtu 16 | Set a custom fragment size (multiple of 8) |
-D RND:5 | Hide among 5 random decoy addresses |
-g 53 | Use a specific source port |
--data-length 25 | Append random data to packets |
--spoof-mac 0 | Use a random MAC address |
Understanding Port States
| State | Meaning |
|---|---|
| open | A service is accepting connections |
| closed | Port is reachable but nothing is listening |
| filtered | A firewall or filter blocks the probes, so Nmap cannot tell |
| unfiltered | Reachable, but open/closed is unknown (seen with ACK scans) |
| open|filtered | No response; common in UDP scans |
| closed|filtered | Nmap cannot decide between closed and filtered |
Practical Workflows
CTF and Hack The Box
Find every open port first, then run detailed scans only on what you found:
# Step 1: all TCP ports, fast
sudo nmap -p- --min-rate 5000 -T4 -oN allports.txt 10.10.10.5
# Step 2: scripts and versions on the open ports only
nmap -p 22,80,8080 -sC -sV -oN targeted.txt 10.10.10.5
# Step 3: don't forget the most common UDP ports
sudo nmap -sU --top-ports 20 10.10.10.5New to HTB? Start with our Hack The Box beginner’s guide and the first CTF methodology.
Internal Network Audit
# Discover live hosts
sudo nmap -sn 192.168.1.0/24 -oG live.gnmap
# Extract the IPs that responded
grep Up live.gnmap | cut -d " " -f 2 > hosts.txt
# Scan the top 1000 ports with versions on those hosts
sudo nmap -sS -sV -iL hosts.txt -oA internal_auditWhat to Do After Nmap
- Web ports (80, 443, 8080): enumerate content with Gobuster or FFUF, and check the server with Nikto.
- SMB (139, 445): enumerate shares and users with enum4linux-ng or NetExec.
- Unexpected results: capture the traffic with Wireshark to see what is really happening.
- Got a shell? Move on to our Linux privilege escalation cheat sheet.
Common Mistakes
- Only scanning the top 1000 ports. Services on high ports are missed; use
-p-when you can. - Forgetting UDP. SNMP, DNS and TFTP often hide the easiest wins.
- Running as a normal user. Without root, Nmap falls back to slower connect scans and cannot do OS detection.
- Not saving output. Always use
-oAso you can review and report later. - Using -T5 or very high rates on real networks. You will miss ports and may disrupt fragile devices.
Frequently Asked Questions
Is Nmap legal to use?
Yes, on networks you own or have written permission to test. Scanning systems without authorization may be illegal depending on your country, so stick to your own lab, platforms like Hack The Box, or an agreed pentest scope.
What is the difference between -sS and -sT?
-sS sends a SYN and never completes the TCP handshake, which is faster and leaves fewer application logs, but it needs root. -sT uses the operating system’s normal connect call and completes the handshake, so it works without privileges but is slower and noisier.
How do I scan all ports with Nmap?
Use -p-, which covers ports 1 to 65535. Adding --min-rate and -T4 speeds it up in labs.
Why are my ports showing as filtered?
A firewall is dropping the probes. Try -Pn if the host looks down, scan different ports, or use an ACK scan (-sA) to map which rules are in place.
Is Nmap a vulnerability scanner?
Not primarily. It maps hosts, ports and services, but NSE scripts in the vuln category can check for some known issues. For full assessments, combine it with a dedicated scanner and manual testing.
Conclusion
Nmap is the first tool you run and the one you come back to most. Master host discovery, full port scans, -sC -sV and the output options first, then add NSE scripts and timing tweaks as you gain experience. Bookmark this cheat sheet and keep the official documentation close for the details.