Your complete all-in-one reference for network scanning — from your first command to advanced techniques.
Network Mapper (nmap) is a free, open-source tool for network exploration and security auditing, created by Gordon Lyon in 1997. It's one of the most widely used network tools in the world — used by sysadmins, penetration testers, and security researchers alike.
Nmap works by sending specially crafted packets to target hosts and analyzing the responses to find open ports, running services, OS fingerprints, and more.
Find which devices are live on a network without port scanning.
Identify open, closed, or firewalled ports on a target.
Find exact software name and version on each open port.
Guess the OS of a remote host from network responses.
Run 600+ scripts for vuln detection, banners, and more.
Map topology using traceroute and host data.
The general format for every nmap command:
Quick examples:
↑ scanme.nmap.org is Nmap's official legal test server — always safe to scan.
Download from nmap.org/download.html — includes the Zenmap GUI app.
Step-by-step beginner walkthroughs
Quick reference for every flag
Build commands visually — no memorization
Understand all terms and flags
Learn to interpret scan results
Configure options visually and get the exact nmap command to run.
sudo on Linux/macOS, or as Administrator on Windows.Tip: Combine -sV -sC -O for a thorough scan. Use -T4 on fast local networks.
Quick reference for all nmap flags and options.
| Command | Description |
|---|---|
| nmap 192.168.1.1 | Scan a single IP address |
| nmap 192.168.1.1-254 | Scan an IP range |
| nmap 192.168.1.0/24 | Scan a subnet (CIDR notation) |
| nmap scanme.nmap.org | Scan a hostname |
| nmap -iL targets.txt | Read targets from file (one per line) |
| nmap --exclude 192.168.1.1 | Exclude a host from scan |
| nmap -6 ::1 | IPv6 scanning |
| Flag | Name | Notes |
|---|---|---|
| -sS | SYN / Stealth Scan | ROOT Fast, stealthy, most popular |
| -sT | TCP Connect Scan | No root needed, more detectable |
| -sU | UDP Scan | ROOT Slow, finds UDP services |
| -sA | ACK Scan | ROOT Maps firewall rules, not open ports |
| -sN | NULL Scan | ROOT Stealthy — no flags set |
| -sF | FIN Scan | ROOT Stealthy — FIN flag only |
| -sX | Xmas Scan | ROOT Stealthy — FIN+PSH+URG flags |
| -sn | Ping Scan (host discovery) | No port scan, just finds live hosts |
| -Pn | Skip host discovery | Treats all hosts as up |
| -PR | ARP Ping | Local network only, very reliable |
| -PE | ICMP Echo Ping | Explicit ICMP echo request — the classic "ping" |
| -PS | TCP SYN Ping | Sends SYN to port 80 to find hosts when ICMP is blocked |
| -PU | UDP Ping | Sends UDP probe to find hosts — useful when TCP/ICMP are filtered |
| Flag | Description |
|---|---|
| -p 22 | Scan port 22 only |
| -p 22,80,443 | Scan specific ports |
| -p 1-1000 | Scan port range |
| -p- | Scan all 65,535 ports |
| -F | Fast — top 100 most common ports |
| --top-ports 100 | Top N most common ports |
| -p U:53,T:80 | Specify UDP or TCP per port |
| Flag | Description |
|---|---|
| -sV | Service and version detection |
| --version-intensity 0-9 | Version probe intensity (0=light, 9=max) |
| -O | OS detection — requires root |
| --osscan-guess | Guess OS aggressively when uncertain |
| -A | Aggressive: enables -O, -sV, -sC, --traceroute |
| --traceroute | Trace hop path from host to target |
| Command | Description |
|---|---|
| -sC | Run default scripts (= --script=default) |
| --script=vuln | Vulnerability detection scripts |
| --script=auth | Authentication bypass and default creds |
| --script=banner | Grab service banners |
| --script=discovery | Network discovery scripts |
| --script=safe | Non-intrusive scripts only |
| --script=http-title | Get HTTP page titles from web servers |
| --script=ssl-cert | Retrieve SSL/TLS certificate details |
| --script=ftp-anon | Check for anonymous FTP access |
| --script=smb-vuln-ms17-010 | Check for EternalBlue vulnerability |
| --script-help <name> | Get docs for a specific script |
| Flag | Name | Use When |
|---|---|---|
| -T0 | Paranoid | IDS evasion, extremely slow |
| -T1 | Sneaky | Slow and evasive |
| -T2 | Polite | Minimal bandwidth usage |
| -T3 | Normal | Default — good balance |
| -T4 | Aggressive | Best on fast local networks |
| -T5 | Insane | Fastest — may miss ports |
| Flag | Description |
|---|---|
| -v / -vv | Verbose / very verbose output |
| -oN file.txt | Save to human-readable text file |
| -oX file.xml | Save to XML (Metasploit-compatible) |
| -oG file.gnmap | Save in grepable format |
| -oA basename | Save all three formats at once |
| --open | Only show open ports in output |
| --reason | Show reason for each port's state |
| --packet-trace | Show all packets sent and received |
| -n | No DNS resolution — speeds up scans |
| --resume file.nmap | Resume interrupted scan (requires normal or grepable output, not XML) |
| Flag | Description |
|---|---|
| -f | Fragment packets into 8-byte chunks |
| --mtu 24 | Custom MTU size (multiple of 8) |
| -D RND:10 | Use 10 random decoy IPs to mask scan |
| -S 1.2.3.4 | Spoof source IP address [ROOT] |
| --source-port 53 | Spoof source port (DNS often allowed) |
| --data-length 25 | Append random data to packets |
| --randomize-hosts | Scan targets in random order |
| --badsum | Send packets with bad checksums |
| Command | Use Case |
|---|---|
| nmap -sn 192.168.1.0/24 | Find all live hosts on LAN |
| nmap -sV 192.168.1.1 | Detect services and versions |
| sudo nmap -A -T4 192.168.1.1 | Full aggressive scan + OS detect |
| nmap -p- -T4 192.168.1.1 | Scan all 65535 ports |
| nmap --script=vuln 192.168.1.1 | Vulnerability scan |
| nmap -sU -p 53,161,123 192.168.1.1 | UDP scan DNS, SNMP, NTP |
| sudo nmap -sS -O -T4 192.168.1.0/24 | Stealth scan + OS detect on subnet |
| nmap -oA results 192.168.1.1 | Scan and save all output formats |
| nmap -v --reason --open 192.168.1.0/24 | Verbose, open ports with reasons |
Hands-on beginner-friendly walkthroughs.
Linux/macOS: open Terminal. Windows: open Command Prompt or PowerShell as Administrator.
Should show: Nmap 7.x ( https://nmap.org )
The host is alive, 3 ports are open, and what service runs on each.
Linux/macOS: ip addr or ifconfig. Windows: ipconfig. Look for your IP like 192.168.1.x — your subnet is usually 192.168.1.0/24.
The -sn flag skips port scanning entirely — just checks which hosts are alive.
Put IPs in targets.txt (one per line):
Now you know exact software versions — critical for identifying vulnerabilities.
0 = light/fast, 9 = maximum/thorough but slow:
Combines OS detect, version detect, default scripts, and traceroute:
The Nmap Scripting Engine runs Lua scripts against targets. 600+ scripts are included for banner grabbing, vulnerability detection, auth testing, and more.
Note: --resume requires a normal (-oN) or grepable (-oG) output file — not XML.
Definitions for every nmap flag, networking term, and security concept.
Learn what every line of nmap output means.
| Port | Protocol | Service | What It Is |
|---|---|---|---|
| 21 | TCP | FTP | File Transfer Protocol |
| 22 | TCP | SSH | Encrypted remote terminal access |
| 23 | TCP | Telnet | Unencrypted remote access (insecure, legacy) |
| 25 | TCP | SMTP | Email sending |
| 53 | TCP/UDP | DNS | Domain name resolution |
| 80 | TCP | HTTP | Unencrypted web traffic |
| 443 | TCP | HTTPS | Encrypted web traffic |
| 445 | TCP | SMB | Windows file sharing |
| 3306 | TCP | MySQL | MySQL database |
| 3389 | TCP | RDP | Windows Remote Desktop |
| 5432 | TCP | PostgreSQL | PostgreSQL database |
| 8080 | TCP | HTTP-Alt | Alternative web / proxy port |
| 27017 | TCP | MongoDB | MongoDB database |
Study nmap flags, scan types, port states, and networking concepts. Click a card to flip it.
Correct / Incorrect keeps the card in deck until right · Mark Learned removes it permanently · Skip moves on
Your saved commands — stored in your browser's local storage (offline, private).
Personal notes — auto-saved to your browser's local storage.
Notes only exist in this browser — copy them somewhere safe if you need to transfer them.