> For the complete documentation index, see [llms.txt](https://thamizhiniyancs.gitbook.io/cheatsheets/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://thamizhiniyancs.gitbook.io/cheatsheets/scanning-networks/nmap/nmap-options.md). # Nmap Options ## Target Specification | Option ( Switch / Syntax ) | Description | | --------------------------------------- | ------------------------------------------------------------ | | `-iL ` | Input from list of hosts/networks | | `-iR ` | Choose random targets/ Scan random hosts `nmap -iR [number]` | | `--exclude ` | Exclude single or multiple hosts/networks | | `--excludefile ` | Exclude list from file | ## Host Discovery | Option ( Switch / Syntax ) | Description | | ----------------------------------- | -------------------------------------------------------------------------------------------------------- | | `-sL` | List Scan - simply lists targets `nmap -3 -sL` | | `-sn` | Ping Scan - disable port scan for discovering host `nmap /24 -sn` | | `-Pn` | Treat all hosts as online -- skip host discovery nmap `-5 -Pn` | | `-PS/PA/PU/PY[portlist]` | TCP SYN/ACK, UDP or SCTP INIT discovery to given ports | | `-PE/PP/PM` | ICMP echo, timestamp, and netmask request discovery probes | | `-PP` | Use ICMP timestamp request | | `-PO[protocol list]` | IP Protocol Ping | | `-n/-R` | Never do DNS resolution/Always resolve \[default: sometimes] `nmap –n ` `nmap –R ` | | `--dns-servers ` | Immediate mode, display things as we find them | | `--system-dns` | A string representing the intended sequence ignorance level | | `--traceroute` | Path to a file where flat text will be dumped that normally would go to the users terminal | | `-PR` | Numeric value representing the number of seconds to wait before declaring the scan over | ## Scan Techniques | Option ( Switch / Syntax ) | Description | | ------------------------------- | ---------------------------------------------------------------------------------------- | | `-sS/sT/sA/sW/sM` | TCP SYN/Connect()/ACK/Window/Maimon scans | | `-sU` | UDP Scan `nmap -sU -v ` UDP port scan `nmap -sU` | | `-sN/sF/sX` | TCP Null, FIN, and Xmas scans | | `--scanflags=value –sA` | TCP ACK scan `nmap --scanflags=value –sA ` | | `-–scanflags` | TCP scan flags `nmap --scanflags ` | | `-Sp` | Ping scan `nmap -Sp ` | | `--scanflags ` | Customize TCP scan flags | | `-sI ` | Idle zombie scan `nmap –sI zombie ` | | `-sY/sZ` | SCTP INIT scan `nmap -sY -v ` SCTP COOKIE-ECHO scan `nmap -sZ -v ` | | `-sO` | IP protocol scan `nmap –sO ` | | `-b ` | FTP bounce scan | | `–send-eth` | Send raw ethernet packets `nmap –send-eth ` | | `–send-ip` | Send IP packets `nmap –send-ip ` | ## Port Specification and Scan Order | Option ( Switch / Syntax ) | Description | | -------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `-p ` | Only scan specified range ports `nmap -p 1-100 ` e.g. -p 80,443 or -p 1–65535 | | `-p-` | Port scans all 1-65535 ports `nmap -p-` | | `-p ` | Port scan from specified protocols `nmap -p smtp,https ` | | `-F` | Fast mode - Scan less ports than the default scan (scan 100 most common ports) `nmap -F` | | `-r` | Scan ports consecutively – do not randomize | | `–randomize-hosts` | Randomize target host order `nmap --randomize-hosts ` | | `-p ,,...` | Port list | | `-p -` | Port range | | `-P "*"` | Scan port using name `nmap -p "*" ftp ` | | `-p U:53,U:110,T20-445` | Mix TCP and UDP | | `--top-ports ` | Scan most common ports | | `--port-ratio ` | Scan ports more common than | | `-p-65535` | Leaving off initial port in range makes Nmap scan start at port 1 `nmap -p-65535` Leaving off initial port in range makes the scan start at port 1 `nmap -p-65535 ` | | `-p0-` | Leaving off end port in range makes Nmap scan through port 65535 `nmap -p0-` `nmap -p0- ` | ## Service / Version Detection | Option ( Switch / Syntax ) | Description | | ----------------------------- | ------------------------------------------------------------------------- | | `-sV` | Probe open ports to determine service/version info `nmap -sV` | | `--version-intensity ` | Set from 0 (light) to 9 (try all probes) | | `--version-light` | Limit to most likely probes (intensity 2) | | `--version-all` | Try every single probe (intensity 9) | | `--version-trace` | Show detailed version scan activity (for debugging) | ## Script Scan | Option ( Switch / Syntax ) | Description | | --------------------------------------------------------------------- | --------------------------------------------------------------------------- | | `--script= ( or ) ( or ) ...` | Run individual or group of scripts | | `--script=` | is a comma separated list of directories, script-files or script-categories | | `--script-trace` | Show all data sent and received | | `--script-updatedb` | Update the script database. `nmap --script-updatedb` | | `--script-help` | “Lua scripts” = Show help about scripts | ## OS Detection | Option ( Switch / Syntax ) | Description | | -------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- | | `-O` | Enable OS detection/ OS Discovery using Nmap and Unicornscan/ Remote OS Detection using TCP/IP stack fingerprinting `nmap -O ` | | `--osscan-limit` | Limit OS detection to promising targets | | `--osscan-guess` | Guess OS more aggressively | | `--max-os-tries` | Set the maximum number x of OS detection tries against a target | ## Timing and Performance | Option ( Switch / Syntax ) | Description | | --------------------------------------------------------------- | --------------------------------------------------------------------------- | | `-T<0-5>` | Set timing template (higher is faster) | | `–ttl [time]` | Set the packet TTL `nmap –ttl [time] ` `nmap /24 -sn` | | `--min-hostgroup/max-hostgroup ` | Parallel host scan group sizes | | `--min-parallelism/max-paralleli sm ` | Probe parallelization | | `--min-rtt-timeout/max-rtt-timeo ut/initial-rtt-timeout