Nmap Cheat Sheet
Nmap is the tool you reach for first on any engagement, and most of it comes down to a few dozen flags you use constantly. This is those flags — host discovery, port scanning, service and version detection, the Nmap Scripting Engine (NSE), timing, firewall evasion and output — each with the exact command and a plain line on what it does. Every command copies with one click. Nothing here is gated behind an email or a download. Not sure what to scan yet? Map the target passively first with the OSINT & recon tools cheat sheet.
Commands are written against Nmap 7.9x and were checked on the date in the chip above. Where a scan needs root it is noted; on Linux and macOS that means running the command with sudo.
Scan only what you own or are explicitly allowed to scan. Port scanning a host you have no permission to test can be illegal in many places, whatever your intent. To practise safely, Nmap runs a target built for it — scanme.nmap.org — and their policy is “a few scans a day is fine.” Better still, point these at your own Lab 00 VM, where you can scan as hard as you like.
Target specification
How you name what to scan. These combine with everything below.
nmap 192.168.1.10 scanme.nmap.org
One or more hosts by IP or name, space-separated.
nmap 192.168.1.0/24
A whole subnet in CIDR notation. /24 is 256 addresses.
nmap 192.168.1.1-50
An octet range. You can range any octet, e.g. 10.0.0-5.1-254.
nmap -iL targets.txt
Read targets from a file, one per line — the usual way to scan a scoped list.
nmap 10.0.0.0/24 --exclude 10.0.0.1
Scan a range but skip named hosts — useful for leaving the gateway alone.
Host discovery
Find which hosts are up before you scan ports, or skip discovery entirely.
nmap -sn 192.168.1.0/24
Ping sweep. -sn discovers live hosts and scans no ports — the fastest way to map what is on a network.
nmap -Pn 192.168.1.10
Skip discovery. -Pn treats every host as up and scans it anyway — essential when a host drops pings but is really there.
nmap -PS22,80,443 192.168.1.0/24
TCP SYN ping to specific ports — finds hosts that block ICMP but answer on common services.
Port scanning
The core of Nmap. -sS needs root; -sT does not.
sudo nmap -sS 192.168.1.10
SYN scan (default when root). Fast and quiet — it never completes the TCP handshake.
nmap -sT 192.168.1.10
TCP connect scan. Completes the handshake; the fallback when you are not root.
sudo nmap -sU 192.168.1.10
UDP scan. Slow but necessary — DNS, SNMP, DHCP and more live only on UDP.
nmap -p 22,80,443 192.168.1.10
Specific ports with -p. Prefix with U: or T: to mix protocols, e.g. -p U:53,T:80.
nmap -p- 192.168.1.10
All 65,535 ports. The thorough scan — run it against your own hosts, not shared practice targets.
nmap -F 192.168.1.10
Fast scan — the top 100 ports only. --top-ports 20 lets you pick the number.
nmap --open 192.168.1.10
Show only open ports — hides closed and filtered noise from the output.
Service and version detection
Move from “port 80 is open” to “Apache 2.4.58 on Ubuntu”.
nmap -sV 192.168.1.10
Version detection. Probes each open port to name the service and its version — the single most useful flag after a port scan.
sudo nmap -O 192.168.1.10
OS detection from TCP/IP fingerprinting. Needs root and at least one open and one closed port to be confident.
sudo nmap -A 192.168.1.10
Aggressive. A shortcut for version detection, OS detection, default scripts and a traceroute in one go. Loud, but the fullest single-command picture.
The Nmap Scripting Engine (NSE)
NSE runs Lua scripts against open ports — banner grabbing, brute forcing, and known-vulnerability checks. Scripts live in categories: safe, default, discovery, auth, brute, vuln, intrusive, exploit.
nmap -sC 192.168.1.10
Default scripts — the safe/default set, safe to run and full of quick wins. Same as --script=default.
nmap --script vuln 192.168.1.10
Vulnerability scripts — checks each service against known CVEs. Intrusive; run only where you are authorised.
nmap --script http-title,http-headers -p 80,443 192.168.1.10
Named scripts, comma-separated. Use --script-help <name> to read what one does before running it.
Timing and performance
-T0 (paranoid) to -T5 (insane). -T4 is the everyday default; drop lower on fragile targets or to stay quiet.
nmap -T4 192.168.1.10
Fast timing — a sensible speed on a healthy network.
nmap --min-rate 1000 192.168.1.10
Rate floor — send at least this many packets per second. Pushes a large scan along when the network can take it.
Firewall and IDS evasion
Techniques for probing through packet filters. They are noisy and situational — understand what each does before relying on it.
sudo nmap -f 192.168.1.10
Fragment packets so simple filters cannot read the whole header at once.
sudo nmap -D RND:5 192.168.1.10
Decoys. Mix your real scan among five random spoofed sources so it is harder to pick out.
sudo nmap -g 53 192.168.1.10
Source port. Some firewalls trust traffic from port 53 (DNS) or 80 — -g sets yours.
Saving output
Always save a scan you might refer back to. -oA writes all three formats at once.
nmap -oN scan.txt 192.168.1.10
Normal output to a file — the human-readable log, same as what prints to screen.
nmap -oG scan.gnmap 192.168.1.10
Grepable output — one host per line, easy to grep and awk for open ports.
nmap -oA fullscan 192.168.1.10
All formats — writes fullscan.nmap, .gnmap and .xml together. The one to use by habit.
Recipes worth memorising
The combinations you will type most.
sudo nmap -sS -sV -sC -O -T4 -p- -oA fullscan 192.168.1.10
The thorough box scan. SYN scan of every port, plus version, default scripts and OS detection, saved to all formats. Your go-to against a single authorised host.
nmap -sn 192.168.1.0/24 -oG - | awk '/Up/{print $2}'
Live-host list. Ping-sweep a subnet and pull just the addresses that answered, ready to feed into a deeper scan.
nmap -p- --min-rate 2000 -T4 192.168.1.10
Fast full-port sweep. Find every open port quickly, then re-scan just those with -sV -sC for depth.
Questions people actually ask
Do I need to be root to use Nmap? No — but the default SYN scan (-sS), UDP scans and OS detection do. Without root, Nmap falls back to the TCP connect scan (-sT), which works fine and just leaves more of a trace.
Is it legal to scan a website? Only with permission. Scanning a host you do not own or have authorisation to test can break computer-misuse laws regardless of intent. Practise on scanme.nmap.org (lightly), a platform's own ranges, or a VM you built yourself.
Why does my scan say all ports are filtered? A firewall is dropping your probes. Try -Pn to skip host discovery, a different scan type, or the evasion flags above — but on your own hosts, first check that a firewall is not simply doing its job.
Which scan should I start with? nmap -sV -sC -T4 target for one host, or nmap -sn to map a network first. Go deeper only where you find something. Not sure what a given open port means? The common ports cheat sheet maps the numbers to services and flags the risky ones.
Learn the tools on a target that wants you there
Every command here is safe to run against your own machine. If you do not have one to point Nmap at yet, Lab 00 builds a Linux VM in about twenty minutes, and Lab 01 walks a first scan against it end to end.
Flags checked against the Nmap 7.9x reference on the date shown at the top of this page. Nothing here is behind an email form or a download. Commands and behaviour do change between Nmap releases — if something no longer matches what you see, tell me and I will re-check and update the date.