The one downside to a tool as robust and powerful as Nmap is remembering so many commands. Even many seasoned industry professionals fail to make the most of Nmap simply because keeping track of all its flags can prove such a challenge.
We have compiled and organized this Nmap cheat sheet to help you master what is arguably the most useful tool in any penetration tester’s arsenal. Whether you use it to memorize Nmap’s options, as a quick reference to keep nearby, or as a study sheet for your CEH/Pentest+ exam, we’re certain it will help you become a Nmap pro.
Download your own copy of this cheat sheet here. Now, let’s get to the Nmap commands.
TCP connect port scan (Default without root privilege)
-sU
nmap 192.168.1.1 -sU
UDP port scan
-sA
nmap 192.168.1.1 -sA
TCP ACK port scan
-sW
nmap 192.168.1.1 -sW
TCP Window port scan
-sM
nmap 192.168.1.1 -sM
TCP Maimon port scan
Host Discovery
SWITCH
EXAMPLE
DESCRIPTION
-sL
nmap 192.168.1.1-3 -sL
No Scan. List targets only
-sn
nmap 192.168.1.1/24 -sn
Disable port scanning. Host discovery only.
-Pn
nmap 192.168.1.1-5 -Pn
Disable host discovery. Port scan only.
-PS
nmap 192.168.1.1-5 -PS22-25,80
TCP SYN discovery on port x. Port 80 by default
-PA
nmap 192.168.1.1-5 -PA22-25,80
TCP ACK discovery on port x. Port 80 by default
-PU
nmap 192.168.1.1-5 -PU53
UDP discovery on port x. Port 40125 by default
-PR
nmap 192.168.1.1-1/24 -PR
ARP discovery on local network
-n
nmap 192.168.1.1 -n
Never do DNS resolution
Nmap Command Generator
Say goodbye to the hassle of trying to remember the exact syntax for your Nmap commands! With our Nmap Command Generator, you can simply say what you need Nmap to do and we will generate the command for you.
Port Specification
SWITCH
EXAMPLE
DESCRIPTION
-p
nmap 192.168.1.1 -p 21
Port scan for port x
-p
nmap 192.168.1.1 -p 21-100
Port range
-p
nmap 192.168.1.1 -p U:53,T:21-25,80
Port scan multiple TCP and UDP ports
-p
nmap 192.168.1.1 -p-
Port scan all ports
-p
nmap 192.168.1.1 -p http,https
Port scan from service name
-F
nmap 192.168.1.1 -F
Fast port scan (100 ports)
–top-ports
nmap 192.168.1.1 –top-ports 2000
Port scan the top x ports
-p-65535
nmap 192.168.1.1 -p-65535
Leaving off initial port in range makes the scan start at port 1
-p0-
nmap 192.168.1.1 -p0-
Leaving off end port in range makes the scan go through to port 65535
Service and Version Detection
SWITCH
EXAMPLE
DESCRIPTION
-sV
nmap 192.168.1.1 -sV
Attempts to determine the version of the service running on port
-sV –version-intensity
nmap 192.168.1.1 -sV –version-intensity 8
Intensity level 0 to 9. Higher number increases possibility of correctness
-sV –version-light
nmap 192.168.1.1 -sV –version-light
Enable light mode. Lower possibility of correctness. Faster
-sV –version-all
nmap 192.168.1.1 -sV –version-all
Enable intensity level 9. Higher possibility of correctness. Slower
-A
nmap 192.168.1.1 -A
Enables OS detection, version detection, script scanning, and traceroute
OS Detection
SWITCH
EXAMPLE
DESCRIPTION
-O
nmap 192.168.1.1 -O
Remote OS detection using TCP/IP stack fingerprinting
-O –osscan-limit
nmap 192.168.1.1 -O –osscan-limit
If at least one open and one closed TCP port are not found it will not try OS detection against host
-O –osscan-guess
nmap 192.168.1.1 -O –osscan-guess
Makes Nmap guess more aggressively
-O –max-os-tries
nmap 192.168.1.1 -O –max-os-tries 1
Set the maximum number x of OS detection tries against a target
-A
nmap 192.168.1.1 -A
Enables OS detection, version detection, script scanning, and traceroute
Timing and Performance
SWITCH
EXAMPLE
DESCRIPTION
-T0
nmap 192.168.1.1 -T0
Paranoid (0) Intrusion Detection System evasion
-T1
nmap 192.168.1.1 -T1
Sneaky (1) Intrusion Detection System evasion
-T2
nmap 192.168.1.1 -T2
Polite (2) slows down the scan to use less bandwidth and use less target machine resources
-T3
nmap 192.168.1.1 -T3
Normal (3) which is default speed
-T4
nmap 192.168.1.1 -T4
Aggressive (4) speeds scans; assumes you are on a reasonably fast and reliable network
-T5
nmap 192.168.1.1 -T5
Insane (5) speeds scan; assumes you are on an extraordinarily fast network
grep ” open ” results.nmap | sed -r ‘s/ +/ /g’ | sort | uniq -c | sort -rn | less
Reverse sorted list of how often ports turn up
Miscellaneous Nmap Flags
SWITCH
EXAMPLE
DESCRIPTION
-6
nmap -6 2607:f0d0:1002:51::4
Enable IPv6 scanning
-h
nmap -h
nmap help screen
Other Useful Nmap Commands
COMMAND
DESCRIPTION
nmap -iR 10 -PS22-25,80,113,1050,35000 -v -sn
Discovery only on ports x, no port scan
nmap 192.168.1.1-1/24 -PR -sn -vv
Arp discovery only on local network, no port scan
nmap -iR 10 -sn -traceroute
Traceroute to random targets, no port scan
nmap 192.168.1.1-50 -sL -dns-server 192.168.1.1
Query the Internal DNS for hosts, list targets only
nmap 192.168.1.1 –packet-trace
Show the details of the packets that are sent and received during a scan and capture the traffic.
You are only doing yourself a disservice by failing to learn and utilize all of Nmap’s features. It is the first go-to tool you will use in the scanning and enumeration stage of many assessments, setting the foundation for the rest of your pentest.
Keep a copy of this Nmap cheat sheet to refer back to, and consider our Complete Nmap Ethical Hacking Course. It, and many other ethical hacking courses, are available in our VIP Member’s Section.
Frequently Asked Questions
What is Nmap, and why is it used?
Nmap is a free network scanning tool used to discover hosts and services on a network by analyzing responses to various packets and requests.
What is the Nmap command used for?
Penetration testers and network administrators will use Nmap to discover machines on a network and their open ports, running services, operating systems, and a wealth of other useful information.
Is Nmap scanning legal?
This depends on your jurisdiction. In many places, the answer is no, not without prior permission from the owner of the site or network.
Nmap is a tool used for scanning and enumeration. Hackers and penetration testers use the information gathered to see what the available attack surface is.
However, there are a great number of NSE scripts that can perform such actions as password brute forcing, checking for backup and configuration files, searching for remote file inclusion (RFI) vulnerabilities, and testing default credentials.
How do I scan an IP with Nmap?
A basic scan of a single IP address is as easy as: nmap <ip>
This will return if the host is up and responding to ping, what ports are open, and what services are running on them. More complex commands can be found in the cheat sheet above.
Is it OK to Nmap Google?
The long answer is, it depends on your jurisdiction. The short answer is, probably not and you shouldn’t do it. Even if it isn’t illegal where you live, it will most certainly violate Google’s terms of service.
Do firewalls block Nmap?
Firewalls can block access to ports, which would indeed block Nmap. Nmap does have flags to attempt to evade firewalls and intrusion detection systems, which we have listed in the cheat sheet above.
Is Nmap a vulnerability?
After you have installed Nmap on your host system, an over-ambitious antivirus program may flag it as malicious. So long as you have downloaded it from the official Nmap website, it is safe to have installed.
Can Nmap bypass a firewall?
Nmap has several optional services which can attempt to bypass firewalls and spoof its scans. See the Firewall / IDS Evasion and Spoofing section above for details.
Can Nmap hack WiFi?
Nmap has many NSE scripts designed to brute force different services and logins. Depending on the login portal, there may be a relevant script to do so.
More realistically, Nmap would be used to enumerate the network, and one of many free programs better suited to WiFi hacking would be used afterward.
Can Nmap crack passwords?
Nmap has many brute force scripts which will automate password login attempts on various services, such as MySQL, Telenet, and POP3. This may provide a quick win, but password attacks are better handled by tools dedicated to that purpose, such as THC Hydra.
How do I read Nmap results?
Fortunately, even the more complex Nmap scans display their results in a clear and easy-to-follow manner. You also have the ability to output the data in various forms, including as an XML or grepable file (see the Output section for details).
You can also see our Zenmap vs. Nmap article to learn about the graphical version of the tool.
Nathan House is the founder and CEO of StationX. He has over 25 years of experience in cyber security, where he has advised some of the largest companies in the world. Nathan is the author of the popular "The Complete Cyber Security Course", which has been taken by over half a million students in 195 countries. He is the winner of the AI "Cyber Security Educator of the Year 2020" award and finalist for Influencer of the year 2022.
Thank you very much in deed, very useful, I will buy your course on nmap, I want to insist about a Firewall course there aren’t around, I guess it is a good investment for you, I bought already all your courses and they are the best! Please keep going!
Thank you for this cheatsheet.
I think there is a mistake concerning the -sS switch. It is not the default one.
Normally, -sT is the default one and -sS needs root privileges.
Sir this is very helpfull and very important for firewall point of view,
But what about port knock if a system or server is using port knock to active its any port for a client. Any method by nmap that can bypass port knock.
The basic port knocking method uses a fixed sequence of ports. This method is not protected cryptographically so there are the following attacks possible:
brute-force — If you use the full range of possible ports 1—65535 then even very short knocking sequences give impressive number of combinations to test. For example for 3 knocks with randomly generated sequence it is 65535³ ≈ 2.8×10¹⁴. Another aspect to consider is that the port which will open after the knocking could be unknown so the attacker would have to repeatedly scan the ports during the port knocking attempts. — The number of combinations to try can be lowered if some information about the ports being used is known (for example a subset of ports) or if there is a successful random number generator attack.
Measure against such attacks except securing the mentioned possible vulnerabilities could be disabling of the access from the attacker source IP address after certain number of unsuccessful attempts during certain time period. Unfortunately this makes the system vulnerable to DoS attacks by attacker locking your access by using your IP address as a spoofed source address.
sniffing — The port knocking sequence is not protected cryptographically so an attacker can sniff the successful port knocking sequence. The port knocking sequence could also leak from logs of the destination system itself of from a network monitoring system.
Measure against this attack is use of one-time knocking sequences (analogy of one-time passwords). The one-time sequence could be a hash computed from a secret and some of the following: source IP address, time, event counter etc.
man in the middle — Captured one-time knocking sequences cannot be reused but a port-knocking access can be exploited by a man-in-the-middle attack. The attacker in the path of your communication (possibly redirected) can relay your successful communication, see and modify anything.
The port-knocking itself is performed by one-way communication as such it cannot be protected against MITM. Also the communication following the port knocking must be secured against MITM to retain the security. To ensure this we can use standard encrypted protocols like SSL or SSH.
Thanks Man , That’s Help me a lot .
i wanna ask , what is the main different between -sn AND -Pn ;
what is the network discovery do exactly and port scan !!
-sL does no scan and just lists targets only to be scanned.
The list scan is a degenerate form of host discovery that simply lists each host of the network(s) specified, without sending any packets to the target hosts. By default, Nmap still does reverse-DNS resolution on the hosts to learn their names. It is often surprising how much useful information simple hostnames give out. For example, fw.chi is the name of one company’s Chicago firewall. Nmap also reports the total number of IP addresses at the end. The list scan is a good sanity check to ensure that you have proper IP addresses for your targets. If the hosts sport domain names you do not recognize, it is worth investigating further to prevent scanning the wrong company’s network. Since the idea is to simply print a list of target hosts, options for higher level functionality such as port scanning, OS detection, or ping scanning cannot be combined with this. If you wish to disable ping scanning while still performing such higher level functionality, read up on the -Pn (skip ping) option.
-PO (IP Protocol Ping)
One of the newer host discovery options is the IP protocol ping, which sends IP packets with the specified protocol number set in their IP header. The protocol list takes the same format as do port lists in the previously discussed TCP, UDP and SCTP host discovery options. If no protocols are specified, the default is to send multiple IP packets for ICMP (protocol 1), IGMP (protocol 2), and IP-in-IP (protocol 4). The default protocols can be configured at compile-time by changingDEFAULT_PROTO_PROBE_PORT_SPEC in nmap.h. Note that for the ICMP, IGMP, TCP (protocol 6), UDP (protocol 17) and SCTP (protocol 132), the packets are sent with the proper protocol headers while other protocols are sent with no additional data beyond the IP header (unless any of –data, –data-string, or –data-length options are specified). This host discovery method looks for either responses using the same protocol as a probe, or ICMP protocol unreachable messages which signify that the given protocol isn’t supported on the destination host. Either type of response signifies that the target host is alive.
This is so awesome! I’m taking your course now and my only regret is I didn’t do this sooner! This could’ve saved me soooo much headache and time! But it’s ok! Best way to learn is through error lol. Now that I know all the things NOT to do, you are showing the way. Thank you Mr. House.
nmap doesn’t change quickly in terms of how you use the tool. The last major release Nmap 7.00 was November 9, 2015. We are still on 7 now. The course was created well after this.
Thank you very much Sir, for this NMAP Cheat sheet, I am from India, and enrolled in your the Complete Cyber Security Volume 1,2,3,4, loved your content and way of explaining #StaySafeOnline
Scan from outside your network and look for the MySQL ports. Port 3306 is the default port for the classic MySQL protocol ( port ), which is used by the mysql client, MySQL Connectors, and utilities such as mysqldump and mysqlpump.
I appreciate the cheat sheet with really good explanations of each Nmap parameter. So I’ve included this article as a reference in my CSS Pen testing report, Thanks again!
Yes! It’s true.. YOU are THE NMAP KING!
I’ve learned things here that my mother wouldn’t even teach me. Thanks so much.
Cheers!
USA (Now a Trump free zone! 🙂
I think the nmap full course and scanning techniques there are the best available. Never mind the midland accent its great but the explanations are best best.
THANK YOU!!! I used to use Legion but for some reason the frontend is proving unreliable, so I need to put on my big boy pants and use Nmap the proper way.
Thank you! It’s content like this that helps make the membership cost worth it. Don’t get me wrong, the sheer content on the website makes it worth the cost but this stuff is just icing on the cake!
Thanks a lot for the information. it is very useful.
That will be a helpful tipsheet. Thank you so much. I can learn more about it. looking forward to the hacking course from you.
Looking forward to it. I use nmap most days but only use a limited number of switches.
Keep the good hands-on stuff coming
Thank you very much in deed, very useful, I will buy your course on nmap, I want to insist about a Firewall course there aren’t around, I guess it is a good investment for you, I bought already all your courses and they are the best! Please keep going!
Great news.
In expectation of this course.
As usual ,
Thanks for what you doing.
I think this is very Useful,Thank you soo much.Am enjoying the training and practice.
Love it. Thank you Nathan!
your welcome
Muchas gracias ,,, me fue de utilidad,,,
How to test .net Web services using ZenMap
You will need to expand on this question as I’m not clear what you are asking?
Thank you for sharing this information!
Thank you for this cheatsheet.
I think there is a mistake concerning the -sS switch. It is not the default one.
Normally, -sT is the default one and -sS needs root privileges.
Default with root. I assume you are running as root!
Hi
This is very helpful. Thanks a lot!
Sir this is very helpfull and very important for firewall point of view,
But what about port knock if a system or server is using port knock to active its any port for a client. Any method by nmap that can bypass port knock.
Thank you
The basic port knocking method uses a fixed sequence of ports. This method is not protected cryptographically so there are the following attacks possible:
brute-force — If you use the full range of possible ports 1—65535 then even very short knocking sequences give impressive number of combinations to test. For example for 3 knocks with randomly generated sequence it is 65535³ ≈ 2.8×10¹⁴. Another aspect to consider is that the port which will open after the knocking could be unknown so the attacker would have to repeatedly scan the ports during the port knocking attempts. — The number of combinations to try can be lowered if some information about the ports being used is known (for example a subset of ports) or if there is a successful random number generator attack.
Measure against such attacks except securing the mentioned possible vulnerabilities could be disabling of the access from the attacker source IP address after certain number of unsuccessful attempts during certain time period. Unfortunately this makes the system vulnerable to DoS attacks by attacker locking your access by using your IP address as a spoofed source address.
sniffing — The port knocking sequence is not protected cryptographically so an attacker can sniff the successful port knocking sequence. The port knocking sequence could also leak from logs of the destination system itself of from a network monitoring system.
Measure against this attack is use of one-time knocking sequences (analogy of one-time passwords). The one-time sequence could be a hash computed from a secret and some of the following: source IP address, time, event counter etc.
man in the middle — Captured one-time knocking sequences cannot be reused but a port-knocking access can be exploited by a man-in-the-middle attack. The attacker in the path of your communication (possibly redirected) can relay your successful communication, see and modify anything.
The port-knocking itself is performed by one-way communication as such it cannot be protected against MITM. Also the communication following the port knocking must be secured against MITM to retain the security. To ensure this we can use standard encrypted protocols like SSL or SSH.
Great stuff!
Can you please help me understand the main difference between
nmap 192.168.1.1 -O and nmap 192.168.1.1 -A
nmap 192.168.1.1 -O = Remote OS detection using TCP/IP stack fingerprinting
nmap 192.168.1.1 -A = Enables OS detection PLUS – version detection, script scanning, and traceroute
So -O is only OS detection, -A is OS detection PLUS – version detection, script scanning, and traceroute
Thanks Man , That’s Help me a lot .
i wanna ask , what is the main different between -sn AND -Pn ;
what is the network discovery do exactly and port scan !!
-sn just finds hosts that are up. No port scan. -Pn is the opposite. No host discovery. Port scan if it appears up or not.
Pn is for no ping
command which dosen’t TCP handshake
hi sir ,
i just wanna know , is there any benefit for this -sL option ? and when do i use -P0 ?
-sL does no scan and just lists targets only to be scanned.
The list scan is a degenerate form of host discovery that simply lists each host of the network(s) specified, without sending any packets to the target hosts. By default, Nmap still does reverse-DNS resolution on the hosts to learn their names. It is often surprising how much useful information simple hostnames give out. For example, fw.chi is the name of one company’s Chicago firewall. Nmap also reports the total number of IP addresses at the end. The list scan is a good sanity check to ensure that you have proper IP addresses for your targets. If the hosts sport domain names you do not recognize, it is worth investigating further to prevent scanning the wrong company’s network. Since the idea is to simply print a list of target hosts, options for higher level functionality such as port scanning, OS detection, or ping scanning cannot be combined with this. If you wish to disable ping scanning while still performing such higher level functionality, read up on the -Pn (skip ping) option.
-PO (IP Protocol Ping)
One of the newer host discovery options is the IP protocol ping, which sends IP packets with the specified protocol number set in their IP header. The protocol list takes the same format as do port lists in the previously discussed TCP, UDP and SCTP host discovery options. If no protocols are specified, the default is to send multiple IP packets for ICMP (protocol 1), IGMP (protocol 2), and IP-in-IP (protocol 4). The default protocols can be configured at compile-time by changingDEFAULT_PROTO_PROBE_PORT_SPEC in nmap.h. Note that for the ICMP, IGMP, TCP (protocol 6), UDP (protocol 17) and SCTP (protocol 132), the packets are sent with the proper protocol headers while other protocols are sent with no additional data beyond the IP header (unless any of –data, –data-string, or –data-length options are specified). This host discovery method looks for either responses using the same protocol as a probe, or ICMP protocol unreachable messages which signify that the given protocol isn’t supported on the destination host. Either type of response signifies that the target host is alive.
Yea i read this , but i dont get it , in short words give me what is -P0 used for ??
Do you know what IP protocols are? like 1 ICMP Internet Control Message Protocol RFC 792, 2 IGMP Internet Group Management Protocol RFC 1112.
It sends IP packets with the specified protocol number set in the IP header. It’s an alternative discovery method.
I AM YOUR BIG FAN SIR..LOVE U
What would you recommend I study to understand IP Protocols, Packets etc.
Great! I was just wondering “gosh, if there could be a pdf version and – woah, there is”
Gald to help!
sirr i need your help
i thing u help mee
How can I help?
Very good article
Thank you Nathan.
Very great article I tried to build, an online command simulator
This is so awesome! I’m taking your course now and my only regret is I didn’t do this sooner! This could’ve saved me soooo much headache and time! But it’s ok! Best way to learn is through error lol. Now that I know all the things NOT to do, you are showing the way. Thank you Mr. House.
Glad you are enjoying the course! 🙂
Great article and quite good presentation
I built and online version of nmap here so such commands
like described here i like them.
man u may live long , may God bless u ok
Appreciate it Arthur.
When was the last time you updated your course Nathan?
nmap doesn’t change quickly in terms of how you use the tool. The last major release Nmap 7.00 was November 9, 2015. We are still on 7 now. The course was created well after this.
Sir, plez show bobs en vagene.. thank kindly sir I owe you, you r best god bless sir
I assume you mean “Bobs and Vegana”. Any reason I should do that?
Wow – this is awesome. I was in the throes of creating my own, and well, yours looks much better than mine. Much appreciated!
Thank you Tim
thank you sir nathan!
Thank you very much Sir, for this NMAP Cheat sheet, I am from India, and enrolled in your the Complete Cyber Security Volume 1,2,3,4, loved your content and way of explaining #StaySafeOnline
My pleasure. Great to have you on the course.
What does nmap do other than scan for vunerailitites?
It’s not really a vulnerability scanner, although it can do that with a script. It is for discovering hosts and open ports.
thank you for the detailed nmap cheat sheet.
N.e.e.d.s
Awesome stuff, I am getting ready to graduate from MHCC with a Cybersecurity/Networking degree, realizing I still have a lot to learn.
Hi! I am trying to find on my network IP addresses that have MySQL open using Nmap. Is any help available? Thanks in advance
Scan from outside your network and look for the MySQL ports. Port 3306 is the default port for the classic MySQL protocol ( port ), which is used by the mysql client, MySQL Connectors, and utilities such as mysqldump and mysqlpump.
Hi Nathan, maybe add movie name Sneakers and replace David with Marty. Like Marty’s friend said “too many secrets”. Cheers
Six
So it means we don’t need to get the course of Nmap on Udemy from you, all of it is here ?
The the cyber security training touy need including nmap training is in VIP membership
https://www.stationx.net/vip-membership
BEST sir….
Love from INDIA
Thank you.
Hey Nathan,
I appreciate the cheat sheet with really good explanations of each Nmap parameter. So I’ve included this article as a reference in my CSS Pen testing report, Thanks again!
nice
nice blog bro
Thank you so much!!!
Yes! It’s true.. YOU are THE NMAP KING!
I’ve learned things here that my mother wouldn’t even teach me. Thanks so much.
Cheers!
USA (Now a Trump free zone! 🙂
I think the nmap full course and scanning techniques there are the best available. Never mind the midland accent its great but the explanations are best best.
Systematics and cogent.
My accent is from the North of England and only really mild for the region. and thank you.
Thank you for this course! And the brilliant accent!
All the best, Steven
My pleasure.
nmap test answers please
Very Usefull.
Thank you.
This is awesome! Thanks
Thank you sir.
My God, this is so cool & Important
My pleasure.
CAN NMAP HACK BETING SITES
Grate job. Thanks a lot
Ola! Apesar que sou bem cru no assunto, Coisas impotante pego para aprender um pouco.
Valeu abraço.
this man is genius in nmap and cyber security like mike meyers
i have to see his courses .
Where can I watch movies in my iPad 2? Good free websites?
Nmap Cheat Sheet
Thanks for this..!!
Thanks Nathan. What a great resource!
Great courses Thanks again Nathan
AM
Nice I want to learn
Higher
THANK YOU!!! I used to use Legion but for some reason the frontend is proving unreliable, so I need to put on my big boy pants and use Nmap the proper way.
Thanks
Thank you! It’s content like this that helps make the membership cost worth it. Don’t get me wrong, the sheer content on the website makes it worth the cost but this stuff is just icing on the cake!