NMAP Command Reference

Ping scan (no port scan)

Skip host discovery (assume host is alive)

ARP ping scan (local network)

TCP SYN ping on specific ports

TCP ACK ping on specific ports

Default TCP SYN scan (top 1000 ports)

TCP SYN scan (stealth scan)

TCP Connect scan (full connection)

UDP scan

TCP FIN scan

TCP NULL scan

Single port

Multiple specific ports

Port range

All 65535 ports

Scan top 100 most common ports

Fast scan (top 100 ports)

Service version detection

Aggressive scan (OS, version, scripts)

Operating system detection

Default scripts

Vulnerability detection scripts

Paranoid timing (very slow)

Sneaky timing (slow)

Normal timing (default)

Aggressive timing (fast)

Insane timing (very fast)

Fragment packets

Decoy scan

Spoof source port

Append random data

Randomize target order