Nmap Cheatsheet

Port Scan Types

Use this Nmap reference while you build software engineering projects, review code, or refresh the syntax you reach for most.

Scan Type Table

One scan type per run (they are mutually exclusive, except that -sU can be combined with one TCP type). Everything except -sT and -sn needs root.

Flag	Name	Sends	Open looks like	Use when
`-sS`	SYN / half-open	SYN	SYN/ACK	The default choice, fast and accurate
`-sT`	Connect	Full TCP handshake via the OS	connect succeeds	No root, or scanning through `--proxies`
`-sU`	UDP	Empty datagram or protocol payload	Any UDP reply	DNS, SNMP, NTP, TFTP, VPN discovery
`-sA`	ACK	ACK	nothing, it maps filtering not open	Mapping firewall rules
`-sW`	Window	ACK, reads the RST window field	RST with nonzero window	Rare stacks where ACK gives a hint
`-sM`	Maimon	FIN/ACK	No response on some BSDs	Legacy BSD-derived stacks
`-sN`	Null	No TCP flags set	No response	Bypassing stateless filters
`-sF`	FIN	FIN only	No response	Same, on RFC-compliant stacks
`-sX`	Xmas	FIN, PSH, URG	No response	Same, and stack fingerprinting
`-sY`	SCTP INIT	INIT	INIT/ACK	Telecom, SIGTRAN, some clustering
`-sZ`	SCTP COOKIE-ECHO	COOKIE-ECHO	No response	Stealthier SCTP variant
`-sO`	IP protocol	One packet per IP protocol	Any reply	Finding GRE, ESP, ICMP support
`-sn`	Ping	Discovery probes only	n/a	Host inventory, no ports
`-sV`	Version detection	Service probes to open ports	Banner match	Add-on, not standalone
`-sC`	Default scripts	NSE `default` category	Script output	Add-on, equals `--script=default`
`-sI`	Idle / zombie	Spoofed via a third host's IP ID	Sequence jump	Fully blind source attribution
`-b`	FTP bounce	`PORT` commands to an FTP relay	Transfer accepted	Ancient FTP servers only

sudo nmap -sS -p- 10.0.0.5            # SYN, all 65535 TCP ports
nmap -sT -p 1-1024 10.0.0.5           # connect scan, no root needed
sudo nmap -sU --top-ports 100 10.0.0.5
sudo nmap -sS -sU -p T:80,443,U:53,161 10.0.0.5   # TCP and UDP together
sudo nmap -sA -p- 10.0.0.5            # firewall rule mapping
sudo nmap -sO 10.0.0.5                # which IP protocols the host answers

Port States

The state is nmap's interpretation of a response, not a fact about the service. Six states exist and the ambiguous ones carry the most information.

State	Meaning	Typical cause
`open`	Something is accepting connections	SYN/ACK, or a UDP reply
`closed`	Host reachable, nothing listening	RST, or ICMP port unreachable
`filtered`	Probe never got a verdict	Drop rule, ICMP admin-prohibited
`unfiltered`	Reachable but open or closed is unknown	ACK scan got a RST
`open\|filtered`	No reply, and no reply means either	UDP, Null, FIN, Xmas, Maimon
`closed\|filtered`	Cannot tell closed from filtered	Idle scan only

sudo nmap -sS --reason -p 22,80,445 10.0.0.5   # print the evidence per port

PORT    STATE    SERVICE REASON
22/tcp  open     ssh     syn-ack ttl 64
80/tcp  closed   http    reset ttl 64
445/tcp filtered microsoft-ds no-response

closed and filtered are very different findings. A closed port proves the host is reachable and the packet was not dropped, which makes it useful evidence about the firewall even though nothing is listening there.

SYN vs Connect

-sS writes the SYN itself and never completes the handshake, so the target's application layer usually logs nothing. -sT asks the kernel to connect(), which is slower, leaves a full connection in every application log, and consumes a file descriptor per probe.

	`-sS`	`-sT`
Root required	Yes	No
Packets per port	2 (SYN, RST)	3-4 (full handshake plus teardown)
Application logs	Usually clean	Connection recorded
Works over SOCKS/HTTP proxy	No	Yes, with `--proxies`
Speed on a /24	Fast	Noticeably slower

Both are equally visible to a stateful firewall or an IDS. "Stealth scan" for -sS means stealthy against the application, not against the network.

UDP Scanning

UDP is slow because silence is ambiguous and ICMP port-unreachable replies are rate limited by the target kernel (Linux allows roughly one per second). A full 65535-port UDP scan can take hours.

sudo nmap -sU --top-ports 50 10.0.0.5              # sane starting point
sudo nmap -sU -sV --version-intensity 0 -p 53,161,500 10.0.0.5
sudo nmap -sU -p- --max-retries 1 --host-timeout 30m 10.0.0.5

Problem	Mitigation
Everything is `open\|filtered`	Add `-sV`, a protocol probe forces a real reply
Scan takes hours	Use `--top-ports`, `--max-retries 1`, `--host-timeout`
ICMP rate limiting	Unavoidable, lower `--min-rate` expectations

Null, FIN, and Xmas

These send TCP packets that no legitimate stack would send. RFC 793 says a closed port must answer with RST and an open port must stay silent, so silence implies open. Windows, Cisco IOS, and many appliances answer RST on every port instead, which makes the whole scan read as closed.

sudo nmap -sN -p 1-1024 10.0.0.5
sudo nmap -sF -p 1-1024 10.0.0.5
sudo nmap -sX -p 1-1024 10.0.0.5
sudo nmap --scanflags SYNFIN -p 80 10.0.0.5   # build your own flag combination

--scanflags takes any combination of URG ACK PSH RST SYN FIN ECE CWR or a numeric value, and pairs with -sA or -sT to choose the response logic.

Idle Scan

-sI bounces the scan off a third host with a predictable global IP ID counter. Probes appear to come from the zombie, so the target logs the zombie's address and never yours. Modern Linux and Windows randomize the IP ID per destination, which makes usable zombies rare (old printers and embedded devices are the classic candidates).

sudo nmap -O 10.0.0.99                             # look for "IP ID Sequence: Incremental"
sudo nmap -sI 10.0.0.99:80 -p 1-1024 10.0.0.5      # zombie:probeport
sudo nmap -sI 10.0.0.99 -Pn -p- 10.0.0.5

It is slow, needs a quiet zombie, and returns closed|filtered where a normal scan would be definite. Treat it as a niche tool, not a default.