Port Selection

The -p syntax

-p takes a comma-separated list where each element is a single port, a range, or a protocol-qualified group. No spaces anywhere in the value.

sudo nmap -p- 10.0.0.5                     # all 65535 TCP ports
sudo nmap -p 22,80,443 10.0.0.5
sudo nmap -p 1-1024,3306,5432,8080-8090 10.0.0.5
sudo nmap -p 'http*' 10.0.0.5              # quote it, the shell globs otherwise
sudo nmap --exclude-ports 22,3389 -p- 10.0.0.5

-p- is not the same as the default. The default scans the 1000 most common ports, which is a frequency-ranked list, not ports 1-1000.

Protocol qualifiers

Prefix a group with T:, U:, S:, or P: to say which protocol it belongs to. This is the only way to scan TCP and UDP ports in one command.

# TCP and UDP in one run, needs both scan types enabled
sudo nmap -sS -sU -p T:80,443,8080,U:53,123,161 10.0.0.5

# SCTP alongside TCP
sudo nmap -sS -sY -p T:80,S:2905 10.0.0.5

# IP protocols, with -sO
sudo nmap -sO -p P:1,6,17,47,50 10.0.0.5

A qualifier applies to every port after it until the next qualifier. Without any prefix the list applies to whichever protocols the chosen scan types cover, so -sS -sU -p 53 scans both TCP 53 and UDP 53.

Top ports and the frequency list

Nmap ships nmap-services with an open-frequency score per port, gathered from internet-wide research scans. --top-ports and the default both draw from it.

nmap -F 10.0.0.5                            # top 100, quick triage
sudo nmap --top-ports 20 10.0.0.0/24        # very fast sweep
sudo nmap --top-ports 3000 10.0.0.5
sudo nmap --port-ratio 0.01 10.0.0.5        # roughly the top few hundred

Read the frequency data directly when you want to know what a scan will cover:

# the 20 most common TCP ports, by open frequency
sort -r -k3 /usr/share/nmap/nmap-services | grep '/tcp' | head -20
grep -w '5432/tcp' /usr/share/nmap/nmap-services

On Homebrew the file lives at /opt/homebrew/share/nmap/nmap-services, and on Debian at /usr/share/nmap/nmap-services.

Scan order and randomization

Nmap randomizes port order by default so a scan does not look like a neat ascending sweep to an IDS.

sudo nmap -r -p 1-1000 10.0.0.5              # sequential, easier to read live
sudo nmap --randomize-hosts -p 80 10.0.0.0/16

Use -r when you are watching output in real time or correlating against a packet capture. Leave the default on when scan-pattern visibility matters.

Cost of each choice

Port count drives scan duration almost linearly, and UDP is far worse than TCP because silence has to be retried and ICMP replies are rate limited.

Filtered ports are the real cost multiplier. An open or closed port answers immediately, while a dropped probe must time out and retry, so a heavily firewalled host takes far longer than a bare one.

# staged approach: find the open ports fast, then go deep on only those
sudo nmap -sS -p- --min-rate 1000 -oG quick.gnmap 10.0.0.5
ports=$(awk -F'Ports: ' '/Ports:/{print $2}' quick.gnmap \
  | tr ',' '\n' | awk -F'/' '/open/{print $1}' | paste -sd, -)
sudo nmap -sV -sC -p "$ports" 10.0.0.5

That two-stage pattern is the standard practice: a cheap wide sweep to find the open set, then expensive version and script work aimed only at ports that answered.