Nmap Cheatsheet
Targets and Basics
Use this Nmap reference while you build software engineering projects, review code, or refresh the syntax you reach for most.
Invocation
Nmap's command line is nmap [scan types] [options] {targets}. Targets always
come last. Raw-packet scan types (-sS, -sU, -O, -f, --spoof-mac) need
root, so most real invocations start with sudo.
Scanning hosts you do not own or do not have written permission to test is unlawful in most jurisdictions. Keep scans inside your own lab, a CTF range, or an engagement with a signed scope.
nmap scanme.nmap.org # default: TCP connect or SYN, top 1000 ports sudo nmap -sS 10.0.0.5 # SYN scan, needs root nmap -v -A scanme.nmap.org # verbose, OS + version + scripts + traceroute nmap -V # version and compiled-in features nmap -h # one-page option summary nmap --iflist # interfaces and routes nmap sees
Target Specification
Everything after the options is a target. Multiple forms can be mixed in one command, and hostnames resolve to every address the resolver returns.
| Form | Example | Meaning |
|---|---|---|
| Hostname | scanme.nmap.org | Resolved, one scan per address |
| Single IP | 192.168.1.10 | One host |
| CIDR | 10.0.0.0/24 | 256 addresses, .0 and .255 included |
| Octet range | 10.0.1-3.1-254 | Cartesian product of the ranges |
| Comma list | 10.0.0.1,5,7 | .1, .5, .7 |
| Wildcard | 192.168.0.* | Same as /24 |
| IPv6 | -6 2001:db8::1 | Needs -6, no CIDR-wide sweeps |
nmap 10.0.0.0/24 172.16.5.10 example.com # mixed targets in one run nmap -iL targets.txt # one target per line, # comments ok nmap -iR 100 -Pn -p 80 # 100 random public hosts nmap 10.0.0.0/24 --exclude 10.0.0.1,10.0.0.254 nmap 10.0.0.0/16 --excludefile safe.txt nmap -sL 10.0.0.0/24 # list targets, send nothing
-sL is the dry run. It expands the target spec and does reverse DNS but puts
no packet on the wire, which is the safest way to confirm a range before you
scan it.
Reading the Output
A normal scan prints one table per host. PORT is port/proto, STATE is the
scan verdict, SERVICE is a lookup in nmap-services (a guess from the port
number unless -sV ran).
Nmap scan report for scanme.nmap.org (45.33.32.156) Host is up (0.082s latency). Not shown: 996 closed tcp ports (reset) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http 9929/tcp open nping-echo 31337/tcp open Elite
| Flag | Effect |
|---|---|
-v / -vv | Report hosts and ports as they are found |
-d / -dd | Debug output, packet-level detail |
--open | Only show open (and open|filtered) ports |
--reason | Show why a port got its state (reset, no-response) |
--packet-trace | Print every packet sent and received |
DNS and Name Resolution
Nmap resolves by default and reverse-resolves hosts that are up. DNS is often the slowest part of a large sweep, so turn it off when you do not need names.
nmap -n 10.0.0.0/24 # never resolve, much faster nmap -R 10.0.0.0/24 # resolve every target, even down hosts nmap --dns-servers 1.1.1.1,9.9.9.9 t # bypass the local resolver nmap --system-dns t # use the OS resolver (slower, serial)
Nmap does its own parallel DNS by default. --system-dns is the fallback when
the local stack does something custom, like split-horizon or a VPN resolver.
Privileges and Interfaces
Without root, nmap silently downgrades: -sS becomes -sT, and -sU, -O,
and the spoofing options fail outright. Check whoami before blaming a scan.
sudo nmap -sS -O 10.0.0.5 # raw sockets, works nmap -sS 10.0.0.5 # warns, falls back to -sT sudo nmap -e en0 10.0.0.5 # pin the source interface sudo nmap --send-ip 10.0.0.5 # raw IP instead of ethernet frames
| Option | Use |
|---|---|
-e <iface> | Force the interface, needed on multi-homed or VPN hosts |
--privileged | Assume root, for capability-granted binaries |
--unprivileged | Assume no root, force the connect-scan path |
--send-eth / --send-ip | Choose the link layer, a workaround for odd drivers |
Granting capabilities avoids sudo for everyday scans:
sudo setcap cap_net_raw,cap_net_admin,cap_net_bind_service+eip \
"$(command -v nmap)"Runtime Control
Long scans are interactive. Keystrokes during a run change verbosity without restarting, and an aborted scan can be resumed from its own output file.
| Key | Effect |
|---|---|
v / V | Increase / decrease verbosity |
d / D | Increase / decrease debugging |
p / P | Turn packet tracing on / off |
| any other key | Print a status line with percent complete and ETA |
sudo nmap -sS -p- 10.0.0.0/24 -oN scan.txt # normal output sudo nmap --resume scan.txt # continue where it stopped nmap --noninteractive 10.0.0.5 # for cron and CI, no keyboard
--resume accepts a normal (-oN) or grepable (-oG) file only, not XML.