Nmap Cheat Sheet: All Commands & Switches (2026) | Edwhere

Every network reconnaissance starts with the same question: what is actually out there? Before you can test anything, assess anything, or secure anything, you need a map. That is exactly what Nmap does and it does it better than any other tool available.

Nmap (Network Mapper) is a free, open-source tool used by security professionals and network administrators worldwide to discover devices on a network and identify the services they are running. It works by sending specially crafted packets to a target and analyzing the responses to map out the network’s structure.

This cheat sheet covers everything you need from your first scan to advanced NSE scripting with real commands you can run immediately.

What Nmap Can Do

Nmap has five core capabilities that make it the go-to tool for network reconnaissance:

• Host Discovery — identifies which devices (computers, servers, IoT devices) are currently up and connected to a network

• Port Scanning — checks which ports on those devices are open, closed, or filtered by a firewall

• Service & Version Detection — determines what software is running on an open port (e.g., Apache 2.4.41) and its version number

• OS Detection — guesses the operating system and hardware characteristics of the remote device

• Scriptable Interaction (NSE) — uses the Nmap Scripting Engine to automate tasks like vulnerability detection or advanced service discovery

Basic Scans

Start here. These four commands cover the most common scanning scenarios.

nmap -sn <target>      (Ping Scan — no port scan, host discovery only)

nmap -T4 -F <target>   (Quick Scan — fast scan of top 100 ports)

nmap <target>          (Default TCP Scan — scans top 1000 ports)

nmap -p- <target>      (All Ports Scan — scans all 65535 ports)

Target Specification

Define exactly which IPs, ranges, or subnets Nmap should scan during your network reconnaissance.

DESCRIPTION	EXAMPLE	SWITCH
Scan a single IP	`nmap 192.168.1.1`
Scan specific IPs	`nmap 192.168.1.1 192.168.2.1`
Scan a range	`nmap 192.168.1.1-254`
Scan a domain	`nmap scanme.nmap.org`
Scan using CIDR notation	`nmap 192.168.1.0/24`
Scan targets from a file	`nmap -iL targets.txt`	`-iL`
Scan 100 random hosts	`nmap -iR 100`	`-iR`
Exclude listed hosts	`nmap -exclude 192.168.1.1`	`-exclude`

Nmap Scan Techniques

Choose the type of scan to run, from stealthy SYN scans to full TCP and UDP scans.

DESCRIPTION	EXAMPLE	SWITCH
TCP SYN port scan (Default)	`nmap 192.168.1.1 -sS`	`-sS`
TCP connect port scan (no root)	`nmap 192.168.1.1 -sT`	`-sT`
UDP port scan	`nmap 192.168.1.1 -sU`	`-sU`
TCP ACK port scan	`nmap 192.168.1.1 -sA`	`-sA`
TCP Window port scan	`nmap 192.168.1.1 -sW`	`-sW`
TCP Maimon port scan	`nmap 192.168.1.1 -sM`	`-sM`

SYN Scan (-sS) is the half-open scan. It sends a SYN packet but never completes the handshake, making it faster and quieter the default for root users.

UDP Scan (-sU) targets UDP services like DNS, SNMP, and DHCP. It is slower because UDP does not provide the same feedback as TCP.

TCP Connect (-sT) completes the full three-way handshake. Easy to detect but works even without root privileges.

Host Discovery

Identify which hosts are online before running a full scan or when skipping port scans entirely.

DESCRIPTION	EXAMPLE	SWITCH
No Scan. List targets only	`nmap 192.168.1.1-3 -sL`	`-sL`
Disable port scanning. Host discovery only.	`nmap 192.168.1.1/24 -sn`	`-sn`
Disable host discovery. Port scan only.	`nmap 192.168.1.1-5 -Pn`	`-Pn`
TCP SYN discovery on port x	`nmap 192.168.1.1-5 -PS22-25,80`	`-PS`
TCP ACK discovery on port x	`nmap 192.168.1.1-5 -PA22-25,80`	`-PA`
UDP discovery on port x	`nmap 192.168.1.1-5 -PU53`	`-PU`
ARP discovery on local network	`nmap 192.168.1.1-1/24 -PR`	`-PR`
Never do DNS resolution	`nmap 192.168.1.1 -n`	`-n`

Port Specification

Target specific ports, ranges, or combinations of TCP and UDP ports for more precise scans.

DESCRIPTION	EXAMPLE	SWITCH
Port scan for port x	`nmap 192.168.1.1 -p 21`	`-p`
Port range	`nmap 192.168.1.1 -p 21-100`	`-p`
Port scan multiple TCP and UDP ports	`nmap 192.168.1.1 -p U:53,T:21-25,80`	`-p`
Port scan all ports	`nmap 192.168.1.1 -p-`	`-p`
Port scan from service name	`nmap 192.168.1.1 -p http,https`	`-p`
Fast port scan (100 ports)	`nmap 192.168.1.1 -F`	`-F`
Port scan the top x ports	`nmap 192.168.1.1 -top-ports 2000`	`-top-ports`
Start scan at port 1	`nmap 192.168.1.1 -p-65535`	`-p-65535`
Scan through to port 65535	`nmap 192.168.1.1 -p0-`	`-p0-`

Service and Version Detection

Detect which services are running and attempt to identify their software versions and configurations.

DESCRIPTION	EXAMPLE	SWITCH
Attempts to determine the service version	`nmap 192.168.1.1 -sV`	`-sV`
Intensity level 0-9 (higher = more accurate)	`nmap 192.168.1.1 -sV -version-intensity 8`	`-sV -version-intensity`
Enable light mode. Faster, less accurate	`nmap 192.168.1.1 -sV -version-light`	`-sV -version-light`
Intensity level 9. Slower, most accurate	`nmap 192.168.1.1 -sV -version-all`	`-sV -version-all`
OS detection, version, scripts, traceroute	`nmap 192.168.1.1 -A`	`-A`

OS Detection

Use TCP/IP fingerprinting to guess the operating system of target hosts.

DESCRIPTION	EXAMPLE	SWITCH
Remote OS detection using TCP/IP fingerprinting	`nmap 192.168.1.1 -O`	`-O`
Skip OS detection if no open+closed TCP port found	`nmap 192.168.1.1 -O -osscan-limit`	`-O -osscan-limit`
Makes Nmap guess more aggressively	`nmap 192.168.1.1 -O -osscan-guess`	`-O -osscan-guess`
Set maximum OS detection tries against target	`nmap 192.168.1.1 -O -max-os-tries 1`	`-O -max-os-tries`
OS detection, version, scripts, traceroute	`nmap 192.168.1.1 -A`	`-A`

NSE Scripts

Enhance your scans with Nmap’s scripting engine for automation and deeper inspection.

DESCRIPTION	EXAMPLE	SWITCH
Scan with default NSE scripts	`nmap 192.168.1.1 -sC`	`-sC`
Scan with default NSE scripts (explicit)	`nmap 192.168.1.1 -script default`	`-script default`
Scan with a single script (e.g. banner)	`nmap 192.168.1.1 -script=banner`	`-script`
Scan with a wildcard (e.g. http)	`nmap 192.168.1.1 -script=http*`	`-script`
Scan with two scripts (e.g. http, banner)	`nmap 192.168.1.1 -script=http,banner`	`-script`
Scan default, remove intrusive scripts	`nmap 192.168.1.1 -script "not intrusive"`	`-script`
NSE script with arguments	`nmap -script snmp-sysdescr -script-args snmpcommunity=admin 192.168.1.1`	`-script-args`

Vulnerability Scan: nmap --script vuln <target>

Specific Script: nmap --script http-enum <target>

Output

Save your scan results in formats like normal text, XML, or grepable output for later analysis.

DESCRIPTION	EXAMPLE	SWITCH
Normal output to file	`nmap 192.168.1.1 -oN normal.file`	`-oN`
XML output to file	`nmap 192.168.1.1 -oX xml.file`	`-oX`
Grepable output to file	`nmap 192.168.1.1 -oG grep.file`	`-oG`
Output in three major formats at once	`nmap 192.168.1.1 -oA results`	`-oA`
Grepable output to screen	`nmap 192.168.1.1 -oG -`	`-oG -`
Append scan to a previous scan file	`nmap 192.168.1.1 -oN file.file -append-output`	`-append-output`
Increase verbosity level	`nmap 192.168.1.1 -v`	`-v`
Increase debugging level	`nmap 192.168.1.1 -d`	`-d`
Display reason a port is in a state	`nmap 192.168.1.1 -reason`	`-reason`
Only show open ports	`nmap 192.168.1.1 -open`	`-open`
Show all packets sent and received	`nmap 192.168.1.1 -T4 -packet-trace`	`-packet-trace`
Shows host interfaces and routes	`nmap -iflist`	`-iflist`
Resume a scan	`nmap -resume results.file`	`-resume`

Nmap Cheat Sheet 2026: Every Command You Need for Network Scanning