Nmap Command Cheat Sheet
Network Mapper (Nmap) is the industry standard tool for network discovery and security auditing. While building commands interactively above is great for learning, below is a quick reference guide to the most common flags utilized by SOC Analysts and Penetration Testers.
Basic Scanning Techniques
-sS | TCP SYN Scan: Default and most popular scan. Known as half-open or stealth scanning. |
-sT | TCP Connect Scan: Used when SYN scan is not an option. Completes the 3-way handshake. |
-sU | UDP Scan: Scans UDP ports (DNS, SNMP, DHCP). Can be very slow. |
-sn | Ping Scan: Disables port scanning. Used only to see which hosts are active on a subnet. |
Discovery & Fingerprinting
-O | OS Detection: Attempts to identify the operating system of the target based on TCP/IP fingerprints. |
-sV | Service Versioning: Interrogates open ports to determine the exact service and application version running. |
-sC | Default Scripts: Runs a collection of safe, default Nmap Scripting Engine (NSE) scripts against the target. |
-A | Aggressive Scan: A shortcut flag that enables OS detection, versioning, script scanning, and traceroute simultaneously. |
Evasion & Timing Options
-T[0-5] | Timing Templates: Higher is faster. -T4 is recommended for modern, reliable local networks. -T0 is used to bypass basic Intrusion Detection Systems (IDS). |
-Pn | No Ping: Forces Nmap to assume the host is online. Essential if the target blocks ICMP (Ping) requests via a firewall. |
-f | Fragment Packets: Splits packets into smaller 8-byte fragments to evade older packet-filtering firewalls. |