Nmap Command Builder

Toggle scan type, ports, detection, timing, and output — the nmap command assembles live, every flag explained, with privilege notes and a copy button.

Pick what to scan and how — the nmap command assembles live below, with a plain-language summary and privilege notes. Nothing runs here; copy the command and run it only against hosts you are authorized to test.

examples

nmap

Raw-packet scans (-sS, -sU, the FIN/Xmas/Null scans), -O, and -A need root; without it nmap silently falls back to a slower -sT connect scan. Port scanning without permission is unlawful in many places — only scan systems you own or are explicitly authorized to test.

nmap 101

What nmap does

Nmap ("Network Mapper") discovers hosts and the services they expose. A run has up to three phases: host discovery (which targets are alive), port scanning (which ports are open, closed, or filtered), and optional detection (service versions, OS, and NSE scripts). The flags below map one-to-one onto the controls in the builder.

Specifying targets

Targets go last on the command line and are split on spaces, so you can mix forms:

form	example
single host	`scanme.nmap.org` or `10.0.0.5`
CIDR range	`192.168.1.0/24` (256 addresses)
octet range	`10.0.0.1-50`, `10.0.0-2.*`
from a file	`-iL targets.txt`

Scan types

flag	scan	notes
`-sS`	TCP SYN ("half-open")	the default when run as root — fast and relatively quiet; never completes the handshake
`-sT`	TCP connect	the fallback without root — uses the OS to complete each connection, so it's slower and more logged
`-sU`	UDP	finds DNS, SNMP, DHCP and the like; slow, because closed UDP ports are rate-limited
`-sA`	TCP ACK	maps firewall rules (filtered vs unfiltered) rather than open ports
`-sF` / `-sX` / `-sN`	FIN / Xmas / Null	stealthy probes that can slip past simple filters on some stacks
`-sn`	ping sweep	host discovery only — no port scan. Great for "what's alive on this subnet?"
`-sL`	list scan	just lists (and reverse-resolves) the targets without sending probes

The raw-packet scans (-sS, -sU, -sA, and the FIN/Xmas/Null trio) need root. Without it nmap silently uses -sT.

Choosing ports

By default nmap scans the 1,000 most common ports. Narrow or widen with:

flag	meaning
`-F`	fast — the top 100 ports only
`--top-ports N`	the N most common ports
`-p 22,80,443`	an explicit list or range (`-p 1-1024`, `-p U:53,T:80`)
`-p-`	all 65,535 ports — thorough but slow

Detection

-sV — probe open ports to identify the service and version.
-O — guess the operating system from TCP/IP behaviour (needs root).
-sC — run the default set of NSE scripts (equivalent to --script=default).
--script — run named NSE scripts or categories, e.g. --script vuln, --script http-title, --script "smb-*".
-A — "aggressive": turns on -sV -O -sC and --traceroute at once. Thorough, but noisy and root-only.

Timing (`-T0`–`-T5`)

Templates trade speed for stealth and reliability. -T0 (paranoid) and -T1 (sneaky) space probes out to evade IDS; -T3 (normal) is the default; -T4 (aggressive) is the usual choice on a fast, reliable network; -T5 (insane) sacrifices accuracy for raw speed and can overwhelm hosts.

Reading and saving results

Each port is reported as open, closed (reachable but nothing listening), or filtered (a firewall dropped the probe). --open hides all but open ports; --reason shows why nmap reached each verdict; -v adds progress detail. To keep the results, use -oN file (human-readable), -oX file (XML), -oG file (grepable), or -oA basename to write all three at once.

A word on authorization

Scanning hosts you don't own or have written permission to test can be illegal and will often trip intrusion detection. Practise against scanme.nmap.org (which Nmap provides for exactly this) or your own lab.