7/3/23, 8:50 PM Nmap Cheat Sheet 2023: All the Commands, Flags & Switches

Search our Nmap cheat sheet to find the right cheat for the term you're looking
for. Simply enter the term in the search bar and you'll receive the matching
cheats available.

Search cheats here

Target Specification
SWITCH EXAMPLE DESCRIPTION

nmap 192.168.1.1 Scan a single IP

nmap 192.168.1.1 192.168.2.1 Scan specific IPs

nmap 192.168.1.1-254 Scan a range

nmap scanme.nmap.org Scan a domain

nmap 192.168.1.0/24 Scan using CIDR notation

-iL nmap -iL targets.txt Scan targets from a file

-iR nmap -iR 100 Scan 100 random hosts

-exclude nmap -exclude 192.168.1.1 Exclude listed hosts

Nmap Scan Techniques

SWITCH EXAMPLE DESCRIPTION

-sS nmap 192.168.1.1 -sS TCP SYN port scan (Default)

-sT nmap 192.168.1.1 -sT TCP connect port scan (Default without root privilege)

-sU nmap 192.168.1.1 -sU UDP port scan

-sA nmap 192.168.1.1 -sA TCP ACK port scan

https://www.stationx.net/nmap-cheat-sheet/ 2/18
7/3/23, 8:50 PM Nmap Cheat Sheet 2023: All the Commands, Flags & Switches

SWITCH EXAMPLE DESCRIPTION

-sW nmap 192.168.1.1 -sW TCP Window port scan

-sM nmap 192.168.1.1 -sM TCP Maimon port scan

Download the PDF Version of This NMAP Cheat Sheet!

Want to keep this cheat sheet at your fingertips? Just enter your email address, and we’ll
send a PDF copy to your inbox.

Email Address

DOWNLOAD

Host Discovery
SWITCH EXAMPLE DESCRIPTION

-sL nmap 192.168.1.1-3 -sL No Scan. List targets only

-sn nmap 192.168.1.1/24 -sn Disable port scanning. Host discovery only.

-Pn nmap 192.168.1.1-5 -Pn Disable host discovery. Port scan only.

https://www.stationx.net/nmap-cheat-sheet/ 3/18
7/3/23, 8:50 PM Nmap Cheat Sheet 2023: All the Commands, Flags & Switches

SWITCH EXAMPLE DESCRIPTION

TCP SYN discovery on port x.

-PS nmap 192.168.1.1-5 -PS22-25,80
Port 80 by default

TCP ACK discovery on port x.

-PA nmap 192.168.1.1-5 -PA22-25,80
Port 80 by default

UDP discovery on port x.

-PU nmap 192.168.1.1-5 -PU53
Port 40125 by default

-PR nmap 192.168.1.1-1/24 -PR ARP discovery on local network

-n nmap 192.168.1.1 -n Never do DNS resolution

Nmap Command Generator

Say goodbye to the hassle of trying to remember the exact syntax for your Nmap
commands! With our Nmap Command Generator, you can simply say what you
need Nmap to do and we will generate the command for you.

OS discovery www.google.com

Generate

Port Specification
SWITCH EXAMPLE DESCRIPTION

-p nmap 192.168.1.1 -p 21 Port scan for port x

-p nmap 192.168.1.1 -p 21-100 Port range

nmap 192.168.1.1 -p U:53,T:21-

-p Port scan multiple TCP and UDP ports
25,80

https://www.stationx.net/nmap-cheat-sheet/ 4/18
7/3/23, 8:50 PM Nmap Cheat Sheet 2023: All the Commands, Flags & Switches

SWITCH EXAMPLE DESCRIPTION

-p nmap 192.168.1.1 -p- Port scan all ports

-p nmap 192.168.1.1 -p http,https Port scan from service name

-F nmap 192.168.1.1 -F Fast port scan (100 ports)

-top- nmap 192.168.1.1 -top-ports

Port scan the top x ports
ports 2000

-p- Leaving off initial port in range makes the scan

nmap 192.168.1.1 -p-65535
65535 start at port 1

Leaving off end port in range

-p0- nmap 192.168.1.1 -p0-
makes the scan go through to port 65535

Service and Version Detection

SWITCH EXAMPLE DESCRIPTION

Attempts to determine the version of the

-sV nmap 192.168.1.1 -sV
service running on port

-sV -version- nmap 192.168.1.1 -sV - Intensity level 0 to 9. Higher number increases
intensity version-intensity 8 possibility of correctness

-sV -version- nmap 192.168.1.1 -sV - Enable light mode. Lower possibility of
light version-light correctness. Faster

nmap 192.168.1.1 -sV - Enable intensity level 9. Higher possibility of

-sV -version-all
version-all correctness. Slower

Enables OS detection, version detection, script

-A nmap 192.168.1.1 -A
scanning, and traceroute

OS Detection
SWITCH EXAMPLE DESCRIPTION

-O nmap 192.168.1.1 -O Remote OS detection using TCP/IP stack fingerprinting

https://www.stationx.net/nmap-cheat-sheet/ 5/18
7/3/23, 8:50 PM Nmap Cheat Sheet 2023: All the Commands, Flags & Switches

SWITCH EXAMPLE DESCRIPTION

-O -osscan- nmap 192.168.1.1 -O - If at least one open and one closed TCP port are not
limit osscan-limit found it will not try OS detection against host

-O -osscan- nmap 192.168.1.1 -O -

Makes Nmap guess more aggressively
guess osscan-guess

-O -max-os- nmap 192.168.1.1 -O - Set the maximum number x of OS detection tries

tries max-os-tries 1 against a target

Enables OS detection, version detection, script

-A nmap 192.168.1.1 -A
scanning, and traceroute

Timing and Performance

SWITCH EXAMPLE DESCRIPTION

-T0 nmap 192.168.1.1 -T0 Paranoid (0) Intrusion Detection System evasion

-T1 nmap 192.168.1.1 -T1 Sneaky (1) Intrusion Detection System evasion

Polite (2) slows down the scan to use less bandwidth and use
-T2 nmap 192.168.1.1 -T2
less target machine resources

-T3 nmap 192.168.1.1 -T3 Normal (3) which is default speed

Aggressive (4) speeds scans; assumes you are on a

-T4 nmap 192.168.1.1 -T4
reasonably fast and reliable network

Insane (5) speeds scan; assumes you are on an extraordinarily

-T5 nmap 192.168.1.1 -T5
fast network

Timing and Performance Switches

EXAMPLE
SWITCH DESCRIPTION
INPUT

-host-timeout <time> 1s; 4m; 2h Give up on target after this long

https://www.stationx.net/nmap-cheat-sheet/ 6/18
7/3/23, 8:50 PM Nmap Cheat Sheet 2023: All the Commands, Flags & Switches

EXAMPLE
SWITCH DESCRIPTION
INPUT

-min-rtt-timeout/max-rtt-timeout/initial-
1s; 4m; 2h Specifies probe round trip time
rtt-timeout <time>

-min-hostgroup/max-
50; 1024 Parallel host scan group sizes
hostgroup <size<size>

-min-parallelism/max-
10; 1 Probe parallelization
parallelism <numprobes>

Specify the maximum number of port

-max-retries <tries> 3
scan probe retransmissions

Send packets no slower

-min-rate <number> 100
than <number> per second

Send packets no faster than <number>

-max-rate <number> 100
per second

NSE Scripts
SWITCH EXAMPLE DESCRIPTION

Scan with default NSE scripts.

-sC nmap 192.168.1.1 -sC Considered useful for discovery and
safe

Scan with default NSE scripts.

-script
nmap 192.168.1.1 -script default Considered useful for discovery and
default
safe

Scan with a single script. Example

-script nmap 192.168.1.1 -script=banner
banner

-script nmap 192.168.1.1 -script=http* Scan with a wildcard. Example http

Scan with two scripts. Example http

-script nmap 192.168.1.1 -script=http,banner
and banner

https://www.stationx.net/nmap-cheat-sheet/ 7/18
7/3/23, 8:50 PM Nmap Cheat Sheet 2023: All the Commands, Flags & Switches

SWITCH EXAMPLE DESCRIPTION

Scan default, but remove intrusive

-script nmap 192.168.1.1 -script "not intrusive"
scripts

-script- nmap -script snmp-sysdescr -script-args

NSE script with arguments
args snmpcommunity=admin 192.168.1.1

Useful NSE Script Examples

COMMAND DESCRIPTION

nmap -Pn -script=http-sitemap-generator scanme.nmap.org http site map generator

nmap -n -Pn -p 80 -open -sV -vvv -script banner,http-title -iR Fast search for random web
1000 servers

Brute forces DNS hostnames

nmap -Pn -script=dns-brute domain.com
guessing subdomains

nmap -n -Pn -vv -O -sV -script smb-enum*,smb-ls,smb-

mbenum,smb-os-discovery,smb-s*,smb-vuln*,smbv2* -vv Safe SMB scripts to run
192.168.1.1

nmap -script whois* domain.com Whois query

nmap -p80 -script http-unsafe-output-escaping Detect cross site scripting

scanme.nmap.org vulnerabilities

nmap -p80 -script http-sql-injection scanme.nmap.org Check for SQL injections

Firewall / IDS Evasion and Spoofing

SWITCH EXAMPLE DESCRIPTION

Requested scan
(including ping scans)
-f nmap 192.168.1.1 -f use tiny fragmented
IP packets. Harder for
packet filters

https://www.stationx.net/nmap-cheat-sheet/ 8/18
7/3/23, 8:50 PM Nmap Cheat Sheet 2023: All the Commands, Flags & Switches

SWITCH EXAMPLE DESCRIPTION

Set your own offset

-mtu nmap 192.168.1.1 -mtu 32
size

nmap -D
Send scans from
-D 192.168.1.101,192.168.1.102,192.168.1.103,192.168.1.23
spoofed IPs
192.168.1.1

nmap -D decoy-ip1,decoy-ip2,your-own-ip,decoy-ip3,decoy- Above example

-D
ip4 remote-host-ip explained

Scan Facebook from

-S nmap -S www.microsoft.com www.facebook.com Microsoft (-e eth0 -Pn
may be required)

Use given source port

-g nmap -g 53 192.168.1.1
number

Relay connections
nmap -proxies http://192.168.1.1:8080, through
-proxies
http://192.168.1.2:8080 192.168.1.1 HTTP/SOCKS4
proxies

-data- Appends random data

nmap -data-length 200 192.168.1.1
length to sent packets

Example IDS Evasion command

nmap -f -t 0 -n -Pn --data-length 200 -D

192.168.1.101,192.168.1.102,192.168.1.103,192.168.1.23 192.168.1.1
Output
SWITCH EXAMPLE DESCRIPTION

nmap 192.168.1.1 -oN

-oN Normal output to the file normal.file
normal.file

-oX nmap 192.168.1.1 -oX xml.file XML output to the file xml.file

https://www.stationx.net/nmap-cheat-sheet/ 9/18
7/3/23, 8:50 PM Nmap Cheat Sheet 2023: All the Commands, Flags & Switches

SWITCH EXAMPLE DESCRIPTION

-oG nmap 192.168.1.1 -oG grep.file Grepable output to the file grep.file

-oA nmap 192.168.1.1 -oA results Output in the three major formats at once

Grepable output to screen. -oN -, -oX - also

-oG - nmap 192.168.1.1 -oG -
usable

-append- nmap 192.168.1.1 -oN file.file -

Append a scan to a previous scan file
output append-output

Increase the verbosity level (use -vv or more

-v nmap 192.168.1.1 -v
for greater effect)

Increase debugging level (use -dd or more for

-d nmap 192.168.1.1 -d
greater effect)

Display the reason a port is in a particular

-reason nmap 192.168.1.1 -reason
state, same output as -vv

-open nmap 192.168.1.1 -open Only show open (or possibly open) ports

-packet- nmap 192.168.1.1 -T4 -packet-

Show all packets sent and received
trace trace

-iflist nmap -iflist Shows the host interfaces and routes

-resume nmap -resume results.file Resume a scan

https://www.stationx.net/nmap-cheat-sheet/ 10/18
7/3/23, 8:50 PM Nmap Cheat Sheet 2023: All the Commands, Flags & Switches

Download the PDF Version of This NMAP Cheat Sheet!

Want to keep this cheat sheet at your fingertips? Just enter your email address, and we’ll
send a PDF copy to your inbox.

Email Address

DOWNLOAD

Helpful Nmap Output examples

COMMAND DESCRIPTION

nmap -p80 -sV -oG - -open 192.168.1.1/24 | Scan for web servers and grep to show which
grep open IPs are running web servers

 00:00
nmap -iR 10 -n -oX out.xml | grep "Nmap" | cut
00:00
Generate a list of the IPs of live hosts
1 
-d " " -f5 > live-hosts.txt

nmap -iR 10 -n -oX out2.xml | grep "Nmap" |

Append IP to the list of live hosts
cut -d " " -f5 >> live-hosts.txt

ndiff scanl.xml scan2.xml Compare output from nmap using the ndif

https://www.stationx.net/nmap-cheat-sheet/ 11/18
7/3/23, 8:50 PM Nmap Cheat Sheet 2023: All the Commands, Flags & Switches

COMMAND DESCRIPTION

xsltproc nmap.xml -o nmap.html Convert nmap xml files to html files

grep " open " results.nmap | sed -r ‘s/ +/ /g’ | sort

Reverse sorted list of how often ports turn up
| uniq -c | sort -rn | less

Miscellaneous Nmap Flags

SWITCH EXAMPLE DESCRIPTION

-6 nmap -6 2607:f0d0:1002:51::4 Enable IPv6 scanning

-h nmap -h nmap help screen

Other Useful Nmap Commands

COMMAND DESCRIPTION

nmap -iR 10 -PS22-

Discovery only on ports x, no port scan
25,80,113,1050,35000 -v -sn

nmap 192.168.1.1-1/24 -PR -sn -vv Arp discovery only on local network, no port scan

nmap -iR 10 -sn -traceroute Traceroute to random targets, no port scan

nmap 192.168.1.1-50 -sL -dns-

Query the Internal DNS for hosts, list targets only
server 192.168.1.1

Show the details of the packets that are sent and

nmap 192.168.1.1 --packet-trace
received during a scan and capture the traffic.

You are only doing yourself a disservice by failing to learn and utilize all of Nmap’s


features. It 00:00
is the first go-to tool you will use in the scanning and00:00
many assessments, setting the foundation for the rest of your pentest.
enumeration
1 stage of

Keep a copy of this Nmap cheat sheet to refer back to, and consider our Complete Nmap
Ethical Hacking Course. It, and many other ethical hacking courses, are available in our
VIP Member’s Section.

https://www.stationx.net/nmap-cheat-sheet/ 12/18