Commonly Used Nmap Commands
1. Target Selection
nmap 192.168.1.1 → Scan single IP
nmap 192.168.1.1-50 → Scan range of IPs
nmap 192.168.1.0/24 → Scan whole subnet
nmap scanme.nmap.org → Scan by hostname
nmap -iL targets.txt → Scan list of IPs from a file
2. Port Scanning
nmap -p 80 192.168.1.1 → Scan one port
nmap -p 22,80,443 192.168.1.1 → Scan multiple ports
nmap -p- 192.168.1.1 → Scan all 65535 ports
nmap -F 192.168.1.1 → Fast scan (top 100 ports)
nmap --top-ports 20 192.168.1.1 → Scan only top 20 most common ports
3. Scan Techniques
nmap -sS 192.168.1.1 → Stealth SYN scan
nmap -sT 192.168.1.1 → TCP connect scan
nmap -sU 192.168.1.1 → UDP scan
nmap -sA 192.168.1.1 → ACK scan (firewall rules check)
nmap -sN 192.168.1.1 → Null scan(closed port send RST, open shows no response)
4. Service & OS Detection
nmap -sV 192.168.1.1 → Detect service & version
nmap -O 192.168.1.1 → Detect operating system
nmap -A 192.168.1.1 → Aggressive scan (OS, version, scripts, traceroute)
5. Host Discovery
nmap -sn 192.168.1.0/24 → Ping scan
nmap -Pn 192.168.1.1 → Scan host without ping
nmap –sn –PE 192.168.1.1 → ICMP echo ping scan
-sn = Check if host is alive (ping scan), no port scan by default.
-Pn = Assume host is alive, skip ping, go straight to port scan.
6. Output & Saving Results
nmap -oN result.txt 192.168.1.1 → Save output in normal text
nmap -oX result.xml 192.168.1.1 → Save output in XML
nmap -oG result.gnmap 192.168.1.1 → Save greppable format (for grep)
7. Performance Tweaks
nmap -T4 192.168.1.1 → Faster scan (aggressive timing)
nmap -T1 192.168.1.1 → Slow scan (stealthier)
nmap --max-retries 2 192.168.1.1 → Limit retries for speed
nmap --min-rate 1000 192.168.1.1 → Send at least 1000 packets/sec
