Nmap Cheatsheet

Basic Scan Types

Scan	Command	Purpose
Ping Scan	`nmap -sn <target>`	Check if host is up.
SYN Scan	`nmap -sS <target>`	Stealthy fast TCP scan.
Service Version Scan	`nmap -sV <target>`	Scan service version of open ports.
Connect Scan	`nmap -sT <target>`	Full TCP handshake; accurate but noisy.
UDP Scan	`nmap -sU <target>`	Scan UDP ports (slow).
OS Detection	`nmap -O <target>`	Guess OS.
Aggressive Scan	`nmap -A <target>`	OS, version, scripts, traceroute.

Port Selection

Option	Meaning
`-p 22`	Scan one port
`-p 22,80,443`	Scan list
`-p 1-65535`	Scan range
`-p-`	Scan all ports
`--top-ports=10`	Scan most common ports
`-F`	Fast scan (top 100)

Important Flags

Flag	Description
`-Pn`	No host discovery; treat host as up
`-n`	No DNS resolution
`--disable-arp-ping`	Disable ARP ping
`--packet-trace`	Show all sent/received packets
`--reason`	Explain port states
`-T4`	Faster timing template
`--stats-every=5s`	Show stats every 5 seconds

Port States

State	Meaning
open	Accepts connections
closed	Responds with RST
filtered	Blocked by firewall
unfiltered	Reachable, state unknown
open\|filtered	No response
closed\|filtered	Idle scan ambiguity

Useful Examples

Scan Top 10 TCP Ports

nmap --top-ports=10 <target>

Full TCP + UDP + Version + OS

nmap -sS -sU -sV -O <target>

Packet Trace Example

nmap -p 21 --packet-trace -Pn -n --disable-arp-ping <target>

Service Enumeration

nmap -sV -p <port> <target>

How Scanning Works

Understanding how Nmap works is critical for interpreting scan results. After confirming a host is alive, scanning helps identify open ports & services, service versions, and OS details.

SYN Scan (-sS) — Default when running as root. Fast and stealthy (half-open). Interprets SYN-ACK → open, RST → closed. Does not complete the three-way handshake, so services may not log the attempt.

TCP Connect Scan (-sT) — Used when not root. Completes full handshake. Most accurate, least stealthy. Logged by services and IDS. Useful when outbound connections are allowed but inbound is blocked.

ACK Scan (-sA) — Difficult for firewalls to detect. TCP packet has only the ACK flag set, forcing RST responses from unfiltered ports. Useful for mapping firewall rules; does not determine open/closed, only filtered/unfiltered.

Filtered Ports

Dropped packets — No reply; Nmap retries (default 10 times). Slow scan.

Rejected packets — ICMP type 3 code 3 → port unreachable → likely firewall rejection.

UDP Scanning (`-sU`)

Slow due to long timeouts. Many ports show open|filtered due to lack of response. State determination:

UDP response → open
ICMP type 3 code 3 → closed
No response → open|filtered

Version Detection (`-sV`)

Probes services to identify service name, version, and extra metadata (workgroup, hostnames, OS hints). Nmap reads banners first; if version cannot be identified from the banner, it attempts signature matching — this is significantly noisier.

Packet Tracing (`--packet-trace`)

Shows packets sent and received. For a closed port:

SENT: SYN
RCVD: RST/ACK → closed

Timing Templates

Nmap offers six timing templates that control scan aggressiveness. Default is -T 3 (normal).

-T 0 / -T paranoid
-T 1 / -T sneaky
-T 2 / -T polite
-T 3 / -T normal
-T 4 / -T aggressive
-T 5 / -T insane

Overly aggressive timing can trigger security systems and result in being blocked.

Firewall / IDS Evasion

Decoys (`-D`)

Use decoy IP addresses to obfuscate the true source of the scan:

nmap -D RND:10 <target>         # 10 random decoys
nmap -D 10.0.0.1,10.0.0.2 <target>   # specific decoys

Decoys must be routable and online from the target’s perspective. Works with SYN, ACK, ICMP, and OS detection scans.

Source Port Specification (`--source-port`)

Specify a source port to blend in with expected traffic (e.g., port 53 for DNS):

nmap -sS -Pn -p- --source-port 53 <target>

Additional Evasion Options

Packet fragmentation (-f)
Randomizing port scan order (--randomize-hosts)
Varying scan technique (Xmas scan -sX, NULL scan -sN, FIN scan -sF)

notebook