Nmap

The de-facto network mapper and port/service scanner.

KaliParrotLinuxmedium

pkg: nmap

Nmap discovers hosts and services on a network by sending packets and analysing responses. It performs host discovery, port scanning, version/OS detection and scriptable checks via the NSE engine.

Syntax

nmap [scan type] [options] {target}

Example

nmap -sV -sC -p- -T4 example.com

Full TCP port scan (-p-) with service/version detection (-sV), default safe scripts (-sC), at aggressive timing (-T4).

Options & flags

What each switch does. Toggle them in the builder below to assemble a command.

`-sS`	TCP SYN ("stealth") scan — default; half-open, fast, needs root.
`-sT`	TCP connect scan — full handshake; used when not root.
`-sU`	UDP scan — find UDP services (DNS, SNMP); slow.
`-sV`	Service/version detection — probe open ports to identify software & version.
`-sC`	Run the default safe NSE scripts (equivalent to --script=default).
`-A`	Aggressive: enables -sV, -O, default scripts and traceroute.
`-O`	OS detection via TCP/IP fingerprinting (needs root).
`-Pn`	Treat all hosts as online — skip host discovery (ping).
`-sn`	Ping scan only — host discovery, no port scan.
`-p` <1-1000>	Ports to scan, e.g. 22,80,443 or 1-65535. Use -p- for all 65535.
`--top-ports` <1000>	Scan the N most common ports.
`-T` <4>	Timing template 0-5 (higher = faster, noisier). -T4 is common.
`--script` <vuln>	Run NSE script(s) or category, e.g. vuln, http-*.
`-oN` <scan.txt>	Write normal output to a file.
`-oA` <scan>	Write output in all formats (normal/XML/grepable) with this basename.
`-v`	Verbose (repeat -vv for more).
`-6`	Enable IPv6 scanning.
`--min-rate` <1000>	Send packets no slower than N/sec (speed up big scans).

Command builder

Tick options (and fill any values) to build a ready-to-copy command.

Usage examples

nmap -sV -sC -p- -T4 target.tld

Full TCP port sweep with version detection and default scripts.

nmap -sn 192.168.1.0/24

Host discovery only — list live hosts on the subnet.

nmap -sU --top-ports 50 target.tld

Scan the 50 most common UDP ports.

nmap -Pn --script vuln -p 80,443 target.tld

Skip ping and run vulnerability NSE scripts on the web ports.

nmap -A -oA fullscan target.tld

Aggressive scan, saving every output format as fullscan.*

Advantages

Extremely versatile — discovery, ports, versions, OS, and NSE scripts
Mature, scriptable and well documented
Outputs in greppable/XML/JSON for tooling

Disadvantages

Active and noisy — easily logged and blocked by IDS/WAF
Full scans can be slow against large ranges
Aggressive timing can disrupt fragile services

Related commands

Frequently asked questions

What is Nmap used for?

Nmap discovers hosts and services on a network by sending packets and analysing responses. It performs host discovery, port scanning, version/OS detection and scriptable checks via the NSE engine.

What is an example Nmap command?

A common example is: nmap -sV -sC -p- -T4 example.com — Full TCP port scan (-p-) with service/version detection (-sV), default safe scripts (-sC), at aggressive timing (-T4).

Is Nmap part of Kali Linux?

Yes. Nmap ships with Kali Linux (and Parrot OS). If missing, install it with: sudo apt install nmap.

What category of security tool is Nmap?

Nmap is a Information Gathering tool with a medium-risk profile when run against a live target.

Try recon tools live

Run real scans against a domain you control, stage by stage.

Open the lab →