Nmap Cheat Sheet: The Scans and Flags You Actually Use

Nmap is the standard tool for discovering hosts and open ports on a network. This is a practical cheat sheet of the commands you actually reach for. Only ever scan systems you own or are authorised to test. To understand the ports and services you find, the free Network Traffic Analysis and Linux networking lessons help.

Host discovery

• nmap -sn 10.0.0.0/24 - ping sweep, no port scan (who is up)
• nmap -Pn host - skip discovery, treat host as up

Port scans

• nmap host - top 1000 TCP ports
• nmap -p- host - all 65,535 TCP ports
• nmap -p 22,80,443 host - specific ports
• nmap -sS host - SYN (stealth) scan (needs root)
• nmap -sU host - UDP scan

Service, version and OS detection

• nmap -sV host - identify service versions
• nmap -O host - OS detection
• nmap -A host - version, OS, scripts and traceroute

Timing and output

• nmap -T4 host - faster timing (1-5)
• nmap -oN out.txt host - save normal output; -oA saves all formats

NSE scripts

• nmap -sC host - default safe scripts
• nmap --script vuln host - known-vulnerability checks

Want to practise finding and reading services hands-on? Try the Web Pentesting course, where recon leads straight into exploitation against a safe target in your browser.