port scan

nmap command line examples

Nmap is a commonly used utility in the security world. The default nmap scan is pretty good but there are a number of options to make your scans more informative and or more efficient.

My current set of command line options varies slightly depending on what I am looking for, but it generally starts with something the looks like this:

  1. nmap  -PN -sU -sS -sV -sC -oA nmap-scan-%D-%T -O --webxml --reason ,

This scans two networks, and In my case I have two subnets at home with routing between them. This would let me see the whole network at a glance.

  • The -PN option does not use ping (ICMP) to test to see if a host is alive before scanning it.
  • The sU, sS sV option enables UDP service discovery.
  • The sS option scans for TCP services using the SYN TCP Connect method. This is pretty reliable as it mimics a legitimate connection attempt.
  • The sV option tells nmap to connect to these services and find out what version they are running. This is useful for finding exploitable services.
Syndicate content