This is an extensive nmap command line reference guide, aligned with the last stable version of nmap options. This guide follows all the official nmap options and is built to be easy to understand with a progressive complexity.

Getting Help & Version Info (Start here)

nmap -h
# or
nmap --help

Prints the short options summary.

nmap -V
# or
nmap --version

Shows Nmap version and compile options.

Nmap version 7.95 ( https://nmap.org )
Platform: x86_64-pc-linux-gnu
Compiled with: ...

man nmap

Full manual page (recommended once you outgrow -h).

Target Specification

Flag	Meaning	Example
(none)	Hostname, IP, CIDR, ranges	nmap scanme.nmap.org
-iL	Read targets from a file	nmap -iL targets.txt
-iR	Scan num random hosts	nmap -iR 100 -Pn -p 80
—exclude	Exclude hosts/networks	nmap 192.168.1.0/24 —exclude 192.168.1.1,192.168.1.5
—excludefile	Exclude list from file	nmap 10.0.0.0/8 —excludefile exclude.txt
Example

nmap -iL hosts.txt --exclude 192.168.1.1

Host Discovery (Ping Scanning)

Flag	Meaning	When to use
-sL	List Scan – just list targets, no packets	Inventory planning
-sn	Ping Scan only (no port scan)	Fast live-host discovery
-Pn	Treat all hosts as online (skip discovery)	Firewalls that block ping
-PS[ports]	TCP SYN discovery	Bypass ICMP filters
-PA[ports]	TCP ACK discovery	Stateless firewalls
-PU[ports]	UDP discovery	UDP-only hosts
-PY[ports]	SCTP INIT discovery	SCTP environments
-PE	ICMP Echo	Classic ping
-PP	ICMP Timestamp	Alternative ICMP
-PM	ICMP Netmask	Alternative ICMP
-PO[proto]	IP Protocol Ping	Protocol-level discovery
-n	Never do DNS resolution	Speed
-R	Always resolve	Force reverse DNS
—dns-servers <s1,s2>	Custom DNS servers	Controlled environments
—system-dns	Use OS resolver	Default system DNS
—traceroute	Trace path to each host	Path discovery

Progressive examples

# Simple list
nmap -sL 192.168.1.0/24

Nmap scan report for 192.168.1.1
Nmap scan report for 192.168.1.2
...

# Classic ping sweep
nmap -sn 192.168.1.0/24

Nmap scan report for 192.168.1.10
Host is up (0.0023s latency).
Nmap done: 256 IP addresses (12 hosts up) scanned in 2.41 seconds

# Skip discovery (common when ICMP is blocked)
nmap -Pn -p 22,80,443 10.0.0.5

# Aggressive discovery mix
nmap -PS22,80,443 -PA80 -PE -PP 192.168.1.0/24

Basic Port Scanning (Beginner → Intermediate)

Flag	Meaning
(default)	Top 1000 TCP ports, SYN scan (if root) or Connect scan
-p	Specific ports / ranges
-p-	All 65535 ports
-F	Fast – top 100 ports
—top-ports	Top n most common ports
—port-ratio	Ports more common than ratio
—exclude-ports	Skip these ports
-r	Sequential (no randomization)

Examples

nmap 192.168.1.10

PORT     STATE SERVICE
22/tcp   open  ssh
80/tcp   open  http
443/tcp  open  https

nmap -p 22,80,443 192.168.1.10
nmap -p 1-1024 192.168.1.10
nmap -p- 192.168.1.10          # full port range (slow)
nmap -F 192.168.1.10           # top 100
nmap --top-ports 20 192.168.1.10

Scan Techniques (Core of Nmap)

Flag	Technique	Notes	Privileges
-sS	TCP SYN (Stealth / Half-open)	Default, fast, stealthy	Root
-sT	TCP Connect	Full handshake	Unprivileged
-sU	UDP Scan	Slow, important for DNS/SNMP/etc.	Root preferred
-sA	TCP ACK	Firewall rule mapping	Root
-sW	TCP Window	Advanced firewall analysis	Root
-sM	TCP Maimon	FIN/ACK (BSD-derived)	Root
-sN	TCP Null	No flags	Root
-sF	TCP FIN	FIN only	Root
-sX	TCP Xmas	FIN+PSH+URG	Root
-sY	SCTP INIT	SCTP scan	Root
-sZ	SCTP COOKIE-ECHO	SCTP variant	Root
-sO	IP Protocol Scan	Supported IP protocols	Root
-sI <zombie[:port]>	Idle / Zombie scan	Extremely stealthy	Root
-b	FTP Bounce	Rare, mostly historical	—
—scanflags	Custom TCP flags	Advanced research	Root

Progressive examples

# Default stealth SYN
sudo nmap -sS 192.168.1.10

# No root available
nmap -sT 192.168.1.10

# UDP (common services)
sudo nmap -sU -p 53,161,123 192.168.1.10

PORT    STATE         SERVICE
53/udp  open          domain
161/udp open|filtered snmp

# Firewall mapping
sudo nmap -sA 192.168.1.10

# Idle scan (very advanced)
sudo nmap -sI zombie.example.com 192.168.1.10

Service & Version Detection

Flag	Meaning
-sV	Probe open ports for service/version
—version-intensity <0-9>	Intensity (default 7)
—version-light	Intensity 2 (fast)
—version-all	Intensity 9 (thorough)
—version-trace	Debug version probes

nmap -sV 192.168.1.10

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.6 (Ubuntu Linux; protocol 2.0)
80/tcp open  http    nginx 1.24.0

nmap -sV --version-intensity 9 192.168.1.10

OS Detection

Flag	Meaning
-O	Enable OS detection
—osscan-limit	Only try promising targets
—osscan-guess	Aggressive guessing

sudo nmap -O 192.168.1.10

Device type: general purpose
Running: Linux 5.X
OS CPE: cpe:/o:linux:linux_kernel:5
OS details: Linux 5.15 - 6.1

Nmap Scripting Engine (NSE)

Flag	Meaning
-sC	Default scripts (—script=default)
—script	Specific scripts / categories / directories
—script-args <n1=v1,…>	Pass arguments
—script-args-file	Arguments from file
—script-trace	Show all script traffic
—script-updatedb	Update script database
—script-help	Help for scripts

Common categories: default, safe, auth, broadcast, brute, discovery, dos, exploit, external, fuzzer, intrusive, malware, safe, version, vuln

nmap -sC 192.168.1.10
nmap --script=vuln 192.168.1.10
nmap --script "http-*" --script-args http.useragent="Mozilla" 192.168.1.10
nmap --script-help vuln

Timing & Performance

Flag	Meaning
-T0 … -T5	Timing templates (0=Paranoid → 5=Insane)
—min-hostgroup / —max-hostgroup	Parallel host group size
—min-parallelism / —max-parallelism	Probe parallelism
—min-rtt-timeout / —max-rtt-timeout / —initial-rtt-timeout	RTT control
—max-retries	Max retransmissions
—host-timeout	Give up on host after time
—scan-delay / —max-scan-delay	Delay between probes
—min-rate	Minimum packets/sec
—max-rate	Maximum packets/sec

nmap -T4 192.168.1.0/24          # recommended for most internal scans
nmap -T2 --max-rate 100 10.0.0.0/8   # slower, quieter
nmap --host-timeout 5m 192.168.1.0/24

Firewall / IDS Evasion & Spoofing

Flag	Meaning
-f / —mtu	Fragment packets
-D <decoy1,decoy2,ME,…>	Decoy scan
-S	Spoof source address
-e	Use specific interface
-g / —source-port	Source port
—proxies <url1,…>	HTTP/SOCKS4 proxies
—data / —data-string / —data-length	Custom payload
—ip-options	IP options
—ttl	Set TTL
—spoof-mac <mac/prefix/vendor>	Spoof MAC
—badsum	Bad checksums

sudo nmap -f -D RND:10,ME 192.168.1.10
sudo nmap -S 192.168.1.99 -e eth0 192.168.1.10
sudo nmap --source-port 53 192.168.1.10

Output Options

Flag	Meaning
-oN	Normal output
-oX	XML
-oG	Grepable
-oS	Script kiddie
-oA	All three major formats
-v / -vv	Verbosity
-d / -dd	Debugging
—reason	Why a port is in a state
—open	Show only open ports
—packet-trace	Show every packet
—iflist	List interfaces & routes
—append-output	Append instead of overwrite
—resume	Resume aborted scan
—noninteractive	No keyboard interaction
—stylesheet <path/URL>	XSL for XML→HTML
—webxml	Use nmap.org stylesheet
—no-stylesheet	No stylesheet

nmap -oA scan-results -v 192.168.1.10
nmap -oX results.xml --stylesheet https://nmap.org/data/nmap.xsl 192.168.1.10

Miscellaneous

Flag	Meaning
-6	IPv6 scanning
-A	Aggressive: OS + version + scripts + traceroute
—datadir	Custom data files location
—send-eth / —send-ip	Raw Ethernet vs IP packets
—privileged	Assume full privileges
—unprivileged	Assume no raw sockets

nmap -6 -A scanme.nmap.org
nmap -A -T4 scanme.nmap.org

Recommended Progressive Workflows

Beginner – quick inventory

nmap -sn 192.168.1.0/24
nmap -F 192.168.1.10

Intermediate – service mapping

nmap -sS -sV -O -T4 --top-ports 1000 192.168.1.0/24 -oA network-map

Advanced – thorough audit

sudo nmap -sS -sU -sV -O -A -T4 -p- --script=default,vuln,safe \
  --version-intensity 8 -oA full-audit 192.168.1.10

Stealthy / constrained

sudo nmap -sS -T2 -f -D RND:8,ME --source-port 53 \
  --data-length 24 -Pn -p 80,443,22 10.0.0.5

Quick Reference Card (most used)

-h / -V                 Help / Version
-sn                     Host discovery only
-Pn                     Skip host discovery
-sS / -sT / -sU         SYN / Connect / UDP
-p <ports> / -p- / -F   Port selection
-sV                     Version detection
-O                      OS detection
-sC / --script=...      Scripts
-A                      Aggressive
-T0..-T5                Timing
-oA <name>              Save all formats
-v / -d                 Verbosity / Debug

Nmap Scripting Engine (NSE) Categories — Complete Exploration

NSE organizes scripts into 14 categories. These categories help you select the right scripts for the job, control risk, and understand what a script is designed to do.

Category names are case-insensitive. A single script can belong to multiple categories (e.g. default + safe + discovery).

Official NSE Categories

Category	Risk Level	Primary Purpose	Typical Use Case
default	Low–Medium	Scripts that run with -sC or -A	Everyday scanning
safe	Low	Non-intrusive, low resource usage	Production / cautious environments
discovery	Low–Medium	Gather information about hosts & services	Reconnaissance
version	Low	Advanced version detection (runs only with -sV)	Service identification
auth	Medium	Authentication methods & credential discovery	Checking default/weak auth
broadcast	Low–Medium	Discover hosts via local network broadcasts	Local network discovery
external	Medium	Contact third-party services (whois, CT logs, etc.)	Enrichment / external lookups
brute	High	Password guessing / brute-force attacks	Credential attacks (authorized only)
intrusive	High	May crash services, consume resources, or look hostile	Aggressive testing
vuln	Medium–High	Check for known vulnerabilities	Vulnerability assessment
exploit	High	Actively attempt to exploit vulnerabilities	Proof-of-concept / authorized exploitation
dos	High	May cause denial of service	DoS testing (very careful use)
malware	Medium	Detect malware, backdoors, or botnet indicators	Compromised host detection
fuzzer	High	Send malformed/randomized data	Finding new bugs (slow & noisy)

Detailed Category Breakdown

1. default

Scripts that run automatically when you use -sC or -A.

Selection criteria used by the Nmap team:

Speed
Usefulness
Low verbosity
Reliability
Low intrusiveness
Privacy considerations

Most default scripts are also in the safe category.

Example

nmap -sC 192.168.1.10
# equivalent to
nmap --script=default 192.168.1.10

2. SAFE

Scripts considered safe to run in most environments. They should not crash services, consume large amounts of bandwidth/CPU, or look like an attack.

Preferred category for production scanning and initial assessments.

3. DISCOVERY

Actively gather information about the target or surrounding network (shares, titles, SNMP data, directories, etc.).

Very commonly combined with safe or default.

4. VERSION

Special category. These scripts only run when version detection (-sV) is enabled. Their output is integrated into the normal version detection results.

You cannot select them independently with —script=version.

5. AUTH

Scripts related to authentication credentials or bypassing authentication (without pure brute-force).

Examples: checking for anonymous FTP, identifying authentication schemes, enumerating users.

6. BROADCAST

Discover hosts that were not specified on the command line by sending broadcast packets on the local network.

Often used with the newtargets script argument so newly discovered hosts are automatically added to the scan queue.

7. EXTERNAL

Scripts that send data to third-party services (WHOIS, Certificate Transparency logs, blacklists, etc.).

These can leak information about your scan targets to external parties.

8. BRUTE

Password guessing / brute-force attacks against many protocols (HTTP, SSH, FTP, databases, SNMP, etc.).

High impact — only use with explicit authorization.

9. INTRUSIVE

Scripts that cannot be classified as safe. They may:

Crash services
Use significant resources
Be perceived as malicious by administrators

Most brute-force and some discovery scripts fall here.

10. VULN

Check for specific known vulnerabilities. Usually only produce output when a vulnerability is found.

11. EXPLOIT

Actively attempt to exploit a vulnerability (e.g. command execution, shellshock, etc.).

Highest risk category for the target.

12. DOS

Scripts that may cause a denial of service, either intentionally (to test resilience) or as a side effect of vulnerability testing.

13. MALWARE

Detect signs of malware, backdoors, or botnet infection (unusual ports, spoofed services, known C2 indicators, etc.).

14. FUZZER

Send unexpected or randomized data to services to discover new bugs. Slow and bandwidth-intensive.

How to Select Categories

# Single category
nmap --script=vuln 192.168.1.10

# Multiple categories (OR)
nmap --script=default,safe,discovery 192.168.1.10

# Boolean expressions (very powerful)
nmap --script "default or safe" 192.168.1.10
nmap --script "not intrusive" 192.168.1.10
nmap --script "(default or safe) and not http-*" 192.168.1.10
nmap --script "vuln and safe" 192.168.1.10

Practical Recommendations by Experience Level

Level	Recommended Categories	Notes
Beginner	default, safe, discovery	Start here
Intermediate	+ auth, version, vuln	Good balance
Advanced	+ brute, intrusive, exploit (authorized)	High risk
Local network	+ broadcast	Use newtargets carefully
External intel	+ external	Privacy implications

Useful Commands for Exploring Categories

# List all scripts in a category
nmap --script-help default
nmap --script-help vuln
nmap --script-help "safe and discovery"

# See categories of a specific script
nmap --script-help http-title

# Update the script database after adding/removing scripts
sudo nmap --script-updatedb

Here’s a focused addition for your Docs: real-world sample outputs + Mermaid decision trees. You can drop these sections into the main Nmap reference or keep them as a companion page (nmap-decision-trees.md / nmap-examples.md).

Mermaid Decision Trees

1. Host Discovery Decision Tree

flowchart TD
    A[Start: Do I need live hosts only?] -->|Yes| B{Can I send ICMP?}
    A -->|No – I must scan every IP| C[Use -Pn]

    B -->|Yes| D[nmap -sn target]
    B -->|No / Firewalled| E{TCP ports open?}

    E -->|Likely 80/443/22| F[nmap -PS80,443,22 -sn target]
    E -->|Unknown| G[nmap -PS -PA -PU -PE -sn target]

    D --> H[List of live hosts]
    F --> H
    G --> H
    C --> I[Treat all hosts as up → proceed to port scan]

2. Port Scan Technique Decision Tree

flowchart TD
    A[Choose Scan Technique] --> B{Do I have root / raw sockets?}
    
    B -->|Yes| C{Need stealth?}
    B -->|No| D[Use -sT TCP Connect]

    C -->|Yes – avoid full handshake| E[Use -sS SYN Stealth]
    C -->|No – simple is fine| E

    E --> F{Also need UDP services?}
    F -->|Yes| G[Add -sU]
    F -->|No| H[TCP only]

    G --> I{Firewall analysis needed?}
    H --> I

    I -->|Yes| J[Add -sA or -sW]
    I -->|No| K[Standard scan]

    D --> L[Unprivileged scan complete]
    K --> M[Privileged scan complete]
    J --> M

3. “What should I run?” Progressive Scan Decision

flowchart TD
    A[What is the goal?] --> B[Quick inventory]
    A --> C[Service mapping]
    A --> D[Vulnerability check]
    A --> E[Full audit / pentest]

    B --> B1["nmap -sn + -F"]
    C --> C1["nmap -sS -sV -O --top-ports 1000"]
    D --> D1["nmap -sV --script=vuln,safe"]
    E --> E1["nmap -sS -sU -sV -O -A -p- --script=default,vuln"]

    B1 --> F[Fast & quiet]
    C1 --> G[Most common real-world scan]
    D1 --> H[Targeted vuln discovery]
    E1 --> I[Thorough – slow & noisy]

4. NSE Category Risk Decision

flowchart TD
    A[Selecting NSE scripts] --> B{Environment?}

    B -->|Production / Cautious| C[default + safe + discovery]
    B -->|Lab / Authorized Test| D[Add vuln + auth]
    B -->|Full Engagement| E[Add brute + intrusive + exploit]

    C --> F[Low risk]
    D --> G[Medium risk]
    E --> H[High risk – written permission required]

Real-World Sample Outputs

Example 1 — Simple Ping Sweep

nmap -sn 192.168.1.0/24

Starting Nmap 7.95 ( https://nmap.org ) at 2026-08-15 11:40 IST
Nmap scan report for 192.168.1.1
Host is up (0.0012s latency).
Nmap scan report for 192.168.1.10
Host is up (0.0028s latency).
Nmap scan report for gateway.local (192.168.1.254)
Host is up (0.0009s latency).
Nmap done: 256 IP addresses (3 hosts up) scanned in 2.87 seconds

Example 2 — Default SYN + Version Scan

sudo nmap -sS -sV -T4 192.168.1.10

Nmap scan report for 192.168.1.10
Host is up (0.0031s latency).
Not shown: 996 closed ports
PORT     STATE SERVICE     VERSION
22/tcp   open  ssh         OpenSSH 8.9p1 Ubuntu 3ubuntu0.10 (Ubuntu Linux; protocol 2.0)
80/tcp   open  http        nginx 1.24.0
443/tcp  open  ssl/http    nginx 1.24.0
3306/tcp open  mysql       MySQL 8.0.36-0ubuntu0.22.04.1
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Nmap done: 1 IP address (1 host up) scanned in 8.42 seconds

Example 3 — Aggressive Scan (-A)

sudo nmap -A -T4 scanme.nmap.org

Nmap scan report for scanme.nmap.org (45.33.32.156)
Host is up (0.18s latency).
Not shown: 991 closed ports
PORT      STATE    SERVICE      VERSION
22/tcp    open     ssh          OpenSSH 7.4 (protocol 2.0)
| ssh-hostkey:
|   2048 8d:60:f1:7c:ca:b7:3d:0a:d6:67:54:9d:69:d9:b9:dd (RSA)
|_  256 3e:8e:1f:5a:2d:8c:8e:9a:1b:2c:3d:4e:5f:6a:7b:8c (ECDSA)
80/tcp    open     http         Apache httpd 2.4.7
|_http-title: Go ahead and ScanMe!
9929/tcp  open     nping-echo   Nping echo
31337/tcp open     tcpwrapped

Device type: general purpose
Running: Linux 4.X|5.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5
OS details: Linux 4.15 - 5.19
Network Distance: 12 hops

TRACEROUTE (using port 80/tcp)
HOP RTT       ADDRESS
...
12  178.21 ms scanme.nmap.org (45.33.32.156)

Nmap done: 1 IP address (1 host up) scanned in 22.15 seconds

Example 4 — UDP Scan (common gotcha)

sudo nmap -sU -p 53,123,161,500 --version-intensity 5 192.168.1.1

Nmap scan report for 192.168.1.1
Host is up (0.002s latency).

PORT    STATE         SERVICE  VERSION
53/udp  open          domain   dnsmasq 2.89
123/udp open          ntp      NTP v4 (unsynchronized)
161/udp open|filtered snmp
500/udp open|filtered isakmp

Example 5 — Vulnerability Scripts

nmap -sV --script=vuln --script-args=unsafe=1 192.168.1.10

PORT   STATE SERVICE VERSION
80/tcp open  http    nginx 1.24.0
| http-slowloris-check:
|   VULNERABLE:
|   Slowloris DOS attack
|     State: LIKELY VULNERABLE
|     Risk factor: Medium
|_    Description: ...
|_http-csrf: Couldn't find any CSRF vulnerabilities.
|_http-dombased-xss: Couldn't find any DOM based XSS.

Example 6 — Grepable + Normal Output (automation friendly)

nmap -oA web-scan -p 80,443,8080,8443 10.0.0.0/24

Produces three files:

web-scan.nmap → human readable
web-scan.gnmap → grepable (Host: 10.0.0.5 () Ports: 80/open/tcp//http///)
web-scan.xml → machine parseable

This covers every flag present in the official Nmap options summary plus the most important related behaviors.

Would you like me to:

Turn this into a ready-to-drop Markdown file for your Docs content collection (with frontmatter)?
Split it into multiple focused Docs pages (e.g. Host Discovery, Scan Techniques, NSE, Evasion)?
Add more real-world example outputs or Mermaid diagrams for scan decision trees?
Adjust the tone/structure further for the HackingKnack terminal aesthetic?
Add more specialized trees (e.g. “Firewall evasion path”, “NSE category selector”, “When to use -Pn”)?

Just say the word.

pie title "Project Status"
  "Complete" : 60
  "In Progress" : 30
  "Planned" : 10

nmap - A Complete Command Reference Guide

Getting Help & Version Info (Start here)

Target Specification

Host Discovery (Ping Scanning)

Basic Port Scanning (Beginner → Intermediate)

Scan Techniques (Core of Nmap)

Service & Version Detection

OS Detection

Nmap Scripting Engine (NSE)

Timing & Performance

Firewall / IDS Evasion & Spoofing

Output Options

Miscellaneous

Recommended Progressive Workflows

Quick Reference Card (most used)

Nmap Scripting Engine (NSE) Categories — Complete Exploration

Official NSE Categories

Detailed Category Breakdown

1. default

2. SAFE

3. DISCOVERY

4. VERSION

5. AUTH

6. BROADCAST

7. EXTERNAL

8. BRUTE

9. INTRUSIVE

10. VULN

11. EXPLOIT

12. DOS

13. MALWARE

14. FUZZER

How to Select Categories

Practical Recommendations by Experience Level

Useful Commands for Exploring Categories

Mermaid Decision Trees

1. Host Discovery Decision Tree

2. Port Scan Technique Decision Tree

3. “What should I run?” Progressive Scan Decision

4. NSE Category Risk Decision

Real-World Sample Outputs

Example 1 — Simple Ping Sweep

Example 2 — Default SYN + Version Scan

Example 3 — Aggressive Scan (-A)

Example 4 — UDP Scan (common gotcha)

Example 5 — Vulnerability Scripts

Example 6 — Grepable + Normal Output (automation friendly)