Nmap Command Builder: Build a Command and Learn What Each Flag Does

Nmap is a free and open source utility for network discovery and security auditing. Defenders use it to inventory hosts, see which ports and services are exposed, and check that firewall rules do what they should. Port results are states: open, closed, filtered, unfiltered and open|filtered.

It runs a TCP SYN scan, also called a half-open scan. Nmap sends a SYN and never completes the handshake. A SYN/ACK reply means the port is open, a RST means closed, and no response after retransmissions means filtered. It needs raw packet privileges and is the default scan type when you have them.

-sS crafts raw packets and needs privileges. -sT asks the operating system to make a full TCP connection, so it works without special privileges, but the guide says it is slower and more likely to be logged by the target.

The 1,000 most common ports for each protocol scanned. Use -F for 100, --top-ports N for the N most common, -p to choose ports, or -p- for all 65,535.

-A enables OS detection (-O), version scanning (-sV), script scanning (-sC) and traceroute. It does not enable timing or verbosity options. The reference guide warns that default script scanning is intrusive, so do not use -A on networks you lack permission to test.

They are named paranoid (0), sneaky (1), polite (2), normal (3), aggressive (4) and insane (5). Normal is the default. The guide recommends -T4 for decent broadband or Ethernet connections and calls -T5 too aggressive for his taste, because short timeouts and few retries can cost accuracy.

It skips host discovery and treats every target as up, so port scans, version detection and OS detection run against all of them. On a /16 that means 65,536 addresses.

The guide says the legal ramifications are complex and controversial, that no US federal law explicitly criminalises port scanning, that unauthorised scanning can still breach an ISP's acceptable use policy and the law in some places, and that you should always get written authorization from the target network's representatives. In the US, accessing a computer without authorization is covered by 18 U.S.C. 1030. This is general information, not legal advice; ask a lawyer in your jurisdiction.

Nmap grants permission to scan scanme.nmap.org for testing, limited to Nmap scanning (not exploits or denial of service) and about a dozen scans a day. You can also scan machines in a lab you own, such as virtual machines on your own computer.

Those options exist to evade detection, and this page is for learning and for authorised audits, where evading your own monitoring defeats the point. The full list is in the Nmap Reference Guide if you have a legitimate need.