Much of the original documentation includes philosophy and reasoning for using particular options. Read that at nmap.org
This version is terse with minial description.(DGG)
nmap [Scan Type…] [options] target specification
"Network Mapper" is an tool for network exploration and security auditing.
Commonly used for security audits, useful for network inventory, managing service upgrade
schedules, and monitoring host or service uptime.
Uses special packets to determine host availablity, services (applications) offered, OS running, type of filters/firewalls , etc.
Example:
-A: enables OS and version detection, script scanning
-t: traceroute
Stats: 0:00:22 elapsed; 248 hosts completed (7 up), 7 undergoing SYN Stealth Scan
SYN Stealth Scan Timing: About 63.99% done; ETC: 11:26 (0:00:11 remaining)
v/V increases/decrease verbosity
d/D increases/decrease debugging
p/P enable/disable packet tracing
Aborted scans ( ^C) can be resumed with proper output option.
A representative scan
agressive detection (with traceroute) and timing, sudo nmap -A -T aggressive -sS --top-ports 10 -v -oN scan-%D-%T 192.168.1.1/28 # .0-.7 Starting Nmap 6.01 ( http://nmap.org ) at 2012-10-23 07:39 EDT NSE: Loaded 93 scripts for scanning. NSE: Script Pre-scanning. Initiating Ping Scan at 07:39 Scanning 8 hosts [2 ports/host] Completed Ping Scan at 07:39, 1.21s elapsed (8 total hosts) Initiating Parallel DNS resolution of 8 hosts. at 07:39 Completed Parallel DNS resolution of 8 hosts. at 07:39, 0.02s elapsed Nmap scan report for 192.168.1.0 [host down] Nmap scan report for 192.168.1.5 [host down] Nmap scan report for 192.168.1.7 [host down] Initiating Connect Scan at 07:39 Scanning 5 hosts [1000 ports/host] Discovered open port 80/tcp on 192.168.1.4 Discovered open port 3306/tcp on 192.168.1.4 Discovered open port 21/tcp on 192.168.1.4 Discovered open port 80/tcp on 192.168.1.1 … full file |
Target Specification | next: Host Discovery |
hostname
/numbits
to a target. Every address with the first numbits which are the same is target.
192.168.10.0/25 scans the 64 hosts with the same 25 high order bits 192.168.10.40/25 specifies the same range( the .40 being masked out. 192.168.10.130/24 specifies the the 128 hosts from 192.168.10.128-255. scanMe.nmap.org/28: Given scanMe.nmap.org is 64.13.134.52, scan the 16 addresses 64.13.134.48 through 64.13.134.63.
Note that increasing numbits take geometricly longer time since each additional bit doubles the number of addresses
CIDR notation is not always flexible enough. For example, skipping IPs ending with .0 or .255 because they are commonly broadcast addresses.
192.168.0-127.1-254 specifies a range for the 3rd octet and will skip all addresses that end in .0 and or .255.
Multiple formats are permitted: nmap scanMe.nmap.org 192.168.3.0/24 10.0.0,1,17-63.0-255
-iL tfile |
Host Discovery | next:Ports |
Security auditors should care about every single device with an nerwork.
An external penetration tester may use a diverse set of probes in an attempt to locate possible exploits.
ARP discovery (-PR) is done on a local ethernet network.
For non-local targets, TCP ACK packet for port 80 and an ICMP echo request query is sent
(unprivileged users use a SYN packet using the connect system call )
Defaults are equivalent to -PA -PE.
Host discovery is followed by a port scan.
| open | An application is actively accepting TCP connections, UDP datagrams or SCTP associations. |
| closed | accessible (it receives and responds to probe packets), but there is no application listening on it, now. |
| filtered | packet filtering prevents probes from reaching the port by a dedicated firewall , router rules, or host-based firewall. It may be only the host sending the packets is having a problem. Try from another host. |
| unfiltered ACK scan | port is accessible, cannot determine if it is open. Scanning with other scan types such as Window scan, SYN scan, or FIN scan, may help resolve if the port is open. |
| open|filtered UDP, IP protocol, FIN, NULL, and Xmas | unable to determine whether a port is open or filtered. Occurs for scan types in which open ports give no response. The lack of response could mean that a packet filter dropped the probe or any response it elicited. |
| closed|filtered IP ID idle scan | unable to determine whether a port is closed or filtered. |
State combinations open.filtered and closed.filtered: it cannot be determined which describe a port best.
For IP protocol scan (-sO), information on supported protocols is provided.
Discussin on probe effectivness
-sL |
| Additional options useful with scan options. | |||||||||||
--traceroute | |||||||||||
nmap target scans more than 1,660 TCP ports on target.
Port states are not intrinsic properties of the port itself, but describe how Nmap sees them.
For example, a scan from within the same network as the target may show port 135/tcp as open,
a scan with the same options from across the Internet might show that port as filtered.
The port states defined by Nmap:
SYN ,
or FIN scans, may resolve the port as open.
connect and FTP bounce .
Only one method may be used at a time, except that UDP scan (-sU) may be combined with any one of the TCP scan types.
Form -sC.
Default: SYN, (or connect if the user does not have proper privileges to send raw packets or if IPv6 targets were
specified.
-sS | TCP SYN fast Default. Quickly, scanning thousands of ports per second, not hampered by restrictive firewalls. Relatively unobtrusive and stealthy Does not depend on idiosyncrasies of implementation. Allows clear, reliable differentiation between the open, closed, and filtered
Sends SYN packet, as if going to open a connection. | ||||||||||||||||||
-sT |
--top-ports n |
Back to ports
Service and Version Detection
Next timing
After ports are discovered, nmap.org target=nmap>version detection interrogates them interrogates them
Some UDP ports are open.filtered .
Version detection elicits a response from these and changes them to open if successful. TCP open.filtered ports are treated the same way.
-sV |
-O |
nmap hostname) on the local network takes a 200 milliseconds.time is in milliseconds, append s, m, or h to the value to specify seconds, minutes, or hours. --host-timeout arguments 900000, 900s, and 15m are equivalent.
--min-hostgroup numhosts | parallel scan group size. | ||||||||||||||
--min-parallelism np--max-parallelism np | probe parallelization | ||||||||||||||
--max-rtt-timeout time |
-e interface | Use specified interface |
-f m--mtu m | fragment packets using the specified MTU |
-D decoy1[,decoy2][,ME][,…] | Cloak a scan with decoys. Makes it appear to the remote host that the decoys are scanning the target too. |
| Spoof source address |
--source-port p | Spoof source port number A common misconception is to trust traffic based only on the source port number. |
--data-length n | Append random data to sent packets Normally minimalist packets containing only a header are sent. |
--ip-options | Send packets with specified IP options IP protocol options are rarely seen and can be useful in some cases. Use record route ( R) to determine a path to a target when traceroute-style approaches fail. Record-timestamp ( T) or both (U)if packets are being dropped by a certain firewall. Loose or strict source routing specified with an L or S followed by a space and then a space-separated list of IP addresses, specify a different route.
|
--ttl value | |
--randomize-hosts | May make the scans less obvious to network monitoring systems. Combine it with slow timing options . See nmap.org |
--spoof-mac MAC address, prefix, or vendor name |
Address of 0 uses random MAC. See nmap.org Examples: Apple, 0, 01:02:03:04:05:06, deadbeefcafe,
0020F2, and Cisco. Only affects raw packet scans such as SYN scan or OS detection,
not connection-oriented features such as version detection Implies --send-eth
|
--badsum | Send packets with invalid checksums Responses come from a firewall or IDS that didn't validate the checksum. See nmap.org/p60-12 |
-sC | |||||||||
interactive output is displayed in addition to file output.
filenames support strftime-like conversions:
%H, %M, %S, %m, %d, %y, and %Y. %T is %H%M%S, %R is %H%M and %D is %m%d%y.
Example: -oX 'scan-%D-%T.xml' will output to scan-144840-121307.xml.
-oN file |
-v | verbosity. Open ports shown as found and completion time estimates are provided. Use it twice or more for more. While running, v increases verbosity, V decreases. See nmap.org
|
-d [level] | debug output While running, d increases, D decreases. See nmap.org
|
--packet-trace | Trace packets and data output summary of every packet sent or received. Used for debugging. See nmap.org Packet Tracing enabled. SENT (4.6944s) TCP 192.168.1.8:52616 > 192.168.1.6:2811 S ttl=49 id=11069 iplen=44 seq=4254715915 win=1024 <mss 1460> SENT (4.8018s) TCP 192.168.1.8:52615 > 192.168.1.11:1218 S ttl=41 id=53597 iplen=44 seq=4254650378 win=1024 <mss 1460> RCVD (4.8057s) TCP 192.168.1.11:1218 > 192.168.1.8:52615 RA ttl=64 id=15801 iplen=40 seq=0 win=0 SENT (4.8243s) TCP 192.168.1.8:52626 > 192.168.1.6:139 S ttl=40 id=14479 iplen=44 seq=4237873418 win=1024 <mss 1460> SENT (4.8244s) TCP 192.168.1.8:52616 > 192.168.1.3:443 S ttl=49 id=23356 iplen=44 seq=4254715915 win=1024 <mss 1460> RCVD (4.8258s) TCP 192.168.1.5:139 > 192.168.1.8:52626 SA ttl=128 id=22102 iplen=44 seq=2168289427 win=8192 <mss 1460> RCVD (4.8266s) TCP 192.168.1.6:139 > 192.168.1.8:52626 SA ttl=128 id=2213 iplen=44 seq=2599483217 win=8192 <mss 1460> SENT (4.8462s) TCP 192.168.1.8:52616 > 192.168.1.3:8888 S ttl=47 id=39457 iplen=44 seq=4254715915 win=1024 <mss 1460> |
--open | Show only open (or possibly open) ports. See nmap.org |
--iflist | (List interfaces and routes) outputs interface list and system routes, useful for debugging. See nmap.org |
--log-errors | Log errors/warnings to normal mode output file Usually go only to the screen (interactive output), leaving any normal-format output files (usually specified with -oN) uncluttered. messages will appear in interactive mode too. An alternative to --log-errors is redirecting interactive output (including the standard error
stream) to a file. See nmap.org
|
Miscellaneous output options | |
--resume filename | Resume aborted scan if normal (-oN) logs were kept, resume scanning.No other arguments are permitted |
--append-output | |
--stylesheet path or URL | XSL stylesheet to transform XML output. See nmap.org |
--webxml | Load stylesheet from Nmap.Org |
--no-stylesheet | Omit XSL stylesheet declaration from XML |
-6 | Enable IPv6 scanning Ping scanning (TCP-only), connect scanning, and version detection . Use IPv6 syntax to specify an address like 3ffe:7501:4819:2000:210:f3ff:fe03:14d0. Hostnames are recommended. Output includes the IPv6 address on the "interesting ports" line see nmap.org |
-A | Aggressive scan enables OS detection ( -O), version and (-sV) script scanning (-sC) and traceroute (--traceroute). Do not use against target networks as it is considered intrusive. Does not set agresive timing options (such as -T4) or verbosity (-v) .
|
--datadir ddir | custom data file location
for: nmap-service-probes, nmap-services,
nmap-protocols, nmap-rpc, nmap-mac-prefixes, and nmap-os-db.--servicedb or --versiondb may be used.Files not found in ddir, are searched for in
$NMAPDIR, then ~/.nmap, location of the Nmap executable and then a compiled-in location
such as /usr/local/share/nmap or /usr/share/nmap
Causes a fast scan ( |
--versiondb service probes file | (Specify custom service probes file) |
--send-eth | send raw ethernet Send data at link layeri rather then network layer. default, chooses the layer best for the platform it is on. See nmap.org |
--send-ip | Send at raw IP level rather than lower level ethernet frames. complement of --send-eth
|
--privileged | enough to perform raw socket sends, packet
sniffing which require root privileges on *nix . Must preceed flags requiring privileges $NMAP_PRIVILEGED set as an equivalent
|
--unprivileged | user lacks raw socket privileges, opposite of --privileged. $NMAP_UNPRIVILEGED set as an alternative
|
--release-memory | before quitting only useful for memory-leak debugging. |
--interactive | Start in interactive mode offers a prompt allowing launching multiple scans see nmap.org |
-V | output version number and exit.Nmap version 7.40 ( https://nmap.org ) Platform: x86_64-apple-darwin13.4.0 Compiled with: liblua-5.3.3 openssl-1.0.2j nmap-libpcre-7.6 nmap-libpcap-1.7.3 nmap-libdnet-1.12 ipv6 Compiled without: Available nsock engines: kqueue poll select |
-h | help summary page
Nmap 4.76 ( http://nmap.org )
Usage: nmap [Scan Type(s)] [Options] {target specification}
TARGET SPECIFICATION:
Can pass hostnames, IP addresses, networks, etc.
Ex: scanme.nmap.org, microsoft.com/24, 192.168.0.1; 10.0.0-255.1-254
-iL <inputfilename>: Input from list of hosts/networks
-iR <num hosts>: Choose random targets
--exclude <host1[,host2][,host3],...>: Exclude hosts/networks
--excludefile <exclude_file>: Exclude list from file
HOST DISCOVERY:
-sL: List Scan - simply list targets to scan
-sP: Ping Scan - go no further than determining if host is online
-PN: Treat all hosts as online -- skip host discovery
-PS/PA/PU [portlist]: TCP SYN/ACK or UDP discovery to given ports
-PE/PP/PM: ICMP echo, timestamp, and netmask request discovery probes
-PO [protocol list]: IP Protocol Ping
-n/-R: Never do DNS resolution/Always resolve [default: sometimes]
--dns-servers <serv1[,serv2],...>: Specify custom DNS servers
--system-dns: Use OS's DNS resolver
SCAN TECHNIQUES:
-sS/sT/sA/sW/sM: TCP SYN/Connect()/ACK/Window/Maimon scans
-sU: UDP Scan
-sN/sF/sX: TCP Null, FIN, and Xmas scans
--scanflags <flags>: Customize TCP scan flags
-sI <zombie host[:probeport]>: Idle scan
-sO: IP protocol scan
-b <FTP relay host>: FTP bounce scan
--traceroute: Trace hop path to each host
--reason: Display the reason a port is in a particular state
PORT SPECIFICATION AND SCAN ORDER:
-p <port ranges>: Only scan specified ports
Ex: -p22; -p1-65535; -p U:53,111,137,T:21-25,80,139,8080
-F: Fast mode - Scan fewer ports than the default scan
-r: Scan ports consecutively - don't randomize
--top-ports <number>: Scan <number> most common ports
--port-ratio <ratio>: Scan ports more common than <ratio>
SERVICE/VERSION DETECTION:
-sV: Probe open ports to determine service/version info
--version-intensity <level>: Set from 0 (light) to 9 (try all probes)
--version-light: Limit to most likely probes (intensity 2)
--version-all: Try every single probe (intensity 9)
--version-trace: Show detailed version scan activity (for debugging)
SCRIPT SCAN:
-sC: equivalent to --script=default
--script= |
v |
nmap -v scanme.nmap.org
sudo nmap -sS -O scanme.nmap.org/24
nmap -sV -p 22,53,110,143,4564 198.116.0-255.1-127
-PN (first sending a couple probes to determine whether a host is up is
time wasting when probing one port on each target host anyway.)
nmap -v -iR 100000 -PN -p 80- Scan 4096 IPs for web servers (without pinging ) and save the output in XML format.
nmap -PN -p80 -oX logs/pb-port80scan.xml -oG logs/pb-port80scan.gnmap 216.163.128.20/20