information on supported IP protocols rather than listening ports.
guesses, device types, and MAC addresses.
Discovery and Security Scanning (see http://nmap.org/book/).
is to specify a target IP address or hostname for scanning.
just the named host or IP address because all address bits are fixed.
be omitted; the default values are 0 on the left and 255 on the right.
useful for Internet surveys and research.
192.168.0.0/8 10.0.0,1,3-7.- does what you would expect.
-iL inputfilename (Input from list) .
pass that filename to Nmap as an argument to the -iL option.
command line (IP address, hostname, CIDR, IPv6, or octet ranges).
Nmap to read hosts from standard input rather than an actual file.
-iR num hosts (Choose random targets) .
skipped. The argument 0 can be specified for a never-ending scan.
rainy afternoon, try the command nmap -Pn -sS -p 80 -iR 0 --open.
to locate random web servers for browsing.
--exclude host1[,host2[,...]] (Exclude hosts/networks) .
to port scans, or subnets administered by other people.
--excludefile exclude_file (Exclude list from file) .
tab-delimited exclude_file rather than on the command line.
address is actually active (is being used by a host or network device).
can find those machines in a sparsely allocated sea of IP addresses.
of discovery probes is recommended for security auditing.
because it is almost always faster and more effective.
further to prevent scanning the wrong company's network.
functionality, read up on the -Pn (skip ping) option.
and only print out the available hosts that responded to the scan.
every single IP and host name.
hosts do not reply to broadcast queries.
In previous releases of Nmap, -sn was known as -sP..
specified on the command line, all 65,536 IP addresses are scanned.
previous versions of Nmap, -Pn was -P0.  and -PN..
-PS port list (TCP SYN Ping) .
multiple probes are specified they will be sent in parallel.
complete the three-way-handshake and establish a full connection.
host is available and responsive.
-PA port list (TCP ACK Ping) .
The TCP ACK ping is quite similar to the just-discussed SYN ping.
actually sending a SYN packet rather than an ACK.
cases, the ACK probe shines as it cuts right through these rules.
probes by specifying -PS and -PA.
-PU port list (UDP Ping) .
disable payloads by specifying --data-length 0.
often undesirable for this particular scan type.
and thus disclose to Nmap that the machine is available.
-PY port list (SCTP INIT Ping) .
This option sends an SCTP packet containing a minimal INIT chunk.
-p except that port type specifiers like S: are not allowed.
specified they will be sent in parallel.
INIT-ACK, not by Nmap itself.
currently not possible for unprivileged users..
-PE; -PP; -PM (ICMP Ping Types) .
used for the same purpose.
-PO protocol list (IP Protocol Ping) .
compile-time by changing DEFAULT_PROTO_PROBE_PORT_SPEC.  in nmap.h.
additional data beyond the IP header (unless the --data-length.
requests against unavailable hosts in a short time period.
--disable-arp-ping (No ARP or ND Ping) .
behavior, use the --disable-arp-ping option.
--traceroute (Trace path to host) .
with a high TTL and then decrements the TTL until it reaches zero.
have to send two packets to most hosts.
parallel stub resolver, this option can slash scanning times.
-R (DNS resolution for all targets) .
--system-dns (Use system DNS resolver) .
resolver is always used for IPv6 scans.
from your resolv.conf file (Unix) or the Registry (Win32).
be bounced off just about any recursive DNS server on the Internet.
This option also comes in handy when scanning private networks.
--dns-servers until you find one which works.
or protect them with firewalls without thwarting legitimate users.
show services available for use on the network.
This slows down the scan dramatically.
is closed or filtered. It is only used for the IP ID idle scan.
thousands of dollars for it.
discussed in the individual scan type entries.
connect and FTP bounce scans.
-sS (TCP SYN scan) .
per second on a fast network not hampered by restrictive firewalls.
-sT (TCP connect scan) .
information on each connection attempt.
system should know that she has been connect scanned.
3, codes 1, 2, 9, 10, or 13) mark the port as filtered.
unreachable messages to one per second (in net/ipv4/icmp.c).
behind the firewall, and using --host-timeout to skip slow hosts.
-sY (SCTP INIT scan) .
between the open, closed, and filtered states.
unreachable error (type 3, code 1, 2, 3, 9, 10, or 13) is received.
-sN; -sF; -sX (TCP NULL, FIN, and Xmas scans) .
error (type 3, code 1, 2, 3, 9, 10, or 13) is received.
filtered ones, leaving you with the response open|filtered.
-sA (TCP ACK scan) .
not and which ports are filtered.
2, 3, 9, 10, or 13), are labeled filtered.
-sW (TCP Window scan) .
course, it is possible that the machine really has no open ports.
-sM (TCP Maimon scan) .
--scanflags (Custom TCP scan) .
creative juices flow, while evading intrusion detection systems.
instead. If you don't specify a base type, SYN scan is used.
-sZ (SCTP COOKIE ECHO scan) .
you with the state open|filtered in both cases.
-sI zombie host[:probeport] (idle scan) .
-sO (IP protocol scan) .
close enough to a port scan that it belongs here.
-b FTP relay host (FTP bounce scan) .
access to other internal hosts than any old Internet host would.
the default FTP port (21) on server is used.
not appreciate you abusing their servers in this way.
common 1,000 ports for each protocol.
-p port ranges (Only scan specified ports) .
the protocol numbers you wish to scan for (0-255).
expansions and quote the argument to -p if unsure.
the argument to -p if unsure.
-F (Fast (limited port) scan) .
Specifies that you wish to scan fewer ports than the default.
protocol. With -F, this is reduced to 100.
nmap-services file, Nmap scans all named ports plus ports 1-1024.
-r (Don't randomize ports) .
one given.  ratio must be between 0.0 and 1.1.
must be 1 or greater.
and do run services on strange ports..
to. Version detection helps you obtain this information.
wrappers). Decoys do not currently work with RPC scan..
can use -A, which enables version detection among other things.
these options are always combined.
--allports (Don't exclude any ports from version detection) .
of pages of HTTP GET requests, binary SSL session requests, etc.
scan all ports regardless of any Exclude directive.
--version-intensity intensity (Set version scan intensity) .
longer. The intensity must be between 0 and 9..  The default is 7..
--version-light (Enable light mode) .
--version-all (Try every single probe) .
probe is attempted against each port.
--version-trace (Trace version scan activity) .
(rlogin, firewall filters, etc) or for hiding the source of an attack.
joke". This is only reported in normal output in verbose (-v) mode.
overflowing and wrapping around, so it is printed only in verbose mode.
detection is available at http://nmap.org/book/osdetect.html.
-O (Enable OS detection) .
use -A to enable OS detection along with other things.
--osscan-limit (Limit OS detection to promising targets) .
--osscan-guess; --fuzzy (Guess OS detection results) .
miss out on retries which could potentially identify the OS.
detection. NSE can even be used for vulnerability exploitation.
carefully audited the scripts yourself.
brute force authentication crackers, and denial of service attacks.
~/.nmap (not searched on Windows).
scripts from script.db by name, you can use a shell-style `*' wildcard.
to protect the wildcard from the shell.
contain space characters it is necessary to quote them.
for those whose names start with http-.
lists the arguments that each script accepts.
since they are not parsed by the shell.
format. Specifying --packet-trace enables script tracing too.
option is generally used by itself: nmap --script-updatedb.
but adds up when you are scanning hundreds or thousands of hosts.
care about while meeting their time constraints.
also make a substantial difference. Those options are listed below.
arguments 900000ms, 900, 900s, and 15m all do the same thing.
come quickly and then increases the groupsize to as high as 1024.
size within a specific range, though this is rarely desired.
--scan-delay option, discussed later, is another way to do this.
time (Adjust probe timeouts) .
timing out and retransmitting while the response is in transit.
100 ms, no matter what the ping times are. Nor do I exceed 1000 ms.
should be reported as a bug to the nmap-dev mailing list..
occasional missed ports and hosts are acceptable.
The default (with no -T template) is to allow ten retransmissions.
--host-timeout time (Give up on slow target hosts) .
are printed for that host.
be wasteful. A --scan-delay of 1s will keep Nmap at that slow rate.
already know what rate works best.
detection and prevention systems (IDS/IPS)..
try to keep the sending rate at or above 300 packets per second.
together to keep the rate inside a certain range.
scans. Other features like OS detection implement their own timing.
sent and Nmap is waiting for them to time out or be responded to.
rate will stay at or below the maximum.
packets are sent at a higher rate, more packets are sent overall.
you need to set an upper limit on total scan time.
ICMP error messages (such as port-unreachable errors) they send.
closed and filtered ports isn't worth the extra time.
platform. Use nmap -V to see which engines are supported.
assumption that you are on a reasonably fast and reliable network.
fast network or are willing to sacrifice some accuracy for speed.
those extra minor optimizations that it enables.
well as setting the maximum TCP scan delay to 5 ms.
content that passes over them.
reconnaissance is often a key goal of implementing the devices.
complex networks, and to verify that filters are working as intended.
It even supports mechanisms for bypassing poorly implemented defenses.
through one of your own proxies.
administrators would find it that much harder to do their jobs.
options and describes what they do.
-f (fragment packets); --mtu (using the specified MTU) .
segmentation faulted immediately upon receiving the first fragment.
defragment outgoing packets in the kernel. Linux with the iptables.
-D decoy1[,decoy2][,ME][,...] (Cloak a scan with decoys) .
RND:number to generate number addresses.
the decoy networks don't see you in their nameserver logs).
-S IP_Address (Spoof source address) .
the IP you are spoofing), so Nmap won't produce useful reports.
-e interface (Use specified interface) .
--source-port portnumber; -g portnumber (Spoof source port number) .
to the client to transfer the requested file.
application-level proxies or protocol-parsing firewall modules.
source port 53 (DNS) or 67 (DHCP).
OS detection tests to work properly.
--data-length number (Append random data to sent packets) .
(Send packets with specified ip options) .
determining and manipulating the network route to target machines.
different route with the strict or loose source routing options.
string containing 36 NUL bytes.
Nmap also offers a shortcut mechanism for specifying options.
Simply pass the letter R, T, or U to request record-route,.
IP options with Nmap, see http://seclists.org/nmap-dev/2006/q3/52.
--ttl value (Set IP time-to-live field) .
--randomize-hosts (Randomize target host order) .
list to Nmap with -iL..
--spoof-mac MAC address, prefix, or vendor name (Spoof MAC address) .
detection or the Nmap Scripting Engine.
--badsum (Send packets with bogus TCP/UDP checksums) .
implementations, it may be preferable to use Adler32.
mode for humans to read directly and XML for easy parsing by software.
for controlling the verbosity of output as well as debugging messages.
user interfaces, or imported into databases.
sCRiPt KiDDi3 0utPUt.  for users who consider themselves |<-r4d.
still be printed to the normal error stream, stderr..
output files named G- and Xscan.xml respectively.
will use an XML file with a name in the form of scan-144840-121307.xml.
-oN filespec (normal output) .
discussed above, this differs slightly from interactive output.
-oX filespec (XML output) .
XML files that render as HTML on any web-connected machine.
-oS filespec (ScRipT KIdd|3 oUTpuT) .
output for lack of a place to put them.
six labeled fields, separated by tabs and followed with a colon.
Index, IP ID, and Status.
-oA basename (Output to all formats) .
-v (Increase verbosity level) .
-d (Increase debugging level) .
scan with very few ports and targets.
--reason (Host and port state reasons) .
RST packet from a closed port or an echo reply from an alive host.
even if this option is not specified.
--stats-every time (Print periodic timing stats) .
--packet-trace (Trace packets and data sent and received) .
Causes Nmap to print a summary of every packet sent or received.
--open (Show only open (or possibly open) ports) .
Perl, but this feature was added due to overwhelming requests.
counts if there are an overwhelming number of them.
--iflist (List interfaces and routes) .
Prints the interface list and system routes as detected by Nmap.
--append-output (Append to rather than clobber output files) .
generally won't parse properly until you fix it up by hand.
--resume filename (Resume aborted scan) .
into one valid XML file would be difficult.
--stylesheet path or URL (Set XSL stylesheet to transform XML output) .
argument to --stylesheet. You must pass the full pathname or URL.
--webxml (Load stylesheet from Nmap.Org) .
--no-stylesheet (Omit XSL stylesheet declaration from XML) .
that don't really fit anywhere else.
-6 (Enable IPv6 scanning) .
the --unprivileged.	option in other situations.
-A (Aggressive scan options) .
options without people having to remember a large set of flags.
--datadir directoryname (Specify custom Nmap data file location) .
--servicedb services file (Specify custom services file) .
--datadir for more information on Nmap's data files.
--versiondb service probes file (Specify custom service probes file) .
--send-eth (Use raw ethernet sending) .
the one which is generally best for the platform it is running on.
--send-ip (Send at raw IP level) .
--privileged (Assume that the user is fully privileged) .
quits if such operations are requested but geteuid is not zero.
set as an equivalent alternative to --privileged.
--unprivileged (Assume that the user lacks raw socket privileges) .
the user as lacking network raw socket and sniffing privileges.
--release-memory (Release memory before quitting) .
the OS does this anyway upon process termination.
-V; --version (Print version number) .
-h; --help (Print help summary page) .
Prints a short help screen with the most common command flags.
Running Nmap without any arguments does the same thing.
you to interact with the program without aborting and restarting it.
and may complain. Getting permission first is the best approach.
. The -v option enables verbose mode.
when you are only probing one port on each target host anyway.
saves the output in grepable and XML formats.
Official Nmap Project Guide to Network Discovery and Security Scanning.
(recommended) or to Fyodor directly.
with Nmap and also available from http://nmap.org/changelog.html.
installer, such as those produced by InstallShield.
but you are not obligated to do so.
alternative license agreement takes precedence over these comments.
right to know exactly what a program is going to do before they run it.
have been found so far).
<dev@nmap.org> for possible incorporation into the main distribution.
conditions of your contributions, just say so when you send them.
damage or problems Nmap could cause.
even a light scan of a network.
version of Nmap utilized the Libpcap-derived WinPcap library.
library,.  which is open-source software, written by Philip Hazel..
redistributable under BSD-style software licenses.
Code and the DARPA CINDER program (DARPA-BAA-10-84).