nmaping
Scan a single IP:
bash
nmap 192.168.1.1
Scan a range of IPs:
bash
nmap 192.168.1.1-20
Scan an entire subnet:
bash
nmap 192.168.1.0/24
Scan multiple IPs or subnets:
bash
nmap 192.168.1.1,192.168.1.5,192.168.2.0/24
Port Scanning
Scan specific ports:
bash
nmap -p 22,80,443 192.168.1.1
Scan a range of ports:
bash
nmap -p 1-1000 192.168.1.1
Scan all 65535 ports:
bash
nmap -p- 192.168.1.1
Scan top 1000 ports (default):
bash
nmap 192.168.1.1
Service and Version Detection
Detect services and versions:
bash
nmap -sV 192.168.1.1
Aggressive scan (includes OS detection, service detection, and more):
bash
nmap -A 192.168.1.1
OS Detection
Detect the operating system:
bash
nmap -O 192.168.1.1
Scan Types
TCP Connect Scan (default scan):
bash
nmap -sT 192.168.1.1
SYN Scan (stealth scan):
bash
nmap -sS 192.168.1.1
UDP Scan:
bash
nmap -sU 192.168.1.1
Ping Scan (discover hosts without port scanning):
bash
nmap -sn 192.168.1.0/24
Output Options
Save output to a file:
bash
nmap -oN output.txt 192.168.1.1
Save output in XML format:
bash
nmap -oX output.xml 192.168.1.1
Save output in a grepable format:
bash
nmap -oG output.grep 192.168.1.1
Timing and Performance
Adjust timing template (0-5, where 5 is the fastest):
bash
nmap -T4 192.168.1.1
Miscellaneous
Avoid DNS resolution:
bash
nmap -n 192.168.1.1
Disable reverse DNS resolution:
bash
nmap -n 192.168.1.1
Use a specific interface:
bash
nmap -e eth0 192.168.1.1