# nmap

### Base Syntax

```bash
nmap {Targets} [ScanType] [Options]
```

### Target

<table id="bkmrk-purpose-example-1-ta"><thead><tr><th>Purpose</th><th>Example</th></tr></thead><tbody><tr><td>1 target</td><td><code>nmap IP</code></td></tr><tr><td>scan multiple targets</td><td><code>nmap IP1&#44; IP2&#44; IP3</code></td></tr><tr><td>scan a list</td><td><code>nmap &#45;iL list&#46;txt</code></td></tr><tr><td>scan CIDR range</td><td><code>nmap 192&#46;168&#46;1&#46;0&#47;24</code></td></tr></tbody></table>

### Ports

<table id="bkmrk-purpose-example-scan"><thead><tr><th>Purpose</th><th>Example</th></tr></thead><tbody><tr><td>Scan top 1k popular ports</td><td><code>nmap IP</code></td></tr><tr><td>Port range</td><td><code>nmap &#45;p x&#45;y</code></td></tr><tr><td>Port list</td><td><code>nmap &#45;p x&#44;y&#44;z</code></td></tr><tr><td>linear portrange</td><td><code>nmap &#45;r x&#45;y</code></td></tr></tbody></table>

### Probing

<table id="bkmrk-purpose-example-don%27"><thead><tr><th>Purpose</th><th>Example</th></tr></thead><tbody><tr><td>Don't probe</td><td><code>nmap IP &#45;Pn</code></td></tr><tr><td>Default probe</td><td><code>nmap IP &#45;PB</code></td></tr><tr><td>ICMP Echo Request</td><td><code>nmap IP &#45;PE</code></td></tr><tr><td>ICMP Timestamp Request</td><td><code>nmap IP &#45;PP</code></td></tr><tr><td>ICMP Network Request</td><td><code>nmap IP &#45;PM</code></td></tr></tbody></table>

### Scan Type

<table id="bkmrk-purpose-example-prob"><thead><tr><th>Purpose</th><th>Example</th></tr></thead><tbody><tr><td>Probe only</td><td><code>nmap IP &#45;sn</code></td></tr><tr><td>SYN Scan</td><td><code>nmap IP &#45;sS</code></td></tr><tr><td>TCP Connect Scan</td><td><code>nmap IP &#45;sT</code></td></tr><tr><td>UDP Scan</td><td><code>nmap IP &#45;su</code></td></tr><tr><td>Version scan</td><td><code>nmap IP &#45;sV</code></td></tr><tr><td>OS Detection</td><td><code>nmap IP &#45;PM</code></td></tr><tr><td>Set TCP flags</td><td><code>nmap IP &#45;&#45;scanflags&#58; x&#44;y&#44;z</code></td></tr></tbody></table>

### Timing Options

<table id="bkmrk-purpose-example-para"><thead><tr><th>Purpose</th><th>Example</th></tr></thead><tbody><tr><td>Paranoid</td><td><code>nmap IP &#45;T0</code></td></tr><tr><td>Sneaky</td><td><code>nmap IP &#45;T1</code></td></tr><tr><td>Polite</td><td><code>nmap IP &#45;T2</code></td></tr><tr><td>Normal</td><td><code>nmap IP &#45;T3</code></td></tr><tr><td>Aggressive</td><td><code>nmap IP &#45;T4</code></td></tr><tr><td>Insane</td><td><code>nmap IP &#45;T5</code></td></tr></tbody></table>

### Output Format

<table id="bkmrk-purpose-example-stan"><thead><tr><th>Purpose</th><th>Example</th></tr></thead><tbody><tr><td>Standard</td><td><code>nmap IP &#45;oN file&#46;txt</code></td></tr><tr><td>Greppable</td><td><code>nmap IP &#45;oG file&#46;txt</code></td></tr><tr><td>XML</td><td><code>nmap IP &#45;oX file&#46;txt</code></td></tr><tr><td>all formats</td><td><code>nmap IP &#45;oA file</code></td></tr></tbody></table>

### Misc Options

<table id="bkmrk-purpose-example-aggr"><thead><tr><th>Purpose</th><th>Example</th></tr></thead><tbody><tr><td>Aggresive scan</td><td><code>nmap IP &#45;A</code></td></tr><tr><td>nmap reason why a port is in a state</td><td><code>nmap IP &#45;&#45;reason</code></td></tr></tbody></table>