Nmap

Important — Why This Sheet Exists. Most people stop at nmap -sC -sV -oA scan <target>. That’s maybe 20% of what Nmap can actually do. This sheet covers the flags, workflows, and interactive tricks that rarely show up in beginner guides — the stuff that separates “ran a scan” from “understood the target and its defences.” Pairs with Awesome NMAP grep (post-processing greppable output) and the NSE Guide (script-level enumeration per port).

Live Runtime Control

Tip — Interactive Keys While a Scan Is Running. Nmap has a runtime keyboard interface — you don’t need --stats-every or a second terminal to check progress on a long -p- scan.

1. Press v — increase verbosity live, mid-scan
2. Press V — decrease verbosity
3. Press d — increase debug level live
4. Press D — decrease debug level
5. Press any other key (e.g. spacebar) — print an immediate status line: % complete, ETA, current probe

No flag needed — it works on any running scan in an interactive terminal. Combine with --stats-every 10s to also get automatic periodic updates without touching the keyboard.

nmap -p- -T4 --stats-every 15s 10.10.10.5
# Then just tap spacebar anytime to force an immediate progress line

Precision Timing — Beyond -T0–-T5

Important — -T Is a Preset, Not a Real Setting. -T0–-T5 are just bundles of the real underlying timing flags below. Most people never touch the real knobs — but that’s where actual control lives.

# Fast internal network, but don't crash the one flaky IoT device on it
sudo nmap -p- --min-rate 2000 --max-rate 5000 --host-timeout 5m 10.0.0.0/24

# Scanning over a slow VPN pivot — stop false "filtered" results from RTT timeouts
sudo nmap -sS --initial-rtt-timeout 500ms --max-rtt-timeout 4s -p 1-1000 172.16.5.10

Tip — The Rate-Limit Bypass Almost Nobody Uses. Many Linux hosts and firewalls rate-limit RST/ICMP unreachable responses — this makes closed/filtered ports look identical and skews your results without you realising it.

sudo nmap -sS --defeat-rst-ratelimit -p- 10.10.10.5
sudo nmap -sU --defeat-icmp-ratelimit --top-ports 200 10.10.10.5

1. --defeat-rst-ratelimit — ignores RST rate limiting for timing; some closed ports can be labelled filtered
2. --defeat-icmp-ratelimit — speeds UDP scans by sacrificing classification of nonresponsive services
3. With the UDP option, nonresponsive ports become closed|filtered; many real UDP services stay silent, so verify with a protocol-specific probe

Firewall & IDS Evasion

Danger — Authorisation Required. Every technique below changes how your traffic looks to defensive tooling. Only use these within signed RoE scope — evasion outside authorised engagements is a fast way to turn a pentest into a criminal case.

Non-Standard Scan Types (Exploit RFC 793 Gaps)

Warning — These Scan Types Need Root and Have Blind Spots.

1. All of -sN/-sF/-sX/-sM require raw socket access (root/sudo) and only work reliably against Unix-like TCP stacks per RFC 793 — Windows targets typically respond with RST to everything, making results useless there
2. These scans cannot distinguish “open” from “filtered” — silence means either. Confirm with a normal -sS or targeted service probe afterward

Packet Manipulation

# Fragment packets — splits the TCP header across multiple IP fragments
sudo nmap -f 10.10.10.5              # 8-byte fragments
sudo nmap -ff 10.10.10.5             # 16-byte fragments (double fragmentation)
sudo nmap --mtu 24 10.10.10.5        # custom fragment size (must be multiple of 8)

# Pad probes with junk data to break simple length-based IDS signatures
sudo nmap --data-length 25 -p 80,443 10.10.10.5

# Set a custom TTL to blend in with expected regional/hop-count profiles
sudo nmap --ttl 128 10.10.10.5

# Spoof or randomise your MAC address on local segments
sudo nmap --spoof-mac 00:11:22:33:44:55 -e eth0 10.10.10.5
sudo nmap --spoof-mac Apple -e eth0 10.10.10.5     # vendor-prefix randomisation
sudo nmap --spoof-mac 0 -e eth0 10.10.10.5         # fully random MAC

# Bad checksum probe — see how the firewall/IDS reacts to intentionally invalid packets
sudo nmap --badsum 10.10.10.5

Info — Command Breakdown.

1. -f / -ff / --mtu — fragmentation defeats older/simple IDS that fail to reassemble packets before signature matching; modern reassembly, host filtering and middleboxes can change the result; fragmentation is not a free or guaranteed bypass
2. --data-length — randomises payload size so probes don’t match a fixed-length scan signature
3. --spoof-mac — useful on internal segments where MAC-based NAC/allowlisting exists, or simply to avoid leaving your real NIC vendor fingerprint in switch logs
4. --badsum — a genuine target silently drops these; a host that does respond may indicate a security device doing packet processing in a naive way

Decoys and Source Manipulation

# Hide your real scan among decoy source IPs
sudo nmap -D RND:10 10.10.10.5
sudo nmap -D decoy1.com,decoy2.com,ME,decoy3.com 10.10.10.5

# Scan from a "trusted" source port — some legacy firewalls allow traffic FROM port 53/20/88
sudo nmap --source-port 53 -p- 10.10.10.5
sudo nmap -g 88 -p 1-1000 10.10.10.5

# Force a specific egress interface on a multi-homed attack box (common on pivots)
sudo nmap -e tun0 10.10.10.5

Warning — Decoys Are Weaker Than They Used to Be.

1. Modern IDS/SIEM correlates behaviour and timing patterns, not just source-IP counts — decoys mainly slow down manual log review now, not automated detection
2. Decoy IPs must actually be up and reachable, or the target’s SYN-ACKs to them generate RSTs that can reveal which “decoy” is fake
3. --source-port only works against firewalls with genuinely naive “allow if source port = X” rules — increasingly rare but still found on legacy/embedded gear

Idle (Zombie) Scanning

Important — How Idle Scan Actually Works. Idle scanning (-sI) spoofs your source IP as a third-party “zombie” host, then infers port state purely by watching the zombie’s IP ID sequence increment. The target only ever sees traffic from the zombie — never from you.

1. Find a zombie: an idle host with a predictable, incrementing global IPID sequence (old printers, embedded devices, unpatched legacy boxes are common candidates)
2. Nmap’s own ipidseq NSE script screens hosts for IPID predictability

# Step 1: Find a usable zombie on the network
nmap -p80 --script ipidseq 192.168.1.0/24

# Step 2: Run the idle scan through the identified zombie
sudo nmap -sI 192.168.1.50 -p- 10.10.10.5

Success — When This Is Worth the Setup Effort.

1. The target sees spoofed probes from the idle host; the technique does not guarantee anonymity across network monitoring
2. Useful for mapping firewall rules from a “trusted internal” vantage point without routing through it directly
3. Slow and fragile — busy or NAT’d zombies break the technique; treat it as a specialty tool, not a default workflow

Host Discovery Tricks Beyond a Basic Ping

Info — Custom Discovery Probes. Default -sn discovery uses several ICMP/TCP probes, or ARP/ND on local Ethernet; unprivileged discovery uses TCP connect probes. These flags let you build a discovery probe firewalls don’t expect:

# TCP SYN discovery to specific "probably open" ports instead of ICMP
sudo nmap -sn -PS22,80,443,3389 10.10.10.0/24

# TCP ACK discovery — some stateless firewalls pass ACK packets through
sudo nmap -sn -PA80,443 10.10.10.0/24

# UDP discovery probe (DNS/NTP/SNMP ports often get a response even when ICMP is dead)
sudo nmap -sn -PU53,161 10.10.10.0/24

# SCTP INIT discovery
sudo nmap -sn -PY 10.10.10.0/24

# ICMP variants beyond plain echo
sudo nmap -sn -PE -PP -PM 10.10.10.0/24    # echo, timestamp, netmask requests

# IP protocol ping — useful when ICMP/TCP/UDP are all filtered but other IP protocols aren't
sudo nmap -sn -PO 10.10.10.0/24

# Skip ARP ping on local segments (ARP is usually more reliable, but sometimes you want raw IP-layer behaviour)
sudo nmap -sn --disable-arp-ping 10.10.10.0/24

# Resolve names via a specific DNS server instead of the system resolver
nmap --dns-servers 8.8.8.8,1.1.1.1 -sn 10.10.10.0/24

# Pure target enumeration — resolves/lists targets without sending a single packet to them
nmap -sL 10.10.10.0/24

Tip — -sL Is a Free Sanity Check. Run -sL first on any new CIDR range before touching it with a real scan — it just does reverse-DNS/target-list resolution with zero packets sent to the targets themselves. Perfect for validating a scope file has no typos before you burn scan time on it.

Scan Resume, Diffing & Continuous Recon

Tip — Resume an Interrupted Scan. A -p- scan against a large range that gets killed (SSH drop, laptop sleep, Ctrl+C) doesn’t have to restart from zero:

nmap -p- -oA big_scan 10.0.0.0/16
# ...interrupted...
nmap --resume big_scan.nmap

Example — Diffing Scans Over Time With ndiff. ndiff ships with Nmap and compares two XML scan results — essential for continuous recon on long engagements or bug bounty monitoring.

nmap -oX scan_day1.xml 10.10.10.5
# ...next day...
nmap -oX scan_day2.xml 10.10.10.5
ndiff scan_day1.xml scan_day2.xml

1. Highlights newly opened/closed ports, changed service versions, new hosts appearing on a range
2. Run this on a cron job against in-scope external ranges during a multi-week engagement to catch new attack surface the moment it appears

HTML Reporting

nmap -oX scan.xml 10.10.10.5
xsltproc scan.xml -o scan_report.html

Info — Command Breakdown.

1. Nmap’s XML output ships with a built-in XSL stylesheet reference — xsltproc (or any XSLT processor) turns it into a clickable HTML report with zero extra tooling
2. Great for handing raw scan evidence to a non-technical stakeholder without teaching them to read .nmap text output

NSE Tricks Beyond --script=default,vuln

Info — Debugging and Extending NSE.

# See the raw NSE network traffic a script generates — invaluable when a script "hangs" or gives odd results
nmap --script-trace --script=http-enum -p80 10.10.10.5

# After adding/editing a custom .nse script, refresh Nmap's script database
nmap --script-updatedb

# Cross-reference every detected service version against a CVE database directly
nmap -sV --script=vulners 10.10.10.5

1. --script-trace — shows every packet sent/received by the NSE engine; the fastest way to debug “why is this script timing out”
2. vulners — turns plain version detection into an instant CVE list with CVSS scores; massively underused compared to the generic vuln category

Example — Scripts That Need NO Target At All. Several NSE scripts operate purely on broadcast/multicast traffic on your local segment — no IP argument required:

nmap --script broadcast-dhcp-discover
nmap --script broadcast-ping
nmap --script llmnr-resolve --script-args 'newtargets,llmnr-resolve.hostname=printer'

1. broadcast-dhcp-discover — requests a DHCP lease to reveal DHCP server, gateway, DNS, and lease policy, before you even have an IP configuration
2. broadcast-ping — finds live hosts via broadcast ping where individual host discovery is filtered
3. This category is a goldmine on internal engagements before you’ve even set a static IP

IPv6 and Protocol-Level Recon

Warning — IPv6 Is the Overlooked Attack Surface.

1. Enterprise firewalls and monitoring are frequently tuned only for IPv4 — the same host can have a wide-open IPv6 stack nobody is watching
2. Always test both stacks explicitly:

nmap -6 -sV fe80::1%eth0
nmap -6 -sV 2001:db8::1

3. -sO (IP protocol scan, shown above) is the easiest way to find GRE tunnels, IPsec (ESP/AH), OSPF — infrastructure most port-based scanning never reveals

Companion Tool: Nping

Info — Nping Overview. Ships with Nmap. Built for crafting arbitrary raw packets — useful when Nmap’s own flags don’t give enough control.

1. Custom TCP/UDP/ICMP/ARP packet crafting for testing specific firewall rules in isolation
2. Can run in --echo-client/--echo-server mode to test round-trip packet mangling across a path
3. Good for building a repeatable, minimal test case to hand to a network team (“this exact packet gets dropped here”)

# Craft a single custom TCP SYN packet to a specific port with custom flags/TTL
nping --tcp -p 443 --flags syn --ttl 64 -c 1 10.10.10.5

# ARP ping a local subnet (faster and more reliable than ICMP on local segments)
sudo nping --arp -c 1 10.10.10.0/24

Quick Reference — Flags Almost Nobody Uses

A staged scan you can interpret

mkdir -p evidence/nmap
# Expand a supplied IP list without reverse-DNS lookups or target probes
nmap -sL -n -iL in-scope-ips.txt
# First pass: one known lab host
nmap -sT -Pn -n --top-ports 1000 --reason \
  -oA evidence/nmap/initial 192.0.2.20
# Follow up only ports observed in the first pass
nmap -sT -Pn -n -sV -p22,80,443,445 --reason \
  -oA evidence/nmap/services 192.0.2.20

The follow-up port list is illustrative: replace it with actual results. -Pn skips discovery; it does not make an unreachable host reachable. -sT uses TCP connects and is appropriate for an unprivileged client or a compatible TCP pivot. A SYN scan and raw ICMP discovery are not transparently supported by every tunnel.

Interpret states before choosing another scan

Use --reason to see the response that drove the classification. A service label without -sV can be a port-number lookup; even a returned banner is not a confirmed vulnerable build.

UDP and NSE follow-up

sudo nmap -sU -Pn -n -sV -p53,123,161 --reason \
  -oA evidence/nmap/udp 192.0.2.20
nmap --script-help http-title,smb2-security-mode
nmap -sT -Pn -n -p80,443 --script http-title \
  -oA evidence/nmap/http 192.0.2.20

Read each NSE script’s documentation and arguments before selecting it. -sC means the default category; it is not a guarantee that every script is passive or appropriate to every application. UDP scan silence is often ambiguous. Confirm DNS with dig, and use a scoped service query for the other protocols.

Timing is a tradeoff, not a repair for every failure

Begin with normal adaptive timing. A high --min-rate can create loss and obscure services on a slow path. A low retry count or host timeout can leave a partial result. Record those constraints, and repeat only the ambiguous ports at a pace the path supports.

The rate-limit defeat options trade state accuracy for speed: they do not recover missing RST/ICMP responses. See the timing reference before using them. Default discovery already includes more than ICMP and uses ARP/ND on local Ethernet; see host discovery.

Use XML for reliable follow-up

-oA writes human, XML and grepable outputs. Retain XML for structured parsing and comparisons rather than scraping a terminal table. Track scan version, command, target list, source route, start/end times and any skipped hosts. The output reference explains file formats and resume limitations.

References

1. Nmap Reference Guide
2. Nmap — Idle Scan (-sI) Documentation
3. Nmap — Firewall/IDS Evasion and Spoofing
4. ndiff — Nmap Scan Comparison Tool
5. Nping Reference Guide
6. NSE Documentation Portal
7. Vulners NSE Script