Scanning Options
| Option | What It Does | Example Command | 
|---|---|---|
| 10.10.10.0/24 | Specifies the target network range. | nmap 10.10.10.0/24 | 
| -sn | Skips port scanning. | nmap -sn 10.10.10.0/24 | 
| -Pn | Disables ICMP Echo Requests (no ping). | nmap -Pn 10.10.10.0/24 | 
| -n | Avoids DNS resolution. | nmap -n 10.10.10.0/24 | 
| -PE | Ping scan using ICMP Echo Requests. | nmap -PE 10.10.10.0/24 | 
| --packet-trace | Shows detailed packet sending/receiving logs. | nmap --packet-trace 10.10.10.0/24 | 
| --reason | Displays the reason for a result. | nmap --reason 10.10.10.0/24 | 
| --disable-arp-ping | Disables ARP Ping. | nmap --disable-arp-ping 10.10.10.0/24 | 
| --top-ports=<num> | Scans the most common ports. | nmap --top-ports=100 10.10.10.0/24 | 
| -p- | Scans all ports. | nmap -p- 10.10.10.0/24 | 
| -p22-110 | Scans ports between 22 and 110. | nmap -p22-110 10.10.10.0/24 | 
| -p22,25 | Scans only ports 22 and 25. | nmap -p22,25 10.10.10.0/24 | 
| -F | Scans top 100 most common ports. | nmap -F 10.10.10.0/24 | 
| -sS | Performs a TCP SYN scan. | nmap -sS 10.10.10.0/24 | 
| -sA | Conducts a TCP ACK scan. | nmap -sA 10.10.10.0/24 | 
| -sU | Runs a UDP scan. | nmap -sU 10.10.10.0/24 | 
| -sV | Scans service versions. | nmap -sV 10.10.10.0/24 | 
| -sC | Uses default scripts for scanning. | nmap -sC 10.10.10.0/24 | 
| --script <script> | Runs specified scripts during the scan. | nmap --script http-title 10.10.10.0/24 | 
| -O | Identifies the target’s operating system. | nmap -O 10.10.10.0/24 | 
| -A | OS, service, and traceroute detection. | nmap -A 10.10.10.0/24 | 
| -D RND:5 | Uses 5 random decoys for the scan. | nmap -D RND:5 10.10.10.0/24 | 
| -e | Specifies the network interface for scanning. | nmap -e eth0 10.10.10.0/24 | 
| -S 10.10.10.200 | Sets the source IP address. | nmap -S 10.10.10.200 10.10.10.0/24 | 
| -g | Specifies the source port. | nmap -g 80 10.10.10.0/24 | 
| --dns-server <ns> | Uses a custom DNS server for resolution. | nmap --dns-server 8.8.8.8 10.10.10.0/24 | 
Output Options
