Nmap without fear: build the right scan

Nmap looks scary because its manual has 150+ options. But you don't scan by memorizing flags: you scan by making six decisions, and each flag is the answer to one of them. Learn the decisions and the rest falls into place.

The six decisions of every scan

1. Which hosts?

One, a range, a list or a whole network. And before scanning in depth, find out what's alive:

nmap 10.0.0.5                 # one host
nmap 10.0.0.0/24              # the whole subnet
nmap -iL targets.txt          # a list from a file
nmap -sn 10.0.0.0/24          # discovery only (ping sweep), no ports

2. Which ports?

By default Nmap checks the top 1000. Tune it by speed vs. thoroughness:

--top-ports 100    # the 100 most common (fast)
-p 80,443,8080     # a specific list
-p 1-1024          # a range
-p-                # ALL 65535 (complete, but slow)

3. How to probe the port?

• -sS (SYN scan): sends a SYN and never finishes the TCP handshake. Fast and a bit stealthier. Needs privileges (root).
• -sT (connect): opens the full connection. No root needed, but noisier and leaves more trace.
• -sU (UDP): for UDP services (DNS, SNMP, DHCP). Slow and full of open|filtered; bound it with --top-ports.

4. How much do you want to find out?

-sV        # service version (Apache 2.4.52, OpenSSH 8.9…)
-O         # operating system (by TCP/IP fingerprint)
-sC        # "default" NSE scripts (banners, safe useful info)
--script vuln   # vulnerability script category

The more you ask, the more noise you make. -sV and NSE leave traces in logs and IDS.

5. At what pace?

From -T0 (paranoid, glacially slow, to evade detection) to -T5 (insane, aggressive and may miss results). -T3 is the default; -T4 is a good balance on stable networks.

6. How to save it?

-oN scan.txt   # plain text
-oX scan.xml   # XML (for other tools)
-oG scan.gnmap # "grepable"
-oA scan       # all three at once  ← the one you want

Always save: repeating a scan costs time and makes more noise.

One command, decoded

nmap -sS -sV -p- -T4 -oA web01 10.0.0.5

• -sS → SYN scan (fast, needs root)
• -sV → identify service versions
• -p- → all 65535 ports
• -T4 → brisk pace
• -oA web01 → save in all three formats with prefix web01
• 10.0.0.5 → the target

-A: convenient, but noisy

-A is a shortcut that bundles -sV -O -sC --traceroute. Perfect for a CTF box where you want everything at once; terrible if you're trying to stay unnoticed, because it lights up every probe at the same time. If you use it, no need to add -sV/-O/-sC: they're already in.

Common traps

• -sS without root: Nmap silently falls back to -sT. If you expected stealth, you didn't get it.
• -sn discovers hosts but does not scan ports. It's the opposite of a port scan.
• -Pn: "assume they're up" and skip the ping. Useful when the target blocks ICMP but you believe something's there anyway.
• UDP is treacherous: slow and ambiguous (open|filtered). Don't fire -sU -p- lightly.

Active vs passive: where to start

Nmap is active recon: you touch the target and leave a trace. Before that comes passive recon (DNS, WHOIS, certificates), which never sends a packet to the target — I cover it in Passive domain reconnaissance. The sane sequence: passive first, and you escalate to active only with permission.

Checklist

• ✅ Discover live hosts (-sn) before scanning in depth.
• ✅ Choose ports deliberately: --top-ports to probe, -p- when it's warranted.
• ✅ -sS with root; otherwise you'll know you're on -sT.
• ✅ Ask only for what you need: -sV/NSE are noisy.
• ✅ Save with -oA always.
• ✅ Only scan what belongs to you or you're authorized in writing to test.

Nmap isn't a magic button: it's six questions. Answer them in order and the command writes itself.

Sergio Belmonte Morales
Cybersecurity Analyst · SOC · Sentinel/KQL specialist