> For the complete documentation index, see [llms.txt](https://notes.drngd0tter.red/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.drngd0tter.red/cheat-sheets/nmap-cheat-sheet.md).

# Nmap Cheat Sheet

Quick Cheat Sheet for nmap

## Scanning Options

<table><thead><tr><th width="236">Nmap Option</th><th>Description</th></tr></thead><tbody><tr><td><code>-sn</code></td><td>Disables port scanning</td></tr><tr><td><code>-Pn</code></td><td>Disables ICMP Echo requests</td></tr><tr><td><code>-n</code></td><td>Disabled DNS resolution</td></tr><tr><td><code>-PE</code></td><td>performs the pings scan by using ICMP echo requests</td></tr><tr><td><code>--packet-trace</code></td><td>shows all packets sent and received</td></tr><tr><td><code>--reason</code></td><td>display the reason for a specific result</td></tr><tr><td><code>--disable-arp-ping</code></td><td>disables ARP Ping request</td></tr><tr><td><code>--top-ports=&#x3C;int></code></td><td>scans the specified number of top ports</td></tr><tr><td><code>-p-</code></td><td>scan all ports</td></tr><tr><td><code>-p22-110</code></td><td>scan all ports between 22 and 110</td></tr><tr><td><code>-p22,110</code></td><td>scan only ports 22 and 110</td></tr><tr><td><code>-F</code></td><td>scan top 100 ports</td></tr><tr><td><code>-sS</code></td><td>perform TCP SYN-Scan</td></tr><tr><td><code>-sA</code></td><td>perform TCP ACK-Scan</td></tr><tr><td><code>-sU</code></td><td>perform UDP scan</td></tr><tr><td><code>-sV</code></td><td>scans the discovered services for their versions</td></tr><tr><td><code>-sC</code></td><td>perform a script scan with scripts that are categorized as "default"</td></tr><tr><td><code>--script &#x3C;script></code></td><td>performs a script scan by using the specified scripts</td></tr><tr><td><code>-O</code></td><td>perform an OS detection scan</td></tr><tr><td><code>-A</code></td><td>performs OS detection, service detection, and traceroute scans</td></tr><tr><td><code>-D RND:5</code></td><td>sets the number of random decoys that will be used to scan the target</td></tr><tr><td><code>-e</code></td><td>specifies the network interface that is used for the scan</td></tr><tr><td><code>-S 10.10.10.200</code></td><td>specifies the source IP address for the scan</td></tr><tr><td><code>-g</code></td><td>specifies the source port for the scan</td></tr><tr><td><code>--dns-server</code></td><td>DNS resolution is performed by using a specified name server</td></tr></tbody></table>

## Output Options

<table><thead><tr><th width="186">Nmap Option</th><th>Description</th></tr></thead><tbody><tr><td><code>-oA filename</code></td><td>Stores the results in all available formats starting with the name of "filename"</td></tr><tr><td><code>-oN filename</code></td><td>Stores the results in normal format with the name "filename"</td></tr><tr><td><code>-oG filename</code></td><td>Stores the results in "grepable" format with the name of "filename"</td></tr><tr><td><code>-oX filename</code></td><td>Stores the results in XML format with the name of "filename"</td></tr></tbody></table>

**Convert XML file to HTML:**

`xsltproc target.xml -o target.html`

## Performance Options

| Nmap Option                  | Description                                                 |
| ---------------------------- | ----------------------------------------------------------- |
| `--max-retries <num>`        | Sets the number of retries for scans of specific ports      |
| `--stats-every=5s`           | Displays scan's status every 5 seconds                      |
| `-v/-vv`                     | Displays verbose output during the scan                     |
| `--initial-rtt-timeout 50ms` | Sets the specified time value as initial RTT timeout        |
| `--max-rtt-timeout 100ms`    | Sets the specified time value as maximum RTT timeout        |
| `--min-rate 300`             | Sets the number of packets that will be sent simultaneously |
| `-T <0-5>`                   | Specifies the specific timing template                      |