# Nmap Cheat Sheet

## Scanning Options

<table><thead><tr><th width="236">Nmap Option</th><th>Description</th></tr></thead><tbody><tr><td><code>-sn</code></td><td>Disables port scanning</td></tr><tr><td><code>-Pn</code></td><td>Disables ICMP Echo requests</td></tr><tr><td><code>-n</code></td><td>Disabled DNS resolution</td></tr><tr><td><code>-PE</code></td><td>performs the pings scan by using ICMP echo requests</td></tr><tr><td><code>--packet-trace</code></td><td>shows all packets sent and received</td></tr><tr><td><code>--reason</code></td><td>display the reason for a specific result</td></tr><tr><td><code>--disable-arp-ping</code></td><td>disables ARP Ping request</td></tr><tr><td><code>--top-ports=&#x3C;int></code></td><td>scans the specified number of top ports</td></tr><tr><td><code>-p-</code></td><td>scan all ports</td></tr><tr><td><code>-p22-110</code></td><td>scan all ports between 22 and 110</td></tr><tr><td><code>-p22,110</code></td><td>scan only ports 22 and 110</td></tr><tr><td><code>-F</code></td><td>scan top 100 ports</td></tr><tr><td><code>-sS</code></td><td>perform TCP SYN-Scan</td></tr><tr><td><code>-sA</code></td><td>perform TCP ACK-Scan</td></tr><tr><td><code>-sU</code></td><td>perform UDP scan</td></tr><tr><td><code>-sV</code></td><td>scans the discovered services for their versions</td></tr><tr><td><code>-sC</code></td><td>perform a script scan with scripts that are categorized as "default"</td></tr><tr><td><code>--script &#x3C;script></code></td><td>performs a script scan by using the specified scripts</td></tr><tr><td><code>-O</code></td><td>perform an OS detection scan</td></tr><tr><td><code>-A</code></td><td>performs OS detection, service detection, and traceroute scans</td></tr><tr><td><code>-D RND:5</code></td><td>sets the number of random decoys that will be used to scan the target</td></tr><tr><td><code>-e</code></td><td>specifies the network interface that is used for the scan</td></tr><tr><td><code>-S 10.10.10.200</code></td><td>specifies the source IP address for the scan</td></tr><tr><td><code>-g</code></td><td>specifies the source port for the scan</td></tr><tr><td><code>--dns-server</code></td><td>DNS resolution is performed by using a specified name server</td></tr></tbody></table>

## Output Options

<table><thead><tr><th width="186">Nmap Option</th><th>Description</th></tr></thead><tbody><tr><td><code>-oA filename</code></td><td>Stores the results in all available formats starting with the name of "filename"</td></tr><tr><td><code>-oN filename</code></td><td>Stores the results in normal format with the name "filename"</td></tr><tr><td><code>-oG filename</code></td><td>Stores the results in "grepable" format with the name of "filename"</td></tr><tr><td><code>-oX filename</code></td><td>Stores the results in XML format with the name of "filename"</td></tr></tbody></table>

**Convert XML file to HTML:**

`xsltproc target.xml -o target.html`

## Performance Options

| Nmap Option                  | Description                                                 |
| ---------------------------- | ----------------------------------------------------------- |
| `--max-retries <num>`        | Sets the number of retries for scans of specific ports      |
| `--stats-every=5s`           | Displays scan's status every 5 seconds                      |
| `-v/-vv`                     | Displays verbose output during the scan                     |
| `--initial-rtt-timeout 50ms` | Sets the specified time value as initial RTT timeout        |
| `--max-rtt-timeout 100ms`    | Sets the specified time value as maximum RTT timeout        |
| `--min-rate 300`             | Sets the number of packets that will be sent simultaneously |
| `-T <0-5>`                   | Specifies the specific timing template                      |


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://notes.drngd0tter.red/cheat-sheets/nmap-cheat-sheet.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.