Common Nmap Parameters

The following table lists frequently used Nmap parameters along with their descriptions in an academic context.

Parameter	Description
`-sT`	TCP connect() scan. This method records a large number of connection requests and error messages in the target host’s logs.
`-sS`	Half-open scan. Few systems log this activity; however, root privileges are required.
`-sF`, `-sN`	Stealth FIN packet scan, Xmas Tree scan, and Null scan modes.
`-sP`	Ping scan. Nmap employs a ping scan by default when scanning ports; only if the host is alive will Nmap continue scanning.
`-sU`	UDP scan. UDP scans are inherently unreliable.
`-sA`	This advanced scanning method is typically used to traverse firewall rule sets.
`-sV`	Probe port service versions.
`-Pn`	Ping is not required prior to scanning. Some firewalls block ping commands; this option can be used to bypass that restriction.
`-v`	Display the scanning process. Recommended for verbose output.
`-h`	Help option. Provides the clearest and most comprehensive help documentation.
`-p`	Specify ports, for example: `1-65535`, `1433`, `135`, `22`, `80`, etc.
`-O`	Enable remote operating system detection. False positives may occur.
`-A`	Comprehensive system detection, enabling script detection and advanced scanning.
`-oN` / `-oX` / `-oG`	Write the report to a file in three respective formats: normal, XML, and grepable.
`-T4`	For TCP ports, disable dynamic scan delays exceeding 10 ms.
`-iL`	Read a list of hosts from a file, for example: `-iL C:\ip.txt`.

Practical Examples

Scan open ports on a specified IP address:

nmap -sS -p 1-65535 -v XXX.XXX.XXX.XXX
Scan live hosts in a /24 subnet:

nmap -sP XXX.XXX.XXX.XXX/24
Scan specific ports:

nmap -p 80,1433,22,1521 XXX.XXX.XXX.XXX
Detect the host operating system:

nmap -O XXX.XXX.XXX.XXX
Comprehensive system detection:

nmap -v -A XXX.XXX.XXX.XXX

Note: By default, Nmap scans 1,000 high-risk ports.
Scan a specified IP range:

nmap XXX.XXX.XXX.XXX-XXX
Penetrate a firewall for scanning (when ping is blocked):

nmap -Pn -A XXX.XXX.XXX.XXX
Use a script to scan web‑sensitive directories:

nmap -p 80 --script=http-enum.nse XXX.XXX.XXX.XXX