Handy nmap Recipes

List the hosts that would be scanned, without scanning:

nmap -sL (complicated host definition)

Traceroute only:

nmap -sn -Pn --traceroute HOST

Resume an interrupted scan (XML output works best):

sudo nmap --resume FILENAME

Convert nmap XML to HTML:

xsltproc nmap.xml -o nmap.html

Scan many hosts for one open port, show only hosts with it open, save greppable:

nmap -Pn -p port_number --open -oG port_numberscan_%D HOSTS

Mixed TCP and UDP ports:

sudo nmap -sS -sU -pT:21,23,U:53,111 HOST

Run all safe scripts on the top 100 ports, save all formats:

sudo nmap -sS -F -Pn --script safe -oA outfile_%D HOSTS

Fyodor’s Discoverer Supreme:

sudo nmap -sn -PE -PP -PS21,22,23,25,80,113,31339 -PA80,113,443,10042 -PU53,51234 --source-port 53 --data-length 32 HOSTS

Thorough scan, good for CTFs — all TCP ports, versions, OS, traceroute, default+vuln scripts, all formats:

nmap -e nic_name -sS -A -p0- --script "default or vuln" -oA seriousscan_%D HOSTS

Ghostscan — decoys, slow timing, random padding, randomized host order, random high source port, no ping, SYN scan, all formats:

sudo nmap -sS -Pn -T0 -g $(shuf -i 50000-65535 -n 1) --randomize-hosts --data-length $(($RANDOM%32+224)) -D decoy-ip1,decoy-ip2,decoy-ip3,decoy-ip4,decoy-ip5,decoy-ip6 -oA ghostscan_%D HOSTS