nmap flags

Flags	Description
--disable-arp-ping	Disables ARP ping
--open
--packet-trace	Trace Packet
--spoof-mac	Spoof MAC Address	--spoof-mac 0 (Randomize MAC)
--top-ports
-A	Aggresive Mode	OS detection, version detection, script scanning, and traceroute.
-D	Decoy IP
-F	Fast Scan	Scans top 100 ports
-O	OS Detection
-PA	TCP ACK Ping Scan
-PE	Ping Echo Request	ping scan by using 'ICMP Echo requests' (for larger networks)
-PM	ICMP Address Mask Ping Scan
-PO	IP Protocol Ping Scan
-PP	ICMP Timestamp Ping Scan
-PR	ARP Request	for local network scans where ARP is supported
-PS	TCP SYN Ping
-Pn	disables host discovery	For escaping Windows Defender, -P0 in older versions, treat host as online
-S	Spoof Source IP Address
-T	Timing	1-5
-f	Fragmented Packets (fragscan)	split the IP packet into tiny fragment packets
-g	Source port	Source Port Manipulation
-iL		Read target IPs/ranges from the file hosts.lst.
-mtu	MTU
-n	Never do Domain/Name/System Resolution
-oA tnet		Output in all formats (normal, XML, and grepable) with base filename tnet.
-p	Ports 1-65535
-sA	Ack flag probe scan
-sC	Script Scan	Default scripts if no script is provided
-sF	FIN Scan
-sL	List Targets in range
-sM	TCP Maimon Scan
-sN	Null TCP Scan
-sR	??
-sS	Transmission Control Protocol SYN scan	Stealth Scan (Half Open Scan)
-sT	TCP nmap - Full-Open Scan Scan	Full TCP Scan (Full Open)
-sU	User Datagram Protocol Scan
-sV	Version Detection
-sX	Xmas Scan
-sY	SCTP Init Scan
-sZ	SCTP Cookie Scan
-sn	Disable Port Scanning
-v	Verbose Mode
-vvv	Increased verbosity level
--dns-servers
-sn	Skip port scan (only ping)

Nmap ("Network Mapper") is a versatile security scanner used for network exploration, host discovery, and service detection. It operates by sending specially crafted packets to a target host and analyzing the responses.

Nmap uses various command-line flags (options) to tailor scans for different objectives, such as evasion, speed, host discovery, or detailed reconnaissance.

Here is a comprehensive overview of key Nmap flags and options discussed in the sources:

I. General and Aggressive Scanning

Flag	Name	Function
`-A`	Aggressive Scan	Enables advanced and aggressive options, including OS detection (`-O`), version scanning (`-sV`), script scanning (`-sC`), and traceroute. Used for comprehensive scans.
`-v`	Increase Verbosity	Increases the verbosity level to provide more detailed output.
`-T<0-5>`	Timing Template	Sets the timing template (aggressiveness), where higher numbers are faster. T0 (paranoid) and T1 (sneaky) are specifically intended for IDS evasion. T4 (aggressive) is used for fast scans.

II. Host Discovery and Ping Sweeps (The `-sn` family)

Host discovery identifies systems that are "alive" or responding on the network. Nmap typically uses the -sn option (ping scan/ping sweep) to skip port scanning and focus only on host discovery.

Flag	Name	Function
`-sn`	Ping Scan	Disables port scanning and performs host discovery (ping sweep), treating the host as up only if a ping probe succeeds. This is sometimes synonymous with `-sP`.
`-Pn`	No Ping/Treat All Hosts Up	Disables host discovery and assumes all specified hosts are online. This is necessary when scanning networks that block ICMP traffic.
`-PS`	TCP SYN Ping	Sends an empty SYN packet to probe for active hosts (default destination port is 80).
`-PA`	TCP ACK Ping	Sends an empty ACK packet to probe for active hosts (default destination port is 80). Often used to bypass firewalls that only block SYN packets.
`-PE`	ICMP ECHO Ping	Uses standard ICMP echo requests for host discovery.
`-PP`	ICMP Timestamp Ping	Sends an ICMP timestamp query, effective when traditional ICMP ECHO pings are blocked.
`-PM`	ICMP Address Mask Ping	Sends an ICMP address mask query, also effective when ECHO pings are blocked.
`-PR`	ARP Ping Scan	Sends ARP packets for discovering active devices on the local IPv4 range, often effective even when restrictive firewalls are present.
`-PU`	UDP Ping Scan	Sends UDP packets to an uncommon port (default 40,125) for host discovery.
`-PO`	IP Protocol Ping	Sends packets across multiple IP protocols (ICMP, IGMP, IP-in-IP by default) to determine if a host is active.

III. Port Scanning Techniques

Port scanning identifies open ports and services. The techniques vary based on stealth and reliability:

TCP Scanning Methods

Flag	Name	Function
`-sS`	SYN Stealth Scan (Half-open)	The default and most popular scan type. It is considered stealthy because it abruptly resets the connection before the TCP three-way handshake completes, thus avoiding many logging mechanisms.
`-sT`	TCP Connect Scan (Full-Open)	Completes the full three-way handshake and then sends an RST packet to close the connection. It is easily detectable and is the default when the user lacks raw packet privileges.
`-sF`	FIN Scan	An Inverse TCP Flag Scan. Sends a packet with only the FIN flag set. Relies on RFC 793: closed ports respond with RST; open ports send no response.
`-sX`	Xmas Scan	An Inverse TCP Flag Scan. Sets the FIN, URG, and PSH flags ("lighting the packet up like a Christmas tree"). Open ports receive no response; closed ports send an RST.
`-sN`	NULL Scan	An Inverse TCP Flag Scan. Sends a packet with no TCP flags set (flag header is 0).
`-sA`	ACK Flag Probe Scan	Sends packets with only the ACK flag set. It never determines if a port is open. Its primary use is to map firewall rulesets and determine if ports are filtered or unfiltered.
`-sM`	Maimon Scan	Uses a FIN/ACK probe. If the port is closed, an RST packet is returned; if open, the packet is often silently dropped (effective mostly against BSD systems).

Other Protocol Scanning Methods

Flag	Name	Function
`-sU`	UDP Scan	Used to check services running over UDP (e.g., DNS, SNMP). If a closed port is probed, the host usually returns an `ICMP_PORT_UNREACH` error.
`-sY`	SCTP INIT Scan	SCTP equivalent of the TCP SYN scan, used for services like VoIP and IP telephony.
`-sZ`	SCTP COOKIE ECHO Scan	An advanced SCTP scan where an open port silently drops the packet, and a closed port sends an ABORT chunk.

IV. Service, Version, and OS Detection

These flags enable detailed reconnaissance and fingerprinting:

Flag	Name	Function
`-sV`	Service/Version Detection	Interrogates open ports to determine the service protocol, application name, and accurate version number. This is critical for determining which exploits a system is vulnerable to.
`-O`	OS Detection	Used to perform OS discovery and determine the operating system running on the target machine.
`-sC`	Script Scanning	Activates the running of default Nmap Scripting Engine (NSE) scripts.
`--script`	Specific Script Execution	Allows the user to specify custom or non-default NSE scripts (e.g., `--script nbstat.nse` for NetBIOS enumeration, or `--script=smb-enum-shares` for SMB share enumeration).

V. Target Specification and Scope

Flag	Name	Function
`-p`	Port Specification	Specifies the ports to scan (e.g., `-p 21,80` or `-p1-65535` to scan all ports).
`-F`	Fast (Limited Port) Scan	Reduces the number of ports scanned from the default 1,000 to 100. Used to expedite the scan.
`-iL <file>`	Input List	Specifies an input file containing a list of target IP addresses or hostnames to scan.
`-6`	IPv6 Scanning	Enables scanning for IPv6 networks.
`-r`	Do Not Randomize Ports	Instructs Nmap to scan ports in numerical order instead of the default random order.

VI. Evasion and Spoofing Techniques

These flags help conceal the attacker's true identity or bypass filtering devices:

Flag	Name	Function
`-sI <Zombie>`	IDLE/IPID Header Scan	Performs complete blind scanning by impersonating an idle "zombie" host via IP spoofing, relying on IPID tracking.
`-D`	Decoy Scanning	Cloaks the scan by generating (`RND:10`) or manually specifying IP addresses of decoys. Makes it difficult for IDSs/firewalls to determine the true source IP address.
`-f`	Fragment Packets	Causes the requested scan to use tiny fragmented IP packets, splitting the TCP header over several packets to evade packet filters and IDSs.
`-g` / `--source-port`	Source Port Manipulation	Manipulates the source port (e.g., setting it to port 80) to bypass firewalls configured to allow traffic only from well-known ports.
`--spoof-mac`	MAC Address Spoofing	Sets a specific MAC address (or generates a random one using `0`) for the packets to evade firewalls using MAC filtering rules.
`--badsum`	Bad Checksums	Instructs Nmap to send packets with invalid TCP, UDP, or SCTP checksums to bypass improperly configured systems/IDSS that fail to verify the checksum.

VII. Output and Reporting

Flag	Name	Function
`-oN <file>`	Normal Output	Saves the scan results in a normal, human-readable format.
`-oX <file>`	XML Output	Requests that output be directed to the given filename in XML format.
`-oG <file>`	Grepable Output	Outputs the scan results in a simple format that can be easily processed by Unix tools like `grep` or `awk`.
`-oA <prefix>`	All Output Formats	Saves the scan results in three major formats (normal, XML, and greppable) using the specified prefix.