Nmap Cheat Sheet: Commands That Actually Work (Tested on a Live Host)

Hi folks! Most Nmap cheat sheets are a wall of flags copied from the man page, half of which you will never type. This one is different in a small but useful way: every command below was run against a live host before it went into the article, and where timing matters we measured it instead of guessing.

Bookmark it, skim the sections, steal the recipes at the end.

Table of Contents

• Specifying Targets
• Choosing Ports
• Scan Types
• Service and OS Detection
• Timing and Speed
• NSE Scripts
• Saving Output
• Understanding the Verdict
• Ten Recipes Worth Keeping
• Before You Scan Anything

Specifying Targets

nmap 203.0.113.10                 # single host
nmap example.com                  # hostname
nmap 203.0.113.0/24               # CIDR block
nmap 203.0.113.1-50               # range
nmap -iL targets.txt              # list from a file
nmap 203.0.113.0/24 --exclude 203.0.113.5,203.0.113.6
nmap 203.0.113.0/24 --excludefile skip.txt

Get in the habit of keeping an --excludefile around even for small jobs. It costs nothing and it is the one flag that prevents the mistake you cannot take back.

Choosing Ports

nmap -p80,443 host                # specific ports
nmap -p1-1000 host                # a range
nmap -p- host                     # all 65535
nmap -F host                      # fast: top 100
nmap --top-ports 20 host          # N most common
nmap -pU:53,161 host              # UDP ports
nmap -p80,443,U:53 host           # TCP and UDP together

One gotcha that costs people an evening: -F and -p cannot be combined. Nmap refuses with “You cannot use -F (fast scan) with -p (explicit port selection)” and quits. Pick one.

Default behaviour, in case you were wondering: with no port flags at all, Nmap checks 1000 common ports — not the first thousand, but the thousand most frequently found open.

Scan Types

-Pn deserves special mention: plenty of internet hosts drop ICMP, so without it Nmap decides the host is down and never scans a port. If a scan returns nothing at all, try -Pn before concluding anything.

# who is alive in this subnet? (no ports touched)
nmap -sn 203.0.113.0/24

Service and OS Detection

nmap -sV host                     # what software answers
nmap -O host                      # OS fingerprint
nmap -A host                      # -sV, -O, scripts and traceroute at once

These are the expensive flags, and it is worth seeing the numbers. On our test host a plain scan of the default 1000 ports finished in 0.41 s. The same host with -A on a single port took 19.3 s — roughly fifty times longer for one port instead of a thousand.

Also keep expectations calibrated on -O. Here is real output:

Aggressive OS guesses: Linux 5.0 - 5.4 (93%), Linux 4.15 - 5.8 (90%), ...
No exact OS matches for host (test conditions non-ideal).

Probabilities, not facts. Useful as a hint, not as evidence.

Timing and Speed

nmap -T0 host    # paranoid, evades IDS, glacial
nmap -T3 host    # default
nmap -T4 host    # commonly recommended
nmap -T5 host    # insane, drops accuracy

nmap --min-rate 5000 host         # packets per second floor
nmap --host-timeout 30s host      # give up on slow hosts
nmap --max-retries 1 host         # fewer retransmits

Now the part that contradicts most cheat sheets. We timed a full 65 535-port scan three ways against a responsive host:

-T4 changed nothing. Timing templates shorten waiting, and a host that answers every probe instantly gives you nothing to wait for. Against filtered targets and slow links -T4 genuinely helps — just do not expect it to be a universal speed button. The full breakdown is in our piece on scanning all 65 535 ports.

NSE Scripts

nmap -sC host                     # default script set
nmap --script=ssl-cert host       # one specific script
nmap --script=http-title,ssl-cert host
nmap --script "http-*" host       # wildcards work
nmap --script-help=ssl-cert       # what does this thing do

-sC against port 443 pulls the certificate out for you, which is genuinely handy for expiry checks:

| ssl-cert: Subject: commonName=app.scanitex.com
| Subject Alternative Name: DNS:app.scanitex.com, DNS:scanitex.com, DNS:www.scanitex.com
| Not valid before: 2026-07-26T10:07:53
|_Not valid after:  2026-10-24T10:07:52

A word of caution on script categories: vuln and exploit scripts do far more than look. They interact with the service and some of them attempt exploitation. That is a different legal and operational category from a port scan — run them only where you have explicit authorisation.

Saving Output

nmap -oN scan.txt host            # normal, human readable
nmap -oX scan.xml host            # XML for tooling
nmap -oG scan.gnmap host          # grepable, one line per host
nmap -oA scan host                # all three at once

-oA scan writes exactly three files — we checked: scan.nmap, scan.xml and scan.gnmap. Use it by default on anything long; re-running a scan because you forgot to save is a special kind of annoying.

Understanding the Verdict

nmap --reason host                # why Nmap decided that
nmap --open host                  # show only open ports
nmap -v host                      # progress while it runs

--reason is underrated. It turns a bare verdict into evidence:

22/tcp open   ssh     syn-ack ttl 58
25/tcp closed smtp    reset ttl 58

Port 22 answered with a SYN-ACK; port 25 was actively refused with a reset. A filtered port, by contrast, would show no reason at all — nothing came back. That distinction is the whole story when you are debugging a firewall.

Ten Recipes Worth Keeping

# 1. what is alive in the subnet
nmap -sn 203.0.113.0/24

# 2. quick look at one host
nmap -Pn -F 203.0.113.10

# 3. everything, saved properly
nmap -Pn -p- -oA fullscan 203.0.113.10

# 4. find open ports, then identify only those
nmap -Pn -p- --min-rate 5000 --open 203.0.113.10
nmap -Pn -p22,80,443 -sV 203.0.113.10

# 5. certificate expiry check
nmap -Pn -p443 --script=ssl-cert 203.0.113.10

# 6. the usual UDP suspects
nmap -Pn -sU --top-ports 20 203.0.113.10

# 7. web ports across a whole range
nmap -Pn -p80,443,8080,8443 --open 203.0.113.0/24

# 8. is this port reachable at all, with the reason
nmap -Pn -p3306 --reason 203.0.113.10

# 9. scan a list, skipping what must not be touched
nmap -Pn -iL targets.txt --excludefile skip.txt -oA audit

# 10. slow and quiet
nmap -Pn -T2 --max-retries 1 -p80,443 203.0.113.10

Recipe 4 is the one to internalise. Discovery and identification are separate stages precisely because -sV is expensive — running it against every port of every host is how a five-minute job becomes an overnight one.

Before You Scan Anything

Short and unglamorous, but it belongs on every cheat sheet:

• Your own hosts and ranges — scan freely.
• Someone else’s — only with written authorisation, inside the agreed scope.
• Bug bounty assets — inside the published scope, using the permitted techniques.
• NSE vuln/exploit scripts — authorisation only, they are not passive.

Checking whether a port answers is one thing; using what you found to get in is another act entirely, and computer crime law treats it that way nearly everywhere.

If you want to see the outside view of a host without installing anything, our online Nmap scanner runs these same scan types from our machines. And when one host stops being the job — whole ranges, repeatedly — that is what ScaniteX is built for. Happy scanning.