nmap [scan type(s)] [options]

Target Specification

Method	Example
hostname	fslc.usu.edu
IP	192.168.0.24
	192.168.3.23,25,27
wildcard	192.168.*.*
range	192.168.0.21-25
mask	192.168.0.0/24,example.com/28
	/24 is equivalent to a netmask of 255.255.255.0, /16 is netmask 255.255.0.0, /17 is 255.255.128.0, etc. range from 0 (whole internet) to 32 (single host)
mixed examples	192.168.*.23-50,*.*.5.2-7

Scan Types

-s[STFPVUOAWRL]

Option	Effect
-sS	Syn scan, default for root
-sT	TCP connect() scan, default for non-root
-s[FXN]	FIN, Xmas Tree, Null scans
-sP	Ping scan, useful to check if hosts are up (ICMP)
-sV	Version detection, attempt to detect what version of servers found
-sU	UDP scan
-sO	IP scan, check for supported protocols
-sA	ACK scan
-sW	Window scan
-sR	RPC scan
-sL	List scan, prints a list of IP addresses/hostnames without pinging/portscanning (DNS)

Ping Options

-P[0ASUEPM]

Option	Effect
-P0	do not attempt to ping first, useful when target(s) block pings
-PA	[portlist] Use TCP ACK 'ping' to specified ports (instead of ICMP)
-PS	[portlist] same as above using SYN packets
-PU	[portlist] same as above using UDP
-PE	True ping (ICMP echo request)
-PP	ICMP timestamp request (type 13)
-PM	ICMP netmask request (type 17)

More Options

Option	Effect
-O	OS identification, attempt to determine what OS is running
-F	fast scan mode
-A	same as -sV -O
-6	enable IPv6 (who wants it?)
-f	with -s[SFXN], use fragmented IP packets
-v	verbose, tell what is going on -- very useful/informative
-d	increment debug level, tell what is going on. ex. 'nmap -d -d -d hostname' or 'nmap -d3 hostname'
-h	help

Use nmapfe for a gui interface to nmap(you will need nmap installed).

man nmap for for information.

2005-02-25T16:44:24