Reconnaissance and Enumeration · Topic 4 of 6

Nmap Scan Types and Options

Learn the Nmap options the PenTest+ exam expects: scan types, port selection, version and OS detection, scripts, timing and output, with correct syntax.

4 min

In a nutshell

-sS is SYN (half-open), -sT is connect, -sU is UDP, and -sn only finds live hosts.
-Pn skips host discovery, which helps when ICMP is blocked.
-p- scans all 65535 ports, and the default is only the 1000 most common.

What it is

Nmap (Network Mapper) is the standard open-source tool for host discovery, port scanning, service detection and light enumeration. It sends crafted packets and interprets the replies.

The exam expects you to read an Nmap command and say what it does, or to pick the right option for a goal. All examples here are for authorised, in-scope targets only.

How it works

Basic syntax

The general form is the command, then options, then the targets.

Linux shell:
nmap [options] <target>
nmap 192.0.2.10
nmap 192.0.2.0/24
nmap -iL targets.txt

A target can be a host name, an address, a range in Classless Inter-Domain Routing (CIDR) notation such as 192.0.2.0/24, or a list read from a file with -iL. The addresses here come from a range reserved for documentation.

Scan types

Option	Meaning
`-sS`	TCP SYN scan (half-open), the default when run with administrator rights
`-sT`	TCP connect scan, the default for a user without those rights
`-sU`	User Datagram Protocol (UDP) scan
`-sA`	Acknowledgement (ACK) scan, used to learn which ports a firewall filters, not which are open
`-sn`	Host discovery only, no port scan (a ping scan)
`-Pn`	Skip host discovery and treat every host as up

SYN means synchronise, and it is the first packet in the Transmission Control Protocol (TCP) handshake. A SYN scan never completes the connection, so applications often do not log it.

The -Pn option is useful when the target blocks ping (Internet Control Message Protocol, ICMP, echo requests). Without it, Nmap may decide that a live host is down and skip it.

Choosing ports

Option	Meaning
`-p 22,80,443`	Scan only the listed ports
`-p 1-1024`	Scan a range
`-p-`	Scan all 65535 ports
`-F`	Fast mode, fewer common ports
`--top-ports 100`	Scan the 100 most common ports

By default Nmap scans the 1000 most common ports, not every port. A service on an unusual port is missed unless the range is widened.

Detection options

Option	Meaning
`-sV`	Service and version detection
`-O`	Operating system (OS) detection
`-sC`	Run the default set of Nmap Scripting Engine (NSE) scripts
`-A`	Aggressive: combines version detection, OS detection, default scripts and traceroute
`--script <name>`	Run a chosen script or category

NSE scripts are small programs, grouped in categories such as default, safe, discovery, vuln and auth. Some categories are intrusive, so check the rules of engagement before running them.

Timing and noise

The -T option sets a timing template from -T0 (slowest) to -T5 (fastest). Slow templates reduce load and the chance of triggering alerts, while fast ones suit reliable local networks.

Faster is not always better. A scan that overwhelms a fragile device or loses packets gives wrong results.

Output formats

Option	Format
`-oN file`	Normal, human readable text
`-oX file`	Extensible Markup Language (XML), for importing into other tools
`-oG file`	Grepable, an older format
`-oA name`	All three at once, using the same base name

Saving output is part of good evidence handling, because it records what was scanned and when.

Reading the result

A typical line in the output looks like this.

PORT    STATE    SERVICE  VERSION
22/tcp  open     ssh      OpenSSH 8.9
80/tcp  filtered http
443/tcp closed   https

Here, Secure Shell (SSH) answered, port 80 gave no clear reply (probably a firewall), and port 443 actively refused. The version line comes from -sV and should be validated, because banners can be altered.

Exam tip

When a question asks for one command that finds services and versions on all ports and saves every format, think nmap -sV -p- -oA scan192 192.0.2.10.

What to remember for the exam

-sS is SYN (half-open), -sT is connect, -sU is UDP, and -sn only finds live hosts.
-Pn skips host discovery, which helps when ICMP is blocked.
-p- scans all 65535 ports, and the default is only the 1000 most common.
-sV finds service versions, -O guesses the OS, -sC runs default scripts, and -A combines them.
-T0 to -T5 set speed, from slowest to fastest.
-oN, -oX, -oG and -oA choose text, XML, grepable or all formats.
Port states include open, closed, filtered and open|filtered, and unfiltered with an ACK scan.
Scan types that need raw packets usually require administrator rights.

Common mistakes

Assuming the default scan covers all ports. It does not, so uncommon service ports can be missed.

Using -sU and expecting speed. UDP scans are slow, so limit them to key ports such as 53 and 161.

Reading -sA results as open ports. An ACK scan maps filtering rules, and it does not show which services are listening.

Running -A everywhere. It is noisy and includes scripts that may be intrusive, so it needs explicit approval in some environments.

Forgetting to save output. A scan not written to a file is hard to prove or repeat later.

Check yourself

Which option scans every TCP port?
-p-, which covers ports 1 to 65535.
What does -sn do?
It performs host discovery only and does not scan ports.
Which option saves results in normal, XML and grepable formats at once?
-oA.

Topic 4 of 6 in Reconnaissance and Enumeration

Test yourself on Reconnaissance and Enumeration

The full CompTIA PenTest+ PT0-003 question bank has 653 questions, with timed practice exams and an explanation for every answer.

Subscribe Try Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.