Nmap Cheat Sheet: Commands, Flags and an OSCP Scanning Workflow

The short answer

An Nmap cheat sheet comes down to a handful of commands: -sn to find live hosts, -p- to scan every TCP port, -sV -sC to identify what's listening, -sU --top-ports for UDP, and -oA to save every scan. Add -Pn when a host drops ping probes and Nmap reports it as down. The table below lists them, and the sections after it explain each flag.

For OSCP^® students, the order matters as much as the flags: a fast scan of all TCP ports, then a version and script scan on only the open ones, then the top UDP ports. That order finds services outside Nmap's default 1,000 ports, and saved output gives your notes and report the exact commands and results they need.

Only scan hosts you own, hosts you have written permission to test, and lab machines you're given. The Nmap project's page on legal issues advises getting written authorization before any scan, and this sheet sticks to discovery and enumeration.

We're Hacker Blueprint. Our instructor holds the OSCP, our academy has more than 600 students, and around 7,000 people have claimed our prep materials.

Our video "Own Active Directory on EVERY Exam (Complete Methodology)" starts its AD methodology with Nmap: Initial Nmap Scanning begins at 1:04, then Enumeration Methodology at 3:39 and SMB Enumeration at 8:39. It runs 1 hour 50 minutes.

Nmap cheat sheet: the commands you'll use most

SYN scans, UDP scans and OS detection need root, so most commands here start with sudo. Swap TARGET for an IP you're allowed to scan, and 192.0.2.0/24 for your own range.

Nmap on the OSCP exam: what OffSec allows

OffSec's exam guide for the OSCP+^™ exam bans spoofing, commercial tools, automatic exploitation tools, mass vulnerability scanners like Nessus and OpenVAS, and AI chatbots. Then it says: "You may however, use tools such as Nmap (and its scripting engine), Nikto, Burp Free, DirBuster etc. against any of your target systems."

The guide also makes you "ultimately responsible for knowing what features or external utilities any chosen tool is using," so check what a script does with --script-help before you run it. Our guide to OSCP allowed tools covers the rest of the rules.

Two more points shape how you scan. The exam "simulates a live network in a private VPN" that you join from Kali with OpenVPN. And OffSec's AD preparation article says to "Avoid heavy scans on multiple targets" and to re-run scans, because "Scans can be inaccurate."

What nmap -Pn does and when you need it

Before it scans ports, Nmap checks which targets are up. As root, it sends an ICMP echo request, a TCP SYN to port 443, a TCP ACK to port 80 and an ICMP timestamp request. Without root it tries TCP connections to ports 80 and 443, and on local Ethernet it uses ARP. If nothing answers, Nmap skips the host and prints:

Note: Host seems down. If it is really up, but blocking our ping probes, try -Pn

-Pn skips host discovery and treats every target as up. That's the fix when a firewall drops the probes, which is common on Windows targets: Microsoft's archived guidance for Windows 7 and Windows Server 2008 says that by default, Windows Firewall does not allow incoming ICMP echo messages.

The cost is time. With -Pn on a range, Nmap port-scans every address, including empty ones (the Reference Guide's example is a /16, all 65,536 addresses). Use -sn to find live hosts across a range and -Pn on single targets you know exist. If a -Pn scan returns only filtered ports, check your VPN connection before you blame the target.

sudo nmap -sn 192.0.2.0/24
sudo nmap -Pn -p- TARGET

Nmap scan types: SYN, connect and UDP

-sS, the SYN scan, is the default when you run Nmap as root. It never completes the TCP handshake, which is why the Reference Guide calls it half-open scanning, and it's fast.

-sT, the connect scan, is what Nmap uses without root. It asks the operating system to make full connections, which the guide describes as less efficient and more likely to be logged by the target. Run plain nmap TARGET without sudo and you get this scan. Ask for -sS or -sU without root and Nmap stops with "You requested a scan type which requires root privileges."

-sU scans UDP, and works best as its own step, as the UDP section explains.

How to scan all ports with Nmap

By default, Nmap scans the 1,000 most common ports for each protocol you scan, ranked by how often they're found open in its nmap-services file. That list covers the usual services and still misses plenty. In the current nmap-services file, the ports listed for Redis (6379), MongoDB (27017), Active Directory Web Services (9389) and Windows Remote Management (47001) all sit outside the default 1,000. So does any web app someone moved to an unusual high port.

-p- scans ports 1 to 65535 (port 0 only if you name it). On a lab or exam target, run it every time. Here are the other ways to choose ports:

The last one needs a UDP scan and a TCP scan type in the same command, for example -sU -sS.

Nmap service version detection and NSE scripts

Without version detection, the SERVICE column is a lookup: the service that usually runs on that port number. The Reference Guide says that guess is usually accurate and warns you not to bet your security on it. -sV probes each open port and matches the replies against a database, which gives you a product and often a version. Intensity runs from 0 to 9 (default 7), and --version-all tries every probe on a stubborn port. If Nmap still can't name a service, it prints a fingerprint you can submit if you know what's running.

-sC runs the Nmap Scripting Engine's default category, the same as --script=default. The guide notes that some default scripts are considered intrusive, so run them only against hosts you're authorized to scan. --script also takes script names, categories and expressions such as "default or safe". NSE also has categories such as vuln, exploit, brute, dos and intrusive; this sheet sticks to discovery and enumeration.

sudo nmap -sV -sC -p 22,80,445 TARGET
nmap -p 445 --script smb-os-discovery,smb2-security-mode TARGET
nmap -p 80,443 --script http-title TARGET
nmap -p 389 --script ldap-rootdse TARGET
nmap --script-help smb-os-discovery

All four named scripts sit in NSE's safe and discovery categories, according to their NSEDoc pages.

-O guesses the operating system from how the target's TCP/IP stack answers. It needs root and works best with at least one open and one closed TCP port. -A turns on OS detection, version detection, default scripts and traceroute at once: handy against one host, slow across many, and only for hosts you're authorized to scan.

Nmap UDP scan: slow, and still worth running

UDP has no handshake. Open UDP ports often stay silent, and closed ports reply with ICMP port unreachable messages that many hosts rate-limit. At a Linux-style limit of one per second, the Reference Guide says, a 65,536-port UDP scan takes more than 18 hours, so UDP scans stick to the top ports.

A port that never replies shows as open|filtered, because Nmap can't tell a silent service from a dropped probe. Adding -sV sends service-specific probes, which settles many of those ports as open or closed.

The guide names DNS (53), SNMP (161/162) and DHCP (67/68) as three of the most common UDP services, and says some security auditors ignore UDP ports, which it calls a mistake. In the current nmap-services file, the top 20 UDP ports also include NTP (123), TFTP (69), NetBIOS (137 and 138) and IKE (500), and the top 100 reach NFS (2049) and Kerberos (88). OffSec's PEN-200 learning plan gives TCP/UDP port scanning theory and SNMP enumeration their own topics.

sudo nmap -sU --top-ports 100 -oA scans/udp-top100 TARGET
sudo nmap -sU -sV -p 161 --script snmp-sysdescr TARGET

snmp-sysdescr is a safe discovery script that asks SNMP for system information.

Nmap timing and speed: -T4, --min-rate and VPN links

The Reference Guide recommends -T4 "when scanning reasonably modern and reliable networks." It tightens timeouts and caps retries at 6 (the default is 10). -T5 cuts retries to 2 and adds a 15-minute host timeout, trading accuracy for speed.

--min-rate sets a floor in packets per second; the guide's example, --min-rate 300, keeps Nmap at or above 300. It also warns that a minimum rate "should be done with care": scanning faster than the network can support costs accuracy and can even make the scan take longer.

That warning matters most over a VPN, where the tunnel adds latency and a busy link can drop packets. Lost probes mean open ports that show up as filtered or get missed. Watch for Nmap's warning that it is "giving up on port because retransmission cap hit," which means some probes went unanswered. On an exam or lab VPN, use -T4, keep --min-rate modest if you use it, and run your full-port scan twice before you trust it.

For long scans, press Enter for a status line with an estimated finish time, or add --stats-every 30s.

Nmap output to file: save every scan

-oA scans/tcp-all writes tcp-all.nmap, tcp-all.xml and tcp-all.gnmap in one go. The Reference Guide calls grepable output deprecated and points people to XML, but it's still handy for one-liners like the port extraction in the workflow below. Every saved file records the Nmap version, the start time and the exact command you ran, so each one shows how it was made.

--append-output adds to an existing file instead of overwriting it, and --resume restarts a cancelled scan from its normal or grepable output file. Keep one folder per target and name files after what they hold, such as tcp-all, tcp-detail and udp-top100.

How to read Nmap results

Each line of the port table gives the port and protocol, its state, the service name and, with -sV, the product and version. Lines that start with | under a port are NSE script output, and the "Not shown" line counts the ports Nmap left out of the table. This excerpt comes from the example scan in the Nmap Reference Guide:

Not shown: 995 closed ports
PORT     STATE    SERVICE     VERSION
22/tcp   open     ssh         OpenSSH 5.3p1 Debian 3ubuntu7 (protocol 2.0)
80/tcp   open     http        Apache httpd 2.2.14 ((Ubuntu))
|_http-title: Go ahead and ScanMe!
646/tcp  filtered ldp
1720/tcp filtered H.323/Q.931
9929/tcp open     nping-echo  Nping echo

The state column decides what you do next:

The combined states, open|filtered and closed|filtered, mean Nmap couldn't decide between the two, and the first is common in UDP scans. Closed ports still help: they show the host is up and give OS detection something to work with. --reason shows why each port got its state, -v prints open ports as Nmap finds them, and --open shows only open (or possibly open) ports.

Then work through each open port: what's running, which version, and what the script output already tells you. Reading a scan this way is one of the basics in our OSCP+ roadmap, and our video The Brutally Honest OSCP Quiz works through an Active Directory scenario that starts from a port scan (Nmap analysis at 0:14).

An exam-style Nmap workflow

OffSec's AD preparation article suggests starting with light scans, "E.g., scan for ten common ports on your exam machines," and interacting with what you find "while waiting for thorough and longer scans." The workflow below builds on that, one target at a time:

mkdir -p scans
sudo nmap --top-ports 10 -oA scans/quick TARGET
sudo nmap -p- -T4 -v -oA scans/tcp-all TARGET
ports=$(grep -oE '[0-9]+/open/' scans/tcp-all.gnmap | cut -d/ -f1 | paste -sd, -)
sudo nmap -p "$ports" -sV -sC -oA scans/tcp-detail TARGET
sudo nmap -sU --top-ports 100 -oA scans/udp-top100 TARGET

1. The quick scan gives you something to look at within seconds.
2. The full TCP scan skips versions and scripts, so you get the complete port list sooner. Meanwhile, look at what the quick scan found.
3. The ports= line turns the open ports in the grepable file into a comma-separated list, and the detail scan runs -sV -sC on just those. You can rerun it later without repeating the full sweep.
4. The UDP scan runs last, or in a second terminal while you work through the TCP results.
5. Re-run the full TCP scan once before you decide a target is empty. OffSec's article also says to "Use various tools to verify scan outputs."

On an Active Directory set, OffSec's article lists identifying each machine's role as an early step. Microsoft's port reference puts Kerberos on 88 and LDAP on 389, so a host with both open is usually a domain controller. Our OSCP Active Directory guide covers what comes next.

For what comes after the scan, our My Pentesting Methodology playlist shows how we take a machine from open ports to initial access and privilege escalation.

Nmap mistakes that cost OSCP students points

1. Stopping at the default 1,000 ports. A service on an unusual port never shows up. Run -p- on every target.
2. Skipping UDP. SNMP, TFTP and other UDP services only appear when you scan for them. Run at least the top 100 UDP ports.
3. Scanning too fast over the VPN. A high --min-rate or -T5 on a busy tunnel drops probes and misses ports. Use -T4 and confirm with a second scan.
4. Trusting a single scan. OffSec's own advice says scans can be inaccurate, and our free course for OSCP prep says to rescan every host at least twice because lab environments can be unstable.
5. Leaving output in the terminal. OffSec's article notes that ongoing documentation saves you from rerunning commands when you need the outputs again. Use -oA every time.
6. Never scanning again after new access. OffSec's article says to enumerate again with each new level of access, and skipped re-enumeration is among the most common Active Directory failure reasons we see.

From scan output to your notes and report

The exam guide says you "must document all of your attacks including all steps, commands issued, and console output" so a technically competent reader can replicate them. Your scans are the first entries in that record.

• Keep each target's scans folder next to that target's notes page.
• Paste the tcp-detail output into the notes, then write one line per open port: what it is, what you checked and what you ruled out.
• Record the UDP results too, including ports that stayed open|filtered.
• When a port leads to access, mark the scan that found it, since that's the evidence the report needs.

Our OSCP note-taking guide shows how to structure those pages, and our OSCP report template guide shows where the open ports, scan command and output go in the report. OffSec's AD preparation article also suggests terminal loggers "to automatically log all commands and outputs in your shell," a backup for any scan you forgot to save.

FAQ

What does -Pn do in Nmap?

-Pn tells Nmap to skip host discovery and treat every target as up. Use it when a host drops ping probes and Nmap reports "Host seems down" even though you know it's there. On large ranges it slows scans down, because Nmap port-scans every address.

How do I scan all ports with Nmap?

Use -p-, which scans TCP ports 1 to 65535, for example sudo nmap -p- -T4 -oA scans/tcp-all TARGET. Without it, Nmap scans only the 1,000 most common ports for each protocol.

Is Nmap allowed on the OSCP exam?

Yes. OffSec's exam guide says you may use "tools such as Nmap (and its scripting engine)" against your target systems. You stay responsible for knowing what features any tool uses, and spoofing, mass vulnerability scanners and automatic exploitation tools are banned.

Why is my Nmap UDP scan so slow?

Open UDP ports often don't reply, and closed ports answer with ICMP messages that many hosts rate-limit, so Nmap has to wait and retry. Scan the top ports with --top-ports 100 instead of all 65,535.

How do I save Nmap output to a file?

Use -oN for normal output, -oX for XML, -oG for grepable output, or -oA name to write all three at once. -oA is the safest habit, since each file also records the exact command you ran.

Which Nmap flags matter most for the OSCP?

-p- for every TCP port, -sV -sC on the open ports, -sU --top-ports 100 for UDP, -Pn for hosts that ignore pings, -T4 for speed and -oA to save every scan.

Practice the workflow on a lab you're allowed to scan

Pick a target you have permission to scan, run the whole workflow, and save every file into a notes folder. Our free OSCP-style Active Directory chains give you machines built for practice, and our guide to OSCP-like machines points to more.

One of our students, pixelpie, wrote: "I'm now gotten to the level where I'm actually going for the OSCP and this has been of great help so far. Great courses, but also very kind and helpful people." (More reviews)

Try our 30+ hour course for OSCP prep with a free trial, or start with one of our free Active Directory chains.

Stuck on a scan result? Ask in the Hacker Blueprint Discord.

Sources

• Nmap Reference Guide (example scan output, port table columns)
• Nmap: Host Discovery (default discovery probes, ARP on local Ethernet, -Pn, -sn)
• Nmap: Port Scanning Basics (the six port states, why closed ports help)
• Nmap: Port Scanning Techniques (SYN, connect and UDP scans, root requirements, UDP speed, common UDP services)
• Nmap: Port Specification and Scan Order (default 1,000 ports, -p-, -F, --top-ports, protocol prefixes)
• Nmap: Service and Version Detection (-sV, intensity levels, nmap-services lookup, fingerprint submission)
• Nmap: Nmap Scripting Engine (-sC, --script, --script-help, script categories, intrusive default scripts)
• Nmap: OS Detection (-O and the open plus closed port requirement)
• Nmap: Timing and Performance (-T0 to -T5, the -T4 recommendation, --min-rate, retries)
• Nmap: Output (-oN, -oX, -oG, -oA, -v, --reason, --open, --append-output, --resume)
• Nmap: Miscellaneous Options (what -A enables)
• Nmap: Runtime Interaction (status messages during a scan)
• Nmap: Legal Issues (written authorization before scanning)
• NSEDoc: smb-os-discovery, smb2-security-mode, http-title, ldap-rootdse and snmp-sysdescr (script categories and usage)
• Nmap on GitHub: nmap-services (port frequencies behind the top 1,000 TCP and top 100 UDP lists; checked Nov 3, 2026)
• Nmap on GitHub: nmap.cc, NmapOps.cc and scan_engine.cc (the "Host seems down" note, the command line saved in output files, the root privileges message, the retransmission cap warning)
• OffSec: OSCP+ Exam Guide (allowed and banned tools, private VPN over OpenVPN, documentation rules; updated Oct 21, 2026)
• OffSec: OSCP+ Exam with AD Preparation (light scans first, avoid heavy scans, re-run scans, verify with other tools, re-enumerate, machine roles, terminal loggers)
• OffSec: PEN-200 Learning Plan, 12 weeks (port scanning and SNMP enumeration topics)
• Microsoft: Nobody Can Ping My Computer (archived Windows 7 and Server 2008 guidance on ICMP echo and Windows Firewall)
• Microsoft: Service overview and network port requirements for Windows (Kerberos on 88, LDAP on 389)
• Hacker Blueprint: Own Active Directory on EVERY Exam (Complete Methodology) (YouTube, Mar 22, 2026)
• Hacker Blueprint: The Brutally Honest OSCP Quiz (YouTube, Feb 24, 2026)
• Hacker Blueprint: Full OSCP Course (EVERYTHING You Need!) (YouTube, May 6, 2025)