nmap essential

Scan IP
nmap 192.168.1.1

Scan network
nmap 192.168.1.0/24

Fast scan
nmap -F 192.168.1.1

Scan machines up
nmap -sP 192.168.1.0/24

Read hosts for a file (one IP or name per line)
nmap -iL /tmp/test.txt

detect remote services (server / daemon) version numbers
nmap -sV 192.168.1.1

Turn on OS and version detection
nmap -v -A 192.168.1.254
nmap -A -iL /tmp/test.txt

Find out if a host/network is protected by a firewall
nmap -sA 192.168.1.254

Scan a host when protected by the firewall
nmap -PN 192.168.1.1

Scan TCP port 80
nmap -p T:80 192.168.1.1

Scan UDP port 53
nmap -p U:53 192.168.1.1

Scan two ports
nmap -p 80,443 192.168.1.1

Scan a host using TCP ACK (PA) and TCP Syn (PS) ping
nmap -PS 192.168.1.1
nmap -PS 21,80,443 192.168.1.1
nmap -PA 192.168.1.1

Scan a host using IP protocol ping
nmap -PO 192.168.1.1

Display the reason a port is in a particular state
nmap --reason 192.168.1.1

Only show open (or possibly open) ports
nmap --open 192.168.1.1

Show all packets sent and received
nmap --packet-trace 192.168.1.1
nmap --packet-trace server1.cyberciti.biz

Scan a host using UDP ping
nmap -PU 192.168.1.1

Stealthy scan
nmap -sS 192.168.1.1

TCP scan
nmap -sT 192.168.1.1

Find out the most commonly used TCP ports using TCP ACK scan
nmap -sA 192.168.1.1

Cloak a scan with decoys
nmap -n -Ddecoy-ip1,decoy-ip2,your-own-ip,decoy-ip3,decoy-ip4 remote-host-ip
nmap -n -D192.168.1.5,10.5.1.2,172.1.2.4,3.4.2.1 192.168.1.5


How do I save output to a text file?
nmap 192.168.1.1 > output.txt
nmap -oN /path/to/filename 192.168.1.1
nmap -oN output.txt 192.168.1.1

Get IP with nmap

Get only IP

nmap -sP -oG - 10.20.110.0/24 | awk '/Host/{print $2}'

Get IP and hostname

nmap -sP -oG - 10.20.200.0/22 | awk '/Host/{print $2 " " substr($3,2,length($3) - 2)}'

nmap advanced

discover all IPs connected in our network, use lan ip of default gateway
nmap -sP $( ip route | grep '^default' | egrep -o '([0-9]{1,3}\.){3}' )0/24 | awk '/^Nmap.*[0-9]$/{print $NF}' | sort -n -t . -k 4

get information from hosts through windows sharing
nmap -script smb-os-discovery -p 445 -open 192.168.0.0/24

show hosts with port 631 open
nmap 192.168.0.0/24 -p 631 -open | awk '/)$/ {print $NF}'

Limits two simultaneous connections on port 80 to each host connected to the network
nmap -sP 192.168.0.0/24 | egrep -o '([0-9]{1,3}\.){3}[0-9]{1,3}' | sort -n -t . -k 4 | xargs -I% iptables -A INPUT -s % -p tcp --dport 80 -m connlimit --connlimit-above 2 -j DROP

Order ip adress with sort

order ip adress with sort

nmap -sP 192.168.0.0/24; arp -a | sort -n -t . -k 4

Get all mac address

get all mac address and ip from network order by ip

nmap -sP 192.168.0.0/24; arp -a | sort -n -t . -k 4 | awk '{print "mac:", $4, "#"$2}'