Build Nmap commands from checkboxes - scan type, ports, service and OS detection, NSE scripts, timing - and parse scan output into a readable host table.
This builder assembles a valid Nmap command from checkboxes and radio buttons — scan type, port selection, service and OS detection, NSE script categories, timing template, output options — and shows the resulting command line as you change each setting. A second tab parses Nmap output you paste back in, turning the raw text into a readable table of hosts, ports, states, services, and versions. Both run entirely in your browser: this tool writes and reads commands, it does not run them. Nothing is scanned from this page and no traffic is sent to any target.
Port scanning a host you do not own, and for which you do not hold written permission to test, may be unlawful — under the Computer Fraud and Abuse Act in the United States, the Computer Misuse Act in the United Kingdom, and equivalent legislation elsewhere. Independently of the law, unsolicited scanning is treated as hostile reconnaissance by essentially every monitoring team on the internet: it will be logged, it will generate alerts, and it can get your address blocked or your account terminated by your provider.
The audience for this tool is therefore specific. Network and systems administrators auditing their own estate — verifying that a firewall change took effect, finding the forgotten host still listening on 3389, confirming a decommissioned service really is gone, or building an inventory of what is actually exposed rather than what the documentation claims. Penetration testers and red teams working inside a signed scope, where the target ranges, the testing window, and the permitted techniques are agreed in writing before anything is run. Students and lab users scanning machines they own or a deliberately vulnerable target they have stood up themselves. If your situation is not one of those, get the authorisation first. “I was only looking” is not a defence anyone has to accept.
Enter a target — a single address, a hostname, or CIDR notation such as 10.0.0.0/24 — and choose from:
-sS), TCP connect (-sT), TCP ACK (-sA), UDP (-sU), and a combined TCP/UDP scan.--top-ports 100), all 65,535 (-p-), or a specific list or range (-p 22,80,443 or -p 1-1000).-sV), OS detection (-O), default scripts (-sC), or aggressive mode (-A) which enables all of those plus traceroute.-Pn for hosts that do not answer ICMP.http-title,ssl-cert.-v), state reasons (--reason), traceroute, and redirection of output to a file.Five presets — Quick Scan, Full TCP, Intense, Stealth (which simply lowers the timing template to T2) and Vuln Scan — set a sensible combination in one click as a starting point. Usefully, the builder also tells you when the command needs elevated privileges and why: SYN, UDP, and ACK scans, OS detection, aggressive mode, and traceroute all require raw packet access, so it prefixes sudo and lists the specific options that triggered it.
Scan types differ in how the TCP handshake is used. A connect scan (-sT) asks the operating system to complete a full three-way handshake through the normal socket API; it needs no special privileges and is the only option when you cannot elevate, but it is slower and the completed connection is recorded by any application logging inbound sessions. A SYN scan (-sS) sends the initial SYN itself and infers state from the reply — SYN/ACK means open, RST means closed, silence means filtered — without completing the handshake. It is faster and is the default choice when you have root. An ACK scan (-sA) does not determine whether ports are open at all; it distinguishes filtered from unfiltered, which makes it a firewall-rule mapping tool rather than a service discovery one. UDP scanning (-sU) is fundamentally slower and less certain because UDP has no handshake: an absent reply is ambiguous between open and filtered, and rate limiting on ICMP unreachable messages means an honest UDP sweep of a large range takes hours.
Service detection (-sV) connects to each open port and matches the banner and probe responses against Nmap’s signature database to name the product and version. This is the option that turns “443 is open” into “nginx 1.24.0”, and it is what makes a scan useful for patch verification. OS detection (-O) fingerprints the TCP/IP stack’s behaviour and returns a best guess with a confidence percentage — treat it as a hint, since middleboxes and virtualisation distort the signature. Aggressive mode (-A) is simply -sV -O -sC --traceroute together; it is thorough, noisy, and slow, and the builder disables the individual toggles when you select it because they are redundant.
Timing templates control probe parallelism and the delay between probes. T3 is the default. T4 is the common working choice on a healthy local network, and T5 pushes harder at the cost of accuracy — on a congested or lossy link, aggressive timing produces false negatives, because a port that never got a reply in time is reported closed or filtered when it was simply slow. T0 through T2 send probes far more slowly. The practical reason to use them is fragility rather than anything else: embedded devices, industrial controllers, printers, and old network appliances can be knocked over by a fast scan, and a polite template avoids saturating a slow WAN link or tripping a rate limit that would distort your own results.
NSE script categories extend the scan. discovery gathers additional host information, auth probes authentication-related conditions, malware checks for known backdoor indicators, and vuln tests for specific known vulnerabilities. The vuln category is materially more intrusive than a port scan: scripts interact with the service, and some can crash a fragile daemon. Confirm it is within scope before running it, and never run it against production during business hours without agreement.
The second tab takes normal Nmap console output — pasted, or loaded from a saved file — and extracts each host with its address, hostname, status, open ports with protocol, state, service, and version string, and any OS guess with its accuracy percentage. It is a reading aid for a long scan and a quick way to turn results into something you can drop into a report. Parsing happens locally; nothing you paste is transmitted. If you need machine-readable output for tooling instead, Nmap’s own -oX XML format is the better source.
No. It generates a command line for you to copy and run yourself, from your own machine, against a target you are authorised to test. No packets are sent from this page.
Scanning systems you own or have explicit written permission to test is legal and routine. Scanning anything else may be a criminal offence depending on your jurisdiction, and is treated as hostile reconnaissance regardless. Get authorisation in writing, in advance, with the target ranges and testing window stated.
SYN, UDP, and ACK scans, OS detection, aggressive mode, and traceroute all need raw socket access, which is privileged. The builder prefixes sudo automatically and lists which of your selections required it. A TCP connect scan (-sT) needs no elevation.
-sS and -sT?-sS sends a SYN and reads the reply without completing the handshake; it is faster but requires root. -sT completes a full connection through the OS socket API, needs no privileges, and is slower. Use -sT when you cannot elevate.
UDP has no handshake, so Nmap must wait out a timeout on every non-responding port, and operating systems rate-limit the ICMP unreachable messages that indicate a closed port. Restrict UDP scans to the specific ports you care about rather than sweeping the full range.
T3 (the default) or T4 on a healthy network you control. Drop to T2 or below when scanning fragile embedded devices or across a constrained WAN link, where a fast scan risks disrupting the device or producing false results. Avoid T5 unless accuracy genuinely does not matter.
Nmap got no useful reply, so it cannot tell whether the port is open. Something — a firewall, an ACL, or packet loss — dropped the probe. Contrast with “closed”, which means the host actively replied that nothing is listening.
Our port number reference lists the common service assignments, and the subnet calculator is useful for working out the exact CIDR range to put in the target field. Related tooling is listed under security tools.
Network scanning is the systematic probing of computer networks to discover hosts, services, and vulnerabilities. It is a fundamental practice in:
Nmap sends specially crafted packets to target hosts and analyzes the responses:
Authorized scanning only: Scanning networks without permission may violate computer crime laws including the Computer Fraud and Abuse Act (CFAA) in the US and similar laws internationally.
Get written authorization: Before any penetration test or security assessment, obtain explicit written permission defining scope, timing, and allowed techniques.
Nmap (Network Mapper) is a free, open-source network scanning tool used for network discovery, security auditing, and vulnerability assessment. It can identify live hosts on a network, discover open ports and running services, detect operating systems and software versions, and find security vulnerabilities. Nmap is widely used by security professionals, network administrators, and penetration testers for tasks like asset inventory, compliance scanning, and security assessments.
It depends on the scan type. TCP SYN scans (-sS), UDP scans (-sU), OS detection (-O), and many NSE scripts require root/administrator privileges because they need raw socket access. TCP Connect scans (-sT) can run without elevated privileges since they use standard system calls. Our command builder automatically indicates when sudo/admin access is required and explains why.
TCP SYN scan (-sS) sends a SYN packet and waits for a response without completing the three-way handshake, making it faster and harder to detect. TCP Connect scan (-sT) completes the full TCP handshake, which is slower and more likely to be logged but does not require root privileges. SYN scan is preferred for most security assessments when you have root access.
Scan duration varies significantly based on settings. A quick scan of the top 100 ports on a single host might take seconds, while scanning all 65,535 ports across a large subnet with service detection could take hours. Factors include: number of ports scanned, timing template (-T0 to -T5), service version detection (-sV), OS detection (-O), NSE scripts, and network latency. Use -T4 for faster scans on reliable networks.
Scanning your own networks is generally legal. However, scanning networks you do not own without explicit written permission may violate computer crime laws like the Computer Fraud and Abuse Act (CFAA) in the US. Always obtain authorization before scanning any network. Even authorized scanning should be coordinated with IT/security teams to avoid triggering alerts or causing service disruptions.
The -Pn flag tells Nmap to skip host discovery and treat all specified hosts as online. Use it when hosts are behind firewalls that block ping probes, you are scanning specific hosts you know are active, or ping discovery is giving false negatives. Without -Pn, Nmap first checks if hosts are alive before port scanning, which can miss hosts that block ICMP.
NSE (Nmap Scripting Engine) extends Nmap with Lua scripts for tasks like vulnerability detection, brute force testing, and service enumeration. Use --script with categories (vuln, auth, discovery) or specific script names (http-title, ssl-cert). The -sC flag runs default safe scripts. Examples: --script vuln for vulnerability scanning, --script http-enum for web directory enumeration.
T3 (Normal) is the default and suitable for most internal scans. T4 (Aggressive) works well for fast, reliable networks and is commonly used in penetration testing. T2 (Polite) reduces bandwidth impact for production networks. T0/T1 (Paranoid/Sneaky) are for evading intrusion detection systems but are extremely slow. T5 (Insane) may miss results due to packet loss.
Use NSE vulnerability scripts: --script vuln runs all vulnerability detection scripts, or target specific CVEs like --script smb-vuln-ms17-010 for EternalBlue. Combine with -sV for accurate service version detection. For web applications, use --script http-vuln-*. Always review script descriptions first as some scripts can crash vulnerable services.
Nmap supports multiple output formats: -oN (normal text), -oX (XML for tools like Metasploit), -oG (grepable for scripting), -oS (script kiddie format), and -oA (all formats at once with a base filename). XML output is best for importing into other security tools. Use -oA scan_results to create scan_results.nmap, scan_results.xml, and scan_results.gnmap files.