Nmap command builder
Build a correct nmap command without memorising the flags. Choose a scan type, ports, timing, and detection options — the command updates live, with every flag explained in plain English. It runs in your browser and only generates the command; it never scans anything itself.
nmap -sS -T4 192.168.1.0/24
What each flag does
- -sS — TCP SYN ("half-open") scan — fast and stealthy; the default when run as root.
- -T4 — Timing template 4 — higher is faster but noisier (0 = paranoid, 5 = insane).
- 192.168.1.0/24 — The host, hostname, IP range, or CIDR block to scan.
Authorised use only. Only scan systems you own or have explicit written permission to test. In the UK, unauthorised scanning can breach the Computer Misuse Act 1990. This builder generates a command; it does not run it.
Nmap questions, answered
What is nmap used for?
Nmap (Network Mapper) is a free, open-source tool for discovering hosts and services on a network. Security teams use it to map what is exposed, find open ports, identify running services and versions, and fingerprint operating systems as part of reconnaissance.
What is the difference between a SYN scan and a connect scan?
A SYN scan (-sS) sends a SYN packet and never completes the TCP handshake, which is faster and quieter but needs raw-socket (root) privileges. A connect scan (-sT) completes the full handshake using the operating system, so it works without privileges but is slower and more visible in logs.
Do I need to run nmap as root?
Some options need elevated privileges. SYN scan (-sS), OS detection (-O), and UDP scan (-sU) generally require root or Administrator. A plain TCP connect scan (-sT) does not. If you run a privileged scan without privileges, nmap will tell you.
Is it legal to scan any host?
No. You should only scan systems you own or have explicit written authorisation to test. In the UK, scanning without permission can breach the Computer Misuse Act 1990, and elsewhere similar laws apply. Port scanning is a normal part of an authorised engagement, not a free-for-all.
Does this tool run the scan?
No. It only assembles the command string for you to review and run yourself in a terminal, on a system you are authorised to test. Nothing is executed and nothing you enter leaves your browser.
Need a full external assessment?
A port scan is the first step; a real penetration test turns exposed services into evidence of what an attacker could actually do. Compare independent, accreditation-verified UK penetration testing companies in our directory.
Browse the directory