Nmap command builder
Build a correct nmap command without memorising the flags. Choose a scan type, ports, timing, and detection options — the command updates live, with every flag explained in plain English. It runs in your browser and only generates the command; it never scans anything itself.
nmap -sS -T4 192.168.1.0/24
What each flag does
- -sS — TCP SYN ("half-open") scan — fast and stealthy; the default when run as root.
- -T4 — Timing template 4 — higher is faster but noisier (0 = paranoid, 5 = insane).
- 192.168.1.0/24 — The host, hostname, IP range, or CIDR block to scan.
Authorised use only. Only scan systems you own or have explicit written permission to test. In the UK, unauthorised scanning can breach the Computer Misuse Act 1990. This builder generates a command; it does not run it.
Nmap questions, answered
What is nmap used for?
Nmap (Network Mapper) is a free, open-source tool for discovering hosts and services on a network. Security teams use it to map what is exposed, find open ports, identify running services and versions, and fingerprint operating systems as part of reconnaissance.
What is the difference between a SYN scan and a connect scan?
A SYN scan (-sS) sends a SYN packet and never completes the TCP handshake, which is faster and quieter but needs raw-socket (root) privileges. A connect scan (-sT) completes the full handshake using the operating system, so it works without privileges but is slower and more visible in logs.
Do I need to run nmap as root?
Most scan types, including SYN scan (-sS), send raw packets, which the Nmap documentation says requires root access on Unix systems (an administrator account is recommended on Windows). A plain TCP connect scan (-sT) does not need raw packet privileges; it is the default TCP scan when SYN scan is not an option.
Is it legal to scan any host?
No. You should only scan systems you own or have explicit written authorisation to test. In the UK, scanning without permission can breach the Computer Misuse Act 1990, and elsewhere similar laws apply. Port scanning is a normal part of an authorised engagement, not a free-for-all.
Does this tool run the scan?
No. It only assembles the command string for you to review and run yourself in a terminal, on a system you are authorised to test. Nothing is executed and nothing you enter leaves your browser.
How to read the command
- Flags start with a dash. Each one in your command is listed with a plain-English meaning, so you can check it does what you intend before you run it.
- The target goes last. Replace the placeholder with the host or range you are allowed to scan.
- Change an option and the command updates, so you can compare versions before you run one.
Two defaults worth knowing, from the Nmap reference guide:
“The simple command nmap <target> scans 1,000 TCP ports on the host <target>.”
“Normal mode is the default and so -T3 does nothing.”
Common nmap mistakes
- Scanning without permission. The Nmap project's own advice is plain:
“Ensure that you have permission to scan.”
- Assuming the default covers every port. The default scans 1,000 common TCP ports, so a service on an unusual port can be missed. Choose a wider range when you need it, and expect it to take longer.
- Raising the timing too far. Faster templates assume a fast, reliable network and can lose accuracy.
- Reading the output as a vulnerability list. A port scan shows what is open. Finding which of those services is weak is the next step, and a penetration test is where that happens.
Related tools and guides
Need a full external assessment?
A port scan is the first step; a real penetration test turns exposed services into evidence of what an attacker could actually do. Compare UK penetration testing companies in our directory.
Browse the directory