Discover & Fingerprint: Nmap flags you should actually know (and when to use them)

Discovery and fingerprinting are where recon stops being guesswork and starts being a map. Over the next few weeks I’ll dig into Nmap and other recon tools — for now, here’s a compact, practical list of Nmap switches worth committing to memory for pentesting exams and real-world ops. Don’t just memorize the letters — learn the purpose and the use case.

Quick legal note: Only scan systems you own or have explicit permission to test. Unauthorized scanning can be illegal and definitely burns bridges.

Basic target input / listing

• nmap -iL targets.txt
  Scan targets from a file. Use when you have a long list to automate.
• nmap -iR 100
  Scan 100 random hosts. Good for practice/learning about global scanning patterns in a lab.
• nmap 192.168.1.10 -sL
  List-only — no probes. Use to verify target resolution without touching ports.

Host discovery vs port scan

• nmap 192.168.1.1/24 -sn
  Ping/host discovery only (no port scan). Fast way to find live hosts on a subnet.
• nmap 192.168.1.1-5 -Pn
  Skip host discovery (treat hosts as up). Useful when ICMP/ARP are blocked but you still want to try ports.

Port specification

• nmap 192.168.1.1 -p 21
  Scan a single port (FTP, in this example).
• nmap 192.168.1.1 -p 21-100
  Scan a specific port range. Use when you want targeted scanning (faster than full 65k).

Service & OS fingerprinting

• nmap 192.168.1.1 -sV
  Service/version detection. Helps identify vulnerable versions (e.g., out-of-date FTP/SSH).
• nmap 192.168.1.1 -O
  Remote OS detection (TCP/IP stack fingerprinting). Useful when you need OS-level attack vectors.
• nmap 192.168.1.1 -A
  Aggressive: OS detection + version detection + scripts + traceroute. Good for a quick, deep look — loud and obvious on the network.

Timing / IDS evasion

Timing templates adjust scan speed and stealth. Choose based on network reliability and detection risk.

• -T0 Paranoid — ultra-slow. Used to evade IDS or noisy logging systems.
• -T1 Sneaky — very slow.
• -T2 Polite — slows scans to reduce bandwidth/impact on target.
• -T3 Normal — default.
• -T4 Aggressive — faster, assumes stable network.
• -T5 Insane — very fast; only on extremely reliable links or internal lab networks.

Memory tricks & practical tips

• I/O flags: -iL = Input List. File-based scanning automation.
• List-only: -sL — “List targets only.” No probing.
• Host discovery: -sn = scan no ports (ping only).
• Skip discovery: -Pn = treat hosts as Up (No ping).
• Service info: -sV for service Version, -O for OS.
• One-shot vs range: -p 21 vs -p 21-100. Single vs range.
• Aggressive -A = one-shot deep recon; loud but thorough.
• Timing -T# = speed vs stealth. 0 is slowest/most stealthy; 5 fastest.

Mini workflows (real use-cases)

• Quick inventory on a subnet:
  nmap 10.0.0.0/24 -sn → find live hosts, then nmap -sV -p 22,80,443 <host> for details.
• When ICMP blocked:
  nmap -Pn -p 1-1000 <host> → skip discovery, probe ports directly.
• Stealth check in an IDS lab:
  nmap -T1 -sV <host> → slow timing to reduce IDS noise.
• Full noisy recon in a lab environment:
  nmap -A -T4 <target> → quick comprehensive view.

Closing — don’t memorize blindly

The exam question isn’t “what flag is X” — it’s “which flag solves this problem.” Memorize the purpose and practice applying them in labs. Over the coming weeks I’ll publish deeper examples for each of these switches, show script usage, and map Nmap output to real exploitation workflows.