Nmap network security scanner man page
nmap - Network exploration tool and security scanner
SYNOPSIS
nmap [Scan Type(s)] [Options] <host or net #1 ... [#N]>
DESCRIPTION
Nmap is designed to allow system administrators and curi-
ous individuals to scan large networks to determine which
hosts are up and what services they are offering. nmap
supports a large number of scanning techniques such as the
UDP, TCP connect(), TCP SYN (half open), ftp proxy (bounce
attack), Reverse-ident, ICMP (ping sweep), FIN, Xmas Tree,
and Null scanning methods. See the Scan Types section for
more details. nmap also offers a number of advanced fea-
tures such as stealth scanning, dynamic delay and retrans-
mission calculations, parallel scanning, detection of down
hosts via parallel pings, decoy scanning, fragmentation
scanning, and flexible target and port specification.
Significant effort has been put into decent nmap perfor-
mance for non-root users. Unfortunately, many critical
kernal interfaces (such as raw sockets) require root priv-
ileges. nmap should be run as root whenever possible.
OPTIONS
Options that make sense together can generally be com-
bined. Some options are specific to certain scan modes.
nmap tries to catch and warn the user about psychotic or
unsupported option combinations.
If you are impatient, you can skip to the examples section
at the end, which demonstrates common usage. You can also
run nmap -h for a quick reference page listing all the
options.
Scan Types
-sT TCP connect() scan: This is the most basic form of
TCP scanning. The connect() system call provided by
your operating system is used to open a connection
to every interesting port on the machine. If the
port is listening, connect() will succeed, other-
wise the port isn't reachable. One strong advantage
to this technique is that you don't need any spe-
cial privileges. Any user on most UNIX boxes is
free to use this call.
This sort of scan is easily detectable as target
host logs will show a bunch of connection and error
messages for the services which accept() the con-
nection just to have it immediately shutdown.
as "half-open" scanning, because you don't open a
full TCP connection. You send a SYN packet, as if
you are going to open a real connection and you
wait for a response. A SYN|ACK indicates the port
is listening. A RST is indicative of a non-lis-
tener. If a SYN|ACK is received, a RST is immedi-
ately sent to tear down the connection (actually
the OS kernel does this for us). The primary advan-
tage to this scanning technique is that fewer sites
will log it. Unfortunately you need root privi-
leges to build these custom SYN packets.
-sF -sX -sN
Stealth FIN, Xmas Tree, or Null scan modes: There
are times when even SYN scanning isn't clandestine
enough. Some firewalls and packet filters watch for
SYNs to restricted ports, and programs like synlog-
ger and Courtney are available to detect these
scans. These advanced scans, on the other hand, may
be able to pass through unmolested.
The idea is that closed ports are require to reply
to your probe packet with an RST, while open ports
must ignore the packets in question (see RFC 794 pp
64). The FIN scan uses a bare (surprise) FIN
packet as the probe, while the Xmas tree scan turns
on the FIN, URG, and PUSH flags. The Null scan
turns off all flags. Unfortunately Microsoft (like
usual) decided to completely ignore the standard
and do things their own way. Thus this scan type
will not work against systems running Windows95/NT.
On the positive side, this is a good way to distin-
guish between the two platforms. If the scan finds
closed ports, you probably have a UNIX machine,
whereas all ports open is indicative of Windows.
-sP ICMP Echo scanning: This isn't really port scan-
ning, since ICMP doesn't have a port abstraction.
But it is sometimes useful to determine what hosts
in a network are up by pinging them all. the -P
option does this. ICMP scanning is done in paral-
lel, so it can be quite fast. To speed things up
even more, you can increase the number of pings in
parallel with the '-L ' option. It can also be
helpful to tweek the ping timeout value with '-T '.
Note that pinging is done by default anyway, and
only hosts that respond are scanned. Only use this
option if you wish to ping sweep without doing any
actual port scans. You also might want to look
into the -P option for specifying what type of
"ping" you wish to use.
UDP (User Datagram Protocol, RFC 768) ports are
open on a host. The technique is to send 0 byte
udp packets to each port on the target machine. If
we receive an ICMP port unreachable message, then
the port is closed. Otherwise we assume it is
open.
Some people think UDP scanning is pointless. I usu-
ally remind them of the recent Solaris rcpbind
hole. Rpcbind can be found hiding on an undocu-
mented UDP port somewhere above 32770. So it
doesn't matter that 111 is blocked by the firewall.
But can you find which of the more than 30,000 high
ports it is listening on? With a UDP scanner you
can! There is also the cDc Back Orfice backdoor
programs which hides on a configurable UDP port on
Windows machines. Not to mention the many com-
monly vulnerable services that utilize UDP such as
snmp, tftp, NFS, etc.
Unfortunately UDP scanning is sometimes painfully
slow since most hosts impliment a suggestion in RFC
1812 (section 4.3.2.8) of limiting the ICMP error
message rate. For example, the Linux kernel (in
net/ipv4/icmp.h) limits destination unreachable
message generation to 80 per 4 seconds, with a 1/4
second penalty if that is exceeded. Solaris has
much more strict limits (about 2 messages per sec-
ond) and thus takes even longer to scan. nmap
detects this rate limiting and slows down accord-
ingly, rather than flood the network with useless
packets that will be ignored by the target machine.
As is typical, Microsoft ignored the suggestion of
the RFC and does not seem to do any rate limiting
at all on Win95 and NT machines. Thus we can scan
all 65K ports of a Windows machine very quickly.
Woop!
-b <ftp relay host>
FTP bounce attack: An interesting "feature" of the
ftp protocol (RFC 959) is support for "proxy" ftp
connections. In other words, I should be able to
connect from evil.com to the FTP server of tar-
get.com and request that the server send a file
ANYWHERE on the internet! Now this may have worked
well in 1985 when the RFC was written. But in
today's Internet, we can't have people hijacking
ftp servers and requesting that data be spit out to
arbitrary points on the internet. As *Hobbit* wrote
back in 1995, this protocol flaw "can be used to
post virtually untraceable mail and news, hammer on
track down at the same time." What we will exploit
this for is to (surprise, surprise) scan TCP ports
from a "proxy" ftp server. Thus you could connect
to an ftp server behind a firewall, and then scan
ports that are more likely to be blocked (139 is a
good one). If the ftp server allows reading from
and writing to some directory (such as /incoming),
you can send arbitrary data to ports that you do
find open.
The argument passed to the 'b' option is the host
you want to use as a proxy, in standard URL nota-
tion. The format is: username:pass-
word@server:port. Everything but server is
optional. To determine what servers are vulnerable
to this attack, you can see my article in Phrack
51. And updated version is available at the nmap
URL (http://www.insecure.org/nmap).
General Options
None of these are required but some can be quite
useful.
-P0 Do not try and ping hosts at all before scanning
them. This allows the scanning of networks that
don't allow ICMP echo requests (or responses)
through their firewall. microsoft.com is an exam-
ple of such a network, and thus you should always
use -P0 or -PT80 when portscanning microsoft.com.
-PT Use TCP "ping" to determine what hosts are up.
Instead of sending ICMP echo request packets and
waiting for a response, we spew out TCP SYN (con-
nection request) packets throughout the target net-
work (or to a single machine) and then wait for
responses to trickle back. Hosts that are up
should respond with a RST (or, rarely, a SYN|ACK).
This option preserves the efficiency of only scan-
ning hosts that are up while still allowing you to
scan networks/hosts that block ping packets. This
is also very useful because it can be done by non-
root users. To set the destination port of the
probe packets use -PT<port number>. Sometimes
ports like 80 are much more useful than the default
anonymous high port due to filtering, so using
-PT80 can help.
-PI This is the default ping type (for root users)
which uses a true ping (ICMP echo request) packet.
It finds hosts that are up and also looks for sub-
net-directed broadcast addresses on your network.
IP packets to a subnet of computers. These should
be eliminated if found as they allow for numerous
denial of service attacks (Smurf is the most com-
mon).
-I This turns on TCP reverse ident scanning. As noted
by Dave Goldsmith in a 1996 Bugtraq post, the ident
protocol (rfc 1413) allows for the disclosure of
the username that owns any process connected via
TCP, even if that process didn't initiate the con-
nection. So you can, for example, connect to the
http port and then use identd to find out whether
the server is running as root. This can only be
done with a full TCP connection to the target port
(i.e. the -sT scanning option). When -i is used,
the remote hosts identd is queried for each open
port found. Obviously this won't work if the host
is not running identd.
-f This option causes the requested SYN, FIN, XMAS, or
NULL scan to use tiny fragmented IP packets. The
idea is to split up the TCP header over several
packets to make it harder for packet filters and so
forth to detect what you are doing. Be careful with
this! Some programs have trouble handling these
tiny packets. My favorite sniffer segmentation
faulted immediately upon receiving the first
36-byte fragment. After that comes a 24 byte one!
While this method won't get by packet filters and
firewalls that queue all IP fragments (like the
CONFIG_IP_ALWAYS_DEFRAG option in Linux), some net-
works can't afford the performance hit this causes
and thus leave it disabled.
Note that I do not yet have this option working on
all systems. It works fine for my Linux boxes and
some people have reported success with other *NIX
variants.
-v Verbose mode. This is a highly recommended option
and it gives out more information about what is
going on. You can use it twice for greater effect.
Use -d a couple of times if you really want to get
crazy with scrolling the screen!
-h This handy option display a quick reference screen
of nmap usage options.
-o <logfilename>
This logs the results of your scans into the file
you specify as an argument.
Reads target specifications from the file specified
RATHER than from the command line. The file should
contain a list of host or net expressions seperated
by spaces, tabs, or newlines. Use a hyphen (-) as
inputfilename if you want nmap to read host expres-
sions from stdin (like at the end of a pipe). See
the section target specification for more informa-
tion on the expressions you fill the file with.
-p <port ranges>
This option specifies what ports you want to spec-
ify. For example '-p 23' will only try port 23 of
the target host(s). ports greater than 60000. The
default is to scan all ports between 1 and 1024.
-F Fast scan mode.
Specifies that you only wish to scan for ports
listed in /etc/services. This is obviously much
faster than scanning all 65535 ports on a host.
-D <hostname or IP address>
Causes a decoy scan to be performed which makes it
appear to the remote host that the host you specify
is scanning the target network. You can use this
option numerous times to make it appear that many
different machines are scanning the target
addresses. Then even if the administrators do
detect your stealth scan, they will see 5 or 10 of
them and will not have any idea which of the hosts
were actually scanning them and which were decoys.
Note that the hosts you use as decoys should be up
or you might accidently SYN flood your targets.
Also it will be pretty easy to determine which host
is scanning if only one is actually up on the net-
work.
Also note that some (stupid) "port scan detectors"
will firewall/deny routing to hosts that attempt
port scans. Thus you might inadvertantly cause the
machine you scan to lose connectivity with the
decoy machines you are using. This could cause the
target machines major problems if the decoy is,
say, its internet gateway or even "localhost".
Thus you might want to be careful of this option.
The real moral of the story is that detectors of
spoofable port scans should not take action against
the machine that seems like it is port scanning
them!
This option is only available for FIN,SYN, Xmas,
and ICMP ping scans.
In some circumstances, nmap may not be able to
determine your source address ( nmap will tell you
if this is the case). In this situation, use -S
with your IP address (of the interface you wish to
send packets through).
Another possible use of this flag is to spoof the
scan to make the targets think that someone else is
scanning them. Imagine a company being repeatedly
port scanned by a competitor! This is not a sup-
ported usage (or the main purpose) of this flag. I
just think it raises an interesting possibility
that people should be aware of before they go
accusing others of port scanning them. -e would
generally be required for this sort of usage.
-e <interface>
Tells nmap what interface to send and receive pack-
ets on. Nmap should be able to detect this but it
will tell you if it cannot.
-g <portnumber>
Sets the source port number used in scans. Many
naive firewall and packet filter installations make
an exception in their ruleset to allow DNS (53) or
FTP-DATA (20) packets come through and establish a
connection. Obviously this completely subverts the
security advantages of the firewall since intruders
can just masquerade as FTP or DNS by modifying
their source port. Obviously for a UDP scan you
should try 53 first and TCP scans should try 20
before 53.
Be aware that there is a small performance penalty
on some scans for using this option, because I
sometimes store useful information in the source
port number.
Target specification
Everything that isn't an option (or option argu-
ment) in nmap is treated as a target host specifi-
cation. The simplest case is listing single host-
names or IP addresses on the command line. If you
want to scan a subnet of IP addresses, you can
append '/mask' to the hostname or IP address. mask
must be between 0 (scan the whole internet) and 32
(scan the single host specified). Use /24 to scan
a class 'C' address and /16 for a class 'B'.
Nmap also has a more powerful notation which lets
you specify an IP address using lists/ranges for
each element. Thus you can scan the whole class
'128.210.1-50,51-255.1,2,3,4,5-255'. And of course
you can use the mask notation: '128.210.0.0/16'.
These are all equivalent. If you use astericts
('*'), remember that most shells require you to
escape them with back slashes or protect them with
quotes.
Another interesting thing to do is slice the Inter-
net the other way. Instead of scanning all the
hosts in a class 'B', scan '*.*.5.6-7' to scan
every IP address that ends in .5.6 or .5.7 Pick
your own numbers. For more information on specify-
ing hosts to scan, see the examples section.
EXAMPLES
Here are some examples of using nmap, from simple and nor-
mal to a little more complex/esoteric. Note that actual
numbers and some actual domain names are used to make
things more concrete. In their place you should substi-
tute addresses/names from your own network. I do not
think portscanning other networks is illegal; nor should
portscans be construed by others as an attack. I have
scanned hundreds of thousands of machines and nobody has
ever complained. But I am not a lawyer and some (anal)
people may be annoyed by nmap probes. Get permission
first or use at your own risk.
nmap -v target.example.com
This option scans all reserved TCP ports on the machine
target.example.com . The -v means turn on verbose mode.
nmap -sS target.example.com/24
Launches a stealth SYN scan against each machine that is
up out of the 255 machines on class 'C' where target.exam-
ple.com resides. This requires root privileges because of
the SYN scan.
nmap -sX -p 22,53,110,143 128.210.*.1-127
Sends an Xmas tree scan to the first half of each of the
255 possible 8 bit subnets in the 128.210 class 'B'
address space. We are testing whether the systems run
sshd, DNS, pop3d, imapd, or port 4564. Note that Xmas
scan doesn't work on Microsoft boxes due to their defi-
cient TCP stack.
nmap -v -p 80 '*.*.2.3-5'
Rather than focus on a specific IP range, it is sometimes
servers on machines with IP addresses ending in .2.3,
.2.4, or .2.5 . If you are root you might as well add
-sS. Also you will find more interesting machines start-
ing at 127. so you might want to use '127-222' instead of
the first asterict because that section has a greater den-
sity of interesting machines (IMHO).
host -l company.com | cut '-d ' -f 4 | ./nmap -v -i -
Do a DNS zone transfer to find the hosts in company.com
and then feed the IP addresses to nmap. The above com-
mands are for my GNU/Linux box. You may need different
commands/options on other operating systems.
nmap -v -PT80 -g 6791 -sS -D lamer.example.com -p
53,80,139 -o evil_empire.scan www.microsoft.com/24
This SYN scans 255 machines on the www.microsoft.com net-
work of web servers looking for TCP ports 53 (DNS) 80
(WWW) and 139 (NetBIOS-SSN). We use -PT80 because that
network does not allow pings, so we use TCP ping instead.
We also need the '80' because SYN packets to most other
ports are blocked by their firewall. We use -g 6791
because the source port of the scan must be greater than
1023. Packets coming from privileged ports are also
dropped at the MS firewall. The -D option makes it appear
(to MS) that 'lamer.example.com' is scanning them at the
same time we are. MS won't know which is doing the real
scan and which is the decoy. The -o option logs important
output to evil_empire.scan for our later perusal.
Most domains are not this much of a pain to scan. MS just
has a paranoid-as-hell packet filtering policy. This is
actually quite prudent given that they must secure thou-
sands of hopelessly insecure NT boxes! For more info on
MS insecurity, see my page on the subject at
http://www.insecure.org/sploits.html.
BUGS
nmap is still not as portable as I would like. IP frag-
mentation support is especially limited in portability.
AUTHOR
Fyodor <fyodor@dhp.com>
DISTRIBUTION
The newest version of nmap can be obtained from
http://www.insecure.org/nmap
nmap is (C) 1997,1998 by Fyodor (fyodor@dhp.com, fyo-
dor@insecure.org)
License as published by the Free Software Foundation; Ver-
sion 2.
This program is distributed in the hope that it will be
useful, but WITHOUT ANY WARRANTY; without even the implied
warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
PURPOSE. See the GNU General Public License for more
details (it is in the COPYING file of the nmap distribu-
tion).
Man(1) output converted with
man2html