Nmap Command Generator
Quickly generate Nmap scanning commands for network diagnostics and authorized security audits.
Scan Parameters
How It Works
Nmap is commonly used by network administrators and security professionals to discover hosts, identify available services and troubleshoot network connectivity. This generator combines a target, scan type and optional scan parameters into a ready-to-use Nmap command.
Use generated commands only against systems and networks that you own or are authorized to assess.
Network Diagnostic Applications
Network Discovery
Use ping sweep commands to identify active hosts on an authorized network segment.
Service Identification
Generate commands that help identify services and their versions during authorized network assessments.
Infrastructure Auditing
Combine Nmap options to support controlled diagnostics and security audits of network infrastructure.
Frequently Asked Questions
What target can I enter?
You can enter an individual IP address, hostname or network range such as 192.168.1.0/24.
Can I combine multiple options?
Review combinations carefully. Host discovery (-sn) skips port scanning; do not combine it with OS, service or aggressive detection in this generator.
Read the generated command
Example: with target 192.0.2.10, TCP Connect selected and service detection enabled, the output is nmap -sT -sV 192.0.2.10. The target is an example address; replace it with an authorized test host.
This generator supports SYN, TCP Connect, UDP and host-discovery scans, plus OS detection, service-version detection and the aggressive option. It does not provide custom port-range or timing controls. It generates text in your browser; it does not run a scan.
SYN scans do not complete a TCP connection, but monitoring systems can still detect and log them. Check privileges, scope and the effect of selected options before running the command.
Reference: Nmap reference guide.
Physical Security Audits
Quickly scan a dedicated CCTV subnet to locate undiscovered Axis IP cameras or hidden HID card readers that require firmware patching.
Rogue Device Detection
Perform regular sweeps of enterprise subnets to identify unauthorized Wi-Fi routers, personal laptops, or IoT devices plugged into corporate switches.
Firewall Rule Verification
Scan external-facing IPs from outside the network to verify that perimeter firewalls are correctly dropping traffic and not exposing unintended ports.
Before running a scan
Is it legal to use Nmap?
Use Nmap only within an explicitly authorized scope. Ownership alone may not cover hosted infrastructure or third-party services. Check the applicable service terms and your organization’s testing rules.
What is the difference between -sS and -sT?
A SYN scan (-sS) normally requires raw-packet privileges and does not complete the TCP handshake. A TCP Connect scan (-sT) uses the operating system to establish a connection and can run without those privileges. Both can be detected and logged.
Interpret observations, not just flags
An open port means a service accepted the probe from that scan location. It does not by itself prove the service is vulnerable. A filtered result can reflect a firewall or another network obstacle; it does not prove the host is absent. Compare results with the expected service inventory and the scan location.
For an initial authorized inventory, choose host discovery with additional detection options cleared. For one known lab host, use TCP Connect and optionally service-version detection. The aggressive option enables several probes, including default scripts; review its scope in the Nmap manual before selecting it.
Keep the exact command, Nmap version, scan time and network vantage point with your results. This generator produces command text only and cannot verify whether a target belongs to your authorized scope.