Nmap’s switches answer different questions: -sn discovers live hosts, -sS or -sT checks TCP ports, -sU checks UDP, -sV identifies services, -O fingerprints the operating system, and -A combines several identification features. Use only against systems you own or are explicitly authorized to assess, with a defined scope and an approved change window.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
Plan an authorized scan before choosing switches
A scan can create connection attempts, UDP probes, application requests, log entries and alerts. On a production Linux server, record the target addresses, permitted port range, source address, start and stop times, expected traffic level and the person responsible for the change. Notify the monitoring or operations team when required. A full-port UDP scan, NSE scripts and fast timing templates can run much longer or generate more traffic than a small TCP inventory.
As an Amazon Associate I earn from qualifying purchases.
Choose the least intrusive command that answers the question. Start with discovery or a focused TCP list, then add version, operating-system or script detection only where the result is useful. Save the output with a stable basename so another administrator can reproduce and audit the work.
Host discovery and port scanning are different jobs
Find live hosts with -sn
-sn performs host discovery without a port scan. It is useful for mapping which addresses respond before you spend time testing ports. The probes and response depend on the target, privileges and network path, so a lack of response does not prove that a machine is powered off.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
nmap -sn 192.0.2.0/24This command reports hosts that answer discovery probes and does not provide a TCP or UDP port inventory.
Scan despite blocked discovery with -Pn
-Pn skips host discovery and treats every target as online. Use it when a firewall filters ICMP or other discovery probes but the service ports may still be reachable.
Recommended Free Tools
nmap -Pn -p 22,80,443 192.0.2.25Because Nmap proceeds for each address, applying -Pn to a large range of unused addresses can waste time and create unnecessary traffic. Limit the target list when you use it.
TCP scan types: -sS versus -sT
| Option | Privilege requirement | How it works | Operational characteristics |
|---|---|---|---|
-sS |
Raw-packet privileges, normally obtained with root or sudo |
Sends SYN probes and evaluates the response without completing the normal application connection | Efficient half-open technique; still visible to capable intrusion-detection systems |
-sT |
Works without raw-packet privileges | Uses the operating system’s connect() call to complete TCP connections |
Usually more overhead and more likely to appear in service logs |
On Linux, -sS is the normal privileged TCP method. Run it with sudo when policy allows:
sudo nmap -sS -p 22,80,443 server.exampleIf raw-packet privileges are unavailable, Nmap uses a TCP connect scan; you can request it explicitly:
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
nmap -sT -p 22,80,443 server.exampleA connect scan is not an “invisible” alternative. Completing connections gives the target service more conventional events to log, while a capable IDS can detect either scan style. The choice changes packet construction and privilege requirements, not your authorization obligations.
Define the port scope deliberately
Common ports for a quick inventory
Use --top-ports when you need a fast first pass over the most frequently observed ports:
sudo nmap -sS --top-ports 1000 -oA host-common target.exampleThis is a prioritised sample, not proof that other ports are closed.
Specific ports and ranges
-p accepts individual ports and ranges. A focused list reduces runtime and keeps the test aligned with the change request.
sudo nmap -sS -p 22,80,443,8000-8100 target.exampleAll TCP ports with -p-
-p- requests the full TCP port range. It is appropriate when complete TCP coverage is required, but it takes longer and produces more traffic than a targeted list.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsRank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
sudo nmap -sS -p- -T3 -oA host-full target.example“All ports” in this command means all TCP ports. UDP is a separate scan type and must be requested with -sU.
Scan UDP services with -sU
UDP has no TCP-style handshake, so responses are often delayed, absent or generated only after an application-specific request. Nmap therefore treats UDP as a distinct job. Use a deliberate administrative port list first, and add -sV when service identification is needed.
sudo nmap -sU -p 53,67,68,123,161,500,514 -sV -oA host-udp target.exampleThe example covers commonly encountered DNS, DHCP, NTP, SNMP, IPsec-related and logging ports; adjust it to the services authorized in your environment. A response may indicate an open service, while no response can leave a port in an uncertain state because filtering and application behavior are difficult to distinguish. Repeat tests during an approved window if the result affects a security decision.
Combining TCP and UDP in one command is possible, but keeping the protocols in separate output files often makes review and remediation clearer:
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →sudo nmap -sS -p 22,80,443 -oA tcp-services target.example
sudo nmap -sU -p 53,123,161 -sV -oA udp-services target.exampleAdd identification only after you know which ports matter
Service and version detection with -sV
-sV sends service probes to ports Nmap has identified as open or potentially open. It attempts to determine the application protocol and version instead of reporting only a port number. Probe results depend on banners, protocol replies, filtering and the probe database; treat a version string as evidence to verify against the host’s package inventory.
sudo nmap -sS -sV -p 22,80,443 server.exampleRunning version detection on a focused set is faster and creates fewer application requests than probing every port.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
Operating-system fingerprinting with -O
-O compares multiple TCP and UDP response characteristics with Nmap’s nmap-os-db. The current Linux manual describes more than 2,600 known OS fingerprints. Fingerprinting is an inference, not a guarantee: virtual machines, firewalls, proxies, unusual kernels and middleboxes can alter responses or produce a close match. Confirm the result through authorized host-management data.
sudo nmap -O -p 22,80,443 server.exampleDefault NSE scripts with -sC
-sC runs the NSE default script category. These scripts can collect useful metadata and perform protocol checks, but they are additional application interactions. Review the scripts and your organization’s rules before using them on production systems.
Free tools Windows power users keep installed
One-click scans. No signup required.
sudo nmap -sC -sV -p 22,80,443 server.exampleSpecific scripts with --script
--script=<scripts> selects named scripts, categories or script directories. Some scripts accept arguments and may make deeper requests, so read the script documentation and test the exact selection in a controlled environment.
sudo nmap --script=http-title,http-headers -p 80,443 server.exampleWhat -A does—and when not to use it
-A enables OS detection, service/version detection, the default NSE script category and traceroute together. It is convenient for an authorized deep assessment, but it is not a magic “complete scan”: it does not automatically scan every port, and it does not include every NSE category.
sudo nmap -A -p 22,80,443 server.exampleBecause -A combines several active techniques, it can increase runtime, traffic, log volume and monitoring visibility. Prefer explicit switches when you need a predictable change record—for example, -sV -O without scripts, or -sC only on a small set of web ports.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Control speed and network impact with timing templates
-T0 through -T5 selects increasingly aggressive timing behavior. Lower templates favor caution and are suitable for fragile or heavily monitored links; higher templates finish sooner when the network and target can tolerate the additional probe rate. Nmap still adapts to packet loss and latency, so a template is not a fixed packets-per-second promise.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →| Template | Use it when |
|---|---|
-T0 |
Probe pacing must be extremely cautious and duration is acceptable |
-T1 |
A very slow, low-profile assessment is required |
-T2 |
You want reduced load compared with normal operation |
-T3 |
A balanced default for ordinary authorized scans |
-T4 |
The network is reliable and a faster assessment is approved |
-T5 |
Only when the environment is known to tolerate aggressive timing |
For example, a full TCP range with -T3 favors a predictable middle ground:
sudo nmap -sS -p- -T3 target.exampleCoordinate faster settings with monitoring teams. A high template can create a burst that triggers controls even when the total number of ports is modest.
A task-first workflow for Linux administrators
- Confirm authorization and scope. Write down exact hostnames or addresses, protocols, ports, timing limits and the output location. Exclude ranges you are not permitted to test.
- Check reachability. Run
nmap -snfor discovery. If policy or filtering makes discovery unreliable and the target is known to be in scope, use-Pnon that specific target. - Take a focused TCP inventory. Use
sudo nmap -sS --top-ports 1000or an explicit-plist. Record the command and timestamp. - Expand scope only if necessary. Use
-p-for complete TCP coverage, and schedule it when the additional traffic and duration are acceptable. - Check UDP separately. Select ports relevant to the server’s role, run
-sU, and add-sVwhen protocol identification is required. - Identify services and the OS. Apply
-sVand, where justified,-Oto the open ports rather than indiscriminately to every address. - Use scripts intentionally. Choose
-sCor named--scriptselections only after reviewing their behavior and authorization. - Set timing. Begin with
-T3for a normal window; move lower for fragile links or higher only with explicit approval. - Save and review results. Use
-oA, inspect the human-readable file, and preserve the XML for tools or later comparison.
Why Nmap says “host seems down”
- Discovery probes are filtered. Firewalls commonly drop ICMP or other probes while allowing a service port. Retry the known in-scope address with
-Pn. - The address is wrong or unrouted. Verify DNS, routing, VLAN access and the target’s current address before changing scan switches.
- The system is genuinely offline. Confirm through an authorized console, inventory or monitoring source rather than assuming a scan failure.
- A middlebox changes responses. NAT, load balancers and security appliances can make the responding system differ from the server you intended to identify.
- UDP silence is ambiguous. No UDP reply can mean filtering or an application that responds only to valid requests; do not classify it as closed solely from silence.
Use -Pn selectively. It bypasses a useful early filter and can make an address range scan much slower.
Save output for reports and automation
| Switch | Format | Best use |
|---|---|---|
-oN file |
Normal, human-readable output | Ticket attachments and administrator review |
-oX file |
XML | Structured parsing, dashboards and archival |
-oG file |
Grepable legacy format | Simple text processing where this format is already supported |
-oA basename |
Normal, XML and grepable-style files under one basename | Keeping a review copy and machine-readable copies together |
sudo nmap -sS -sV -O -sC -p 22,80,443 -oA host-detail target.exampleKeep the exact command, Nmap version, date, target scope and authorization record with the files. Do not edit the original output; make a separate redacted copy if a report must omit addresses or banners.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteInterpreting results without overclaiming
“Open” means Nmap received evidence that an application is accepting traffic on that port at scan time. “Closed” generally means the host responded but no application was listening. “Filtered” means filtering prevented Nmap from determining the state. These states describe the path and moment tested, not a permanent security property.
Version and OS fields are useful leads for patch review and asset reconciliation, but they can be altered by banners, reverse proxies, containers, kernel backports or network devices. Validate important findings with local package data, service configuration and an approved vulnerability-management process. A scan also cannot prove that an untested protocol, alternate address or filtered port is safe.
Quick switch map
| Goal | Switch | Meaning |
|---|---|---|
| Host discovery only | -sn |
Find live hosts without a port scan |
| Skip discovery | -Pn |
Treat targets as online and scan them |
| Privileged TCP | -sS |
SYN scan using raw packets |
| Unprivileged TCP | -sT |
TCP connect() scan |
| UDP services | -sU |
Probe UDP ports |
| Service versions | -sV |
Probe applications for protocol and version details |
| Operating system | -O |
Fingerprint the TCP/IP stack |
| Default scripts | -sC |
Run the NSE default category |
| Selected scripts | --script=<scripts> |
Run named scripts, categories or directories |
| Aggressive bundle | -A |
OS detection, version detection, default scripts and traceroute |
| Port scope | -p <ports> |
Select ports and ranges; -p- requests all TCP ports |
| Timing | -T0…-T5 |
Choose progressively faster timing behavior |
| Save results | -oN, -oX, -oG, -oA |
Write normal, XML, grepable or combined output |
Bottom line for choosing a command
Use -sn to discover hosts, -sS with sudo for an efficient Linux TCP inventory, -sT when raw privileges are unavailable, and -sU for UDP. Add -sV, -O or carefully selected NSE scripts only when identification depth justifies the extra traffic. Set -p and -T to match the approved scope and network conditions, then preserve the command and results with -oA.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
