Nmap Cheat Sheet: Essential Commands

By Robert Mentrup · Updated September 22, 2026

This cheat sheet collects the Nmap commands network administrators reach for most often. Use them only on networks you own or are explicitly authorized to assess.

Host discovery

• nmap -sn 192.168.1.0/24 — ping-scan a subnet to list live hosts without port scanning.
• nmap -PR 192.168.1.0/24 — ARP discovery on a local network.

Port scanning

• nmap 192.168.1.10 — default scan of the 1000 most common TCP ports.
• nmap -p- 192.168.1.10 — scan all 65535 TCP ports.
• nmap -sV 192.168.1.10 — detect service and version information.

Output

• nmap -oN scan.txt 192.168.1.10 — save normal output to a file.
• nmap -oX scan.xml 192.168.1.10 — save XML output for tooling.

Always confirm you have written authorization before scanning any network you do not own.

Read the Nmap overview