选项概要

当 Nmap 不带选项运行时，该选项概要会被输出，最新的版本在这里 http://www.insecure.org/nmap/data/nmap.usage.txt。它帮助人们记住最常用的选项，但不 能替代本手册其余深入的文档，一些晦涩的选项甚至不在这里。

  1. Usage: nmap [Scan Type(s)] [Options] {target specification}
  2. TARGET SPECIFICATION:
  3.     Can pass hostnames, IP addresses, networks, etc.
  4.     Ex: scanme.nmap.org, microsoft.com/24, 192.168.0.1; 10.0-255.0-255.1-254
  5.     -iL <inputfilename>: Input from list of hosts/networks
  6.     -iR <num hosts>: Choose random targets
  7.     --exclude <host1[,host2][,host3],...>: Exclude hosts/networks
  8.     --excludefile <exclude_file>: Exclude list from file
  9. HOST DISCOVERY:
  10.     -sL: List Scan - simply list targets to scan
  11.     -sP: Ping Scan - go no further than determining if host is online
  12.     -P0: Treat all hosts as online -- skip host discovery
  13.     -PS/PA/PU [portlist]: TCP SYN/ACK or UDP discovery probes to given ports
  14.     -PE/PP/PM: ICMP echo, timestamp, and netmask request discovery probes
  15.     -n/-R: Never do DNS resolution/Always resolve [default: sometimes resolve]
  16. SCAN TECHNIQUES:
  17.     -sS/sT/sA/sW/sM: TCP SYN/Connect()/ACK/Window/Maimon scans
  18.     -sN/sF/sX: TCP Null, FIN, and Xmas scans
  19.     --scanflags <flags>: Customize TCP scan flags
  20.     -sI <zombie host[:probeport]>: Idlescan
  21.     -sO: IP protocol scan
  22.     -b <ftp relay host>: FTP bounce scan
  23. PORT SPECIFICATION AND SCAN ORDER:
  24.     -p <port ranges>: Only scan specified ports
  25.     Ex: -p22; -p1-65535; -p U:53,111,137,T:21-25,80,139,8080
  26.     -F: Fast - Scan only the ports listed in the nmap-services file)
  27.     -r: Scan ports consecutively - don't randomize
  28. SERVICE/VERSION DETECTION:
  29.     -sV: Probe open ports to determine service/version info
  30.     --version-light: Limit to most likely probes for faster identification
  31.     --version-all: Try every single probe for version detection
  32.     --version-trace: Show detailed version scan activity (for debugging)
  33. OS DETECTION:
  34.     -O: Enable OS detection
  35.     --osscan-limit: Limit OS detection to promising targets
  36.     --osscan-guess: Guess OS more aggressively
  37. TIMING AND PERFORMANCE:
  38.     -T[0-6]: Set timing template (higher is faster)
  39.     --min-hostgroup/max-hostgroup <msec>: Parallel host scan group sizes
  40.     --min-parallelism/max-parallelism <msec>: Probe parallelization
  41.     --min_rtt_timeout/max-rtt-timeout/initial-rtt-timeout <msec>: Specifies probe round trip time.
  42.     --host-timeout <msec>: Give up on target after this long
  43.     --scan-delay/--max_scan-delay <msec>: Adjust delay between probes
  44. FIREWALL/IDS EVASION AND SPOOFING:
  45.     -f; --mtu <val>: fragment packets (optionally w/given MTU)
  46.     -D <decoy1,decoy2[,ME],...>: Cloak a scan with decoys
  47.     -S <IP_Address>: Spoof source address
  48.     -e <iface>: Use specified interface
  49.     -g/--source-port <portnum>: Use given port number
  50.     --data-length <num>: Append random data to sent packets
  51.     --ttl <val>: Set IP time-to-live field
  52.     --spoof-mac <mac address, prefix, or vendor name>: Spoof your MAC address
  53. OUTPUT:
  54.     -oN/-oX/-oS/-oG <file>: Output scan results in normal, XML, s|<rIpt kIddi3, and Grepable format, respectively, to the given filename.
  55.     -oA <basename>: Output in the three major formats at once
  56.     -v: Increase verbosity level (use twice for more effect)
  57.     -d[level]: Set or increase debugging level (Up to 9 is meaningful)
  58.     --packet-trace: Show all packets sent and received
  59.     --iflist: Print host interfaces and routes (for debugging)
  60.     --append-output: Append to rather than clobber specified output files
  61.     --resume <filename>: Resume an aborted scan
  62.     --stylesheet <path/URL>: XSL stylesheet to transform XML output to HTML
  63.     --no_stylesheet: Prevent Nmap from associating XSL stylesheet w/XML output
  64. MISC:
  65.     -6: Enable IPv6 scanning
  66.     -A: Enables OS detection and Version detection
  67.     --datadir <dirname>: Specify custom Nmap data file location
  68.     --send-eth/--send-ip: Send packets using raw ethernet frames or IP packets
  69.     --privileged: Assume that the user is fully privileged
  70.     -V: Print version number
  71.     -h: Print this help summary page.
  72. EXAMPLES:
  73.     nmap -v -A scanme.nmap.org
  74.     nmap -v -sP 192.168.0.0/16 10.0.0.0/8
  75.     nmap -v -iR 10000 -P0 -p 80