/commands/nmap/nmap-os-detection
nmap -O: detect the operating system of a host
- tool
- Nmap
- versions
- Nmap 7.x
- os
- linux, macos, windows
sudo nmap -O 192.0.2.10 asks Nmap to identify the target's operating system by sending a series of TCP and UDP probes and comparing the answers with more than 2,600 fingerprints in its nmap-os-db database. It needs raw packets, so it runs as root (or Administrator on Windows), and works best when the scan finds at least one open and one closed TCP port. Scan only hosts you own or are authorised to test.
sudo nmap -O 192.0.2.10 # port scan of the top 1000 ports plus OS detection
sudo nmap -O --osscan-guess 192.0.2.10 # show near matches with a confidence value
sudo nmap -O --osscan-limit 192.0.2.0/24 # skip hosts without an open and a closed port
sudo nmap -O -p 22,80,443,1 192.0.2.10 # few ports, including one likely closed
sudo nmap -A 192.0.2.10 # OS + versions + default scripts + tracerouteReading the result
The report adds lines such as Device type, Running, OS CPE and OS details below the port table. Running gives the family and generation (for example a Linux kernel series), OS CPE the machine-readable Common Platform Enumeration name. With -v Nmap also prints an uptime guess based on TCP timestamps and the IP ID sequence class. When no fingerprint fits and conditions were good, Nmap prints the fingerprint and a URL to submit it if you know the real OS.
Options
| Option | Effect |
|---|---|
| -O | Enable OS detection. |
| -A | OS detection plus -sV, -sC and --traceroute. |
| --osscan-guess (or --fuzzy) | Print close but imperfect matches with a percentage. |
| --osscan-limit | Try OS detection only on hosts with at least one open and one closed TCP port. |
| --max-os-tries N | Retries when no perfect match is found; default 5 in good conditions, 2 otherwise. |
| -Pn | Skip host discovery when the host blocks ping probes. |
| -v | Also show uptime guess, TCP sequence predictability and IP ID class. |
Pitfalls
- Privileges. Without root, Nmap stops with
You requested a scan type which requires root privileges. QUITTING!See scan type requires root privileges. - No closed port. Hosts behind a firewall that drops everything except a few open ports give poor fingerprints. Add a port that is likely closed to
-pso Nmap has one to test. - Host looks down. If ping probes are blocked, Nmap skips the host before OS detection: see Host seems down. try -Pn.
- Middleboxes. Load balancers, NAT gateways and some firewalls answer on behalf of the host, so the fingerprint describes them, not the server behind.
FAQ
Why does nmap say no exact OS matches for host?
The fingerprint did not match any entry in nmap-os-db closely enough. It happens with uncommon devices, firewalls that alter packets, or when Nmap found no open and closed port pair. Add --osscan-guess to see near matches with confidence percentages.
What is the difference between -O and -A?
-O runs OS detection only. -A is a shortcut for OS detection, version detection (-sV), default scripts (-sC) and traceroute together, which takes longer and sends more traffic.
Is the result reliable?
It is a guess based on how the TCP/IP stack answers test probes. Results for general-purpose operating systems are usually right at the family level; exact versions, virtual machines and devices behind NAT or load balancers are often reported wrongly. Confirm with -sV banners or with the system owner.