/commands/nmap/nmap-scan-specific-ports
nmap -p: scan specific ports, port ranges or all 65535 ports
The commands on this page have not been executed by our verification runner yet.updated
- tool
- Nmap
- versions
- Nmap 7.x
- os
- linux, macos, windows
nmap -p 22,80,443 HOST scans only the listed ports. Ranges use a hyphen (-p 1-1024), -p- scans all ports from 1 to 65535, and without -p nmap scans the 1,000 most common ports for each protocol. Prefix ports with T: or U: to mix TCP and UDP in one scan (-p U:53,T:22,80 together with -sU and a TCP scan type).
Port specification
| Option | Scans |
|---|---|
| -p 22 | one port |
| -p 22,80,443 | a list |
| -p 1-1024 | a range |
| -p- | all ports 1-65535 |
| -p http,https | ports by service name (from nmap-services) |
| -p U:53,T:22,80 | UDP 53 and TCP 22 and 80 (needs -sU plus a TCP scan type) |
| -F | the 100 most common ports (fast scan) |
| --top-ports 200 | the 200 most common ports |
| --exclude-ports 25 | everything selected except port 25 |
Examples
nmap -p 22,80,443 scanme.nmap.org # three TCP ports
nmap -p- 127.0.0.1 # every TCP port on this machine
nmap -p 80,443 --open 192.168.1.0/24 # only hosts with these ports open, on your own LAN
sudo nmap -sU -p 53,123 127.0.0.1 # UDP needs privileges
nmap -sV -p 22 127.0.0.1 # also detect the service versionPort states
| State | Meaning |
|---|---|
| open | an application accepts connections on the port |
| closed | the host answered, but nothing listens there |
| filtered | no answer or an ICMP error, usually a firewall drops the packets |
| unfiltered | reachable, but nmap cannot tell open from closed (ACK scan) |
| open|filtered | no response, common for UDP: open or filtered |
--open hides closed and filtered ports from the output. -oG - or -oX file.xml write results in grepable or XML form for scripts.
Check your own machine without nmap
To see which ports your own host listens on, the system tools are faster and need no scan: ss -ltnu on Linux, lsof -nP -iTCP -sTCP:LISTEN on macOS, netstat -ano on Windows.
Sources
Related pages
commands · nmapnmap -sU: scan UDP ports (DNS, SNMP, DHCP)nmap -sU scans UDP ports such as DNS, NTP and SNMP. What open|filtered means, why UDP scans are slow, faster options, combined TCP and UDP port syntax.errors · nmapnmap: Note: Host seems down. If it is really up, but blocking our ping probes, try -PnNmap says Host seems down when no discovery probe gets an answer, often because a firewall drops ping. Scan anyway with -Pn, or run as root for better probes.errors · nmapnmap: You requested a scan type which requires root privileges. QUITTING!nmap quits with requires root privileges when a SYN, UDP or OS scan needs raw sockets. Run it with sudo, use a TCP connect scan (-sT), or grant capabilities.commands · ssss -tulpn: list listening ports and the process using themss -tulpn lists listening TCP and UDP ports with the owning process on Linux. What each flag means, filters for one port, and macOS and Windows equivalents.commands · ufwufw allow 22/tcp: open a port with ufwsudo ufw allow 22/tcp opens a port in the ufw firewall. Ranges, source-restricted rules, app profiles, deleting rules, and the Docker port publishing caveat.