making sense of the nmap options

Question

An nmap option I see in some examples uses the -sP option, but I haven't seen this listed anywhere in their options or --help. Is -sP an option you construct from the other options? If so, please explain briefly how the syntax works. If not, where is the full, complete list of options?

score 3 · Accepted Answer · answered Apr 12 '13 at 20:12

Some of Nmap's options have changed over time. The most commonly-used options can be seen by running nmap with no options (or with --help). The most up-to-date list is found in the online reference guide, but it only refers to the very latest version.

For the most part, older synonyms of options will still work (preserving backwards compatibility). Here's a list of some options and their older synonyms:

-sn used to be -sP
-Pn used to be -PN or -P0 or for some reason -PD
-PE used to be -PI
-oG used to be -oM
--osscan-guess used to be --fuzzy

score 2 · Answer 2 · answered Apr 12 '13 at 18:51

2

As (almost) always, man NMAP(1) has the answer. Check the -sn (No port scan) entry:

In previous releases of Nmap, -sn was known as -sP

As far as I know, all the possible options are listed in the manpage.

answered Apr 12 '13 at 18:51

dawud

15,096
3
42
61

making sense of the nmap options

2 Answers2