Nmap

https://nmap.org/book/
Admin
Nmap is a free and open source utility for network exploration and security auditing, useful for...
Tokens:210,055
Snippets:2,972
Trust Score:9.9
Update:3 months ago
Show doc for...
Tokens:
Raw
### Script Help Example

Source: https://nmap.org/book/toc.html

Demonstrates how to get help information for a specific Nmap Scripting Engine (NSE) script using the `--script-help` option.

```bash
nmap --script-help <script_name>
```

--------------------------------

### Install Visual C++ Redistributable Quietly

Source: https://nmap.org/book/inst-windows.html

Run the Visual C++ Redistributable installer with the /q option for a quiet (non-interactive) installation.

```bash
vc_redist.x86.exe /q
```

--------------------------------

### Install Npcap Quietly

Source: https://nmap.org/book/inst-windows.html

When installing Npcap from the zip file, use the /q option for a quiet (non-interactive) installation.

```bash
npcap-_<version>_ -oem.exe /q
```

--------------------------------

### Installing Nmap

Source: https://nmap.org/book/inst-source.html

Install Nmap, support files, and documentation system-wide. This step typically requires root privileges.

```bash
make install
```

--------------------------------

### Start Zenmap with a Specific Profile

Source: https://nmap.org/book/zenmap-command-line.html

Use the -p or --profile option to start Zenmap with a predefined profile selected.

```bash
zenmap --profile "Regular scan"
```

```bash
zenmap -p "Regular scan"
```

--------------------------------

### Normal Output Example

Source: https://nmap.org/book/toc.html

Shows a typical example of Nmap's standard, non-verbose output. This format is clean and focuses on key scan results.

```text
Nmap scan report for scanme.nmap.org (45.33.32.156)
Host is up (0.21s latency).
Not shown: 997 closed ports
PORT    STATE SERVICE
22/tcp  open  ssh
80/tcp  open  http
9929/tcp open  nping-echo

```

--------------------------------

### Install Nmap using Fink

Source: https://nmap.org/book/inst-macosx.html

Use this command to install Nmap via the Fink package manager. Nmap will be installed to `/sw/bin/nmap`.

```bash
fink install nmap
```

--------------------------------

### Scanrand Output Example

Source: https://nmap.org/book/output.html

This example shows the output of the Scanrand port scanner against a local network. It highlights potential issues with output organization and readability.

```bash
bash-2.05a# **scanrand 10.0.1.1-254:quick**
  UP:        10.0.1.38:80    [01]   0.003s
  UP:       10.0.1.110:443   [01]   0.017s
  UP:       10.0.1.254:443   [01]   0.021s
  UP:        10.0.1.57:445   [01]   0.024s
  UP:        10.0.1.59:445   [01]   0.024s
  UP:        10.0.1.38:22    [01]   0.047s
  UP:       10.0.1.110:22    [01]   0.058s
  UP:       10.0.1.110:23    [01]   0.058s
  UP:       10.0.1.254:22    [01]   0.077s
  UP:       10.0.1.254:23    [01]   0.077s
  UP:        10.0.1.25:135   [01]   0.088s
  UP:        10.0.1.57:135   [01]   0.089s
  UP:        10.0.1.59:135   [01]   0.090s
  UP:        10.0.1.25:139   [01]   0.097s
  UP:        10.0.1.27:139   [01]   0.098s
  UP:        10.0.1.57:139   [01]   0.099s
  UP:        10.0.1.59:139   [01]   0.099s
  UP:        10.0.1.38:111   [01]   0.127s
  UP:        10.0.1.57:1025  [01]   0.147s
  UP:        10.0.1.59:1025  [01]   0.147s
  UP:        10.0.1.57:5000  [01]   0.156s
  UP:        10.0.1.59:5000  [01]   0.157s
  UP:        10.0.1.53:111   [01]   0.182s
bash-2.05a#

```

--------------------------------

### Install OpenBSD Nmap Package

Source: https://nmap.org/book/inst-other-platforms.html

Installs the Nmap binary package on OpenBSD using the pkg_add command. Requires root privileges.

```bash
pkg_add -v nmap-_<version>_.tgz
```

--------------------------------

### Install DEB package using Dpkg

Source: https://nmap.org/book/inst-linux.html

Install a Debian package (.deb) that has been converted from an RPM using the 'dpkg' command.

```bash
sudo dpkg --install nmap_5.21-2_amd64.deb
```

--------------------------------

### Nmap Version Detection Example 2

Source: https://nmap.org/book/vscan-examples.html

A comprehensive example of version detection against a local host, showcasing a wide range of services and their detected versions, including SSL-wrapped services and RPC services.

```bash
# **nmap -A -T4 localhost **

Starting Nmap ( https://nmap.org )
Nmap scan report for felix (127.0.0.1)
(The 1640 ports scanned but not shown below are in state: closed)
PORT     STATE SERVICE    VERSION
21/tcp   open  ftp        WU-FTPD wu-2.6.1-20
22/tcp   open  ssh        OpenSSH 3.1p1 (protocol 1.99)
53/tcp   open  domain     ISC BIND 9.2.1
79/tcp   open  finger     Linux fingerd
111/tcp  open  rpcbind    2 (rpc #100000)
443/tcp  open  ssl/http   Apache httpd 2.0.39 ((Unix) mod_perl/1.99_04-dev)
515/tcp  open  printer
631/tcp  open  ipp        CUPS 1.1
953/tcp  open  rndc?
5000/tcp open  ssl/ftp    WU-FTPD wu-2.6.1-20
5001/tcp open  ssl/ssh    OpenSSH 3.1p1 (protocol 1.99)
5002/tcp open  ssl/domain ISC BIND 9.2.1
5003/tcp open  ssl/finger Linux fingerd
6000/tcp open  X11        (access denied)
8000/tcp open  http-proxy Junkbuster webproxy
8080/tcp open  http       Apache httpd 2.0.39 ((Unix) mod_perl/1.99_04-dev)
8081/tcp open  http       Apache httpd 2.0.39 ((Unix) mod_perl/1.99_04-dev)
Device type: general purpose
Running: Linux 2.4.X|2.5.X
OS details: Linux Kernel 2.4.0 - 2.5.20

Nmap finished: 1 IP address (1 host up) scanned in 42.494 seconds

```

--------------------------------

### Build and Install Nmap from Source RPMs

Source: https://nmap.org/book/inst-linux.html

Rebuilds a source RPM to create a binary RPM, then installs the newly created binary RPM. This is an alternative when pre-built binaries are not suitable.

```bash
> **rpmbuild --rebuild https://nmap.org/dist/nmap-4.68-1.src.rpm**
[ hundreds of lines cut ]
Wrote: /home/fyodor/rpmdir/RPMS/i386/nmap-4.68-1.i386.rpm
[ cut ]
> **su**
Password: 
# **rpm -vhU /home/fyodor/rpmdir/RPMS/i386/nmap-4.68-1.i386.rpm**
Preparing...                ########################################### [100%]
   1:nmap                   ########################################### [100%]
#
```

--------------------------------

### Install OpenBSD Nmap from Source Ports

Source: https://nmap.org/book/inst-other-platforms.html

Installs Nmap from the OpenBSD source ports tree. Requires root privileges and a pre-existing ports tree.

```bash
cd /usr/ports/net/nmap && make install clean
```

--------------------------------

### Nmap Version Detection Output Example

Source: https://nmap.org/book/vscan.html

This example shows the typical output when using Nmap for version detection. It illustrates the detailed assessment of running services beyond just open port numbers.

```text
Nmap scan report for localhost (127.0.0.1)
Host is up (0.00020s latency).
Not shown: 997 closed ports
PORT    STATE SERVICE
22/tcp  open  ssh
80/tcp  open  http
443/tcp open  https

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 12.34 seconds
```

--------------------------------

### Start Zenmap Scan with Profile and Target

Source: https://nmap.org/book/zenmap-command-line.html

Combine -p and -t to initiate a scan with a specific profile against a given target immediately upon starting Zenmap.

```bash
zenmap -p "Regular scan" -t <target>
```

```bash
zenmap -t <target> -p "Regular scan"
```

--------------------------------

### Install FreeBSD Nmap Package

Source: https://nmap.org/book/inst-other-platforms.html

Installs the Nmap binary package on FreeBSD using the pkg_add command. The -r flag attempts to find the package automatically. Requires root privileges.

```bash
pkg_add -r nmap
```

--------------------------------

### Connect-style Network I/O Example

Source: https://nmap.org/book/nse-api.html

Demonstrates creating a socket, connecting, sending data, receiving a response, and closing the socket using connect-style network operations. Error handling is managed with nmap.new_try.

```lua
require("nmap")

local socket = nmap.new_socket()
socket:set_timeout(1000)
try = nmap.new_try(function() socket:close() end)
try(socket:connect(host.ip, port.number))
try(socket:send("login"))
response = try(socket:receive())
socket:close()


```

--------------------------------

### Scan Ports Matching Wildcard with Nmap

Source: https://nmap.org/book/port-scanning-options.html

Use wildcards to match ports with similar names. This example matches ports starting with 'http'. Escape the asterisk if your shell treats it as a filename glob.

```bash
-p http*
```

--------------------------------

### Enumerating RPC Services with rpcinfo

Source: https://nmap.org/book/vscan-post-processors.html

This example demonstrates how to use the Unix rpcinfo command to enumerate RPC services running on a target host. It shows the program number, version, protocol, and port for each service.

```bash
> rpcinfo -p ultra
   program vers proto   port
    100000    4   tcp    111  rpcbind
    100000    4   udp    111  rpcbind
    100232   10   udp  32777  sadmind
    100083    1   tcp  32775  ttdbserverd
    100221    1   tcp  32777  kcms_server
    100068    5   udp  32778  cmsd
    100229    1   tcp  32779  metad
    100230    1   tcp  32781  metamhd
    100242    1   tcp  32783  rpc.metamedd
    100001    4   udp  32780  rstatd
    100002    3   udp  32782  rusersd
    100002    3   tcp  32785  rusersd
    100008    1   udp  32784  walld
    100012    1   udp  32786  sprayd
    100011    1   udp  32788  rquotad
    100024    1   udp  32790  status
    100024    1   tcp  32787  status
    100133    1   udp  32790  nsm_addrand
    100133    1   tcp  32787  nsm_addrand
 _    [ Dozens of lines cut for brevity ]_
```

--------------------------------

### Scan Ports from Beginning/End of Range with Nmap

Source: https://nmap.org/book/port-scanning-options.html

Omit the start or end of a range to imply port one or the last possible port (65535). This example scans ports 1-100 and all ports from 60,000 upwards.

```bash
-p-100,60000-
```

--------------------------------

### Silent Installation

Source: https://nmap.org/book/inst-windows.html

Nmap OEM installers accept the /S option for silent installation.

```bash
/S
```

--------------------------------

### Zenmap Configuration File Excerpt

Source: https://nmap.org/book/zenmap-conf.html

An example excerpt from the `zenmap.conf` file, illustrating the INI-like structure with sections and key-value pairs for output highlighting, paths, and search settings.

```ini
[output_highlight]
enable_highlight = True

[paths]
nmap_command_path = nmap
ndiff_command_path = ndiff

[search]
search_db = 1
file_extension = xml
store_results = 1
directory = 
save_time = 60;days

```

--------------------------------

### Install Nmap using MacPorts

Source: https://nmap.org/book/inst-macosx.html

Use this command with sudo to install Nmap via the MacPorts package manager. Nmap will be installed to `/opt/local/bin/nmap`.

```bash
sudo port install nmap
```

--------------------------------

### Initialize a New Translation File

Source: https://nmap.org/book/zenmap-lang.html

Use msginit to create a new portable object (.po) file for a specific language (e.g., 'es' for Spanish) from the Zenmap template file (zenmap.pot).

```bash
msginit -l es.po -i zenmap.pot
```

--------------------------------

### ASN Query Script Usage

Source: https://nmap.org/book/nsedoc.html

Example of how to run the asn-query script. It shows the basic command and how to specify a custom DNS server.

```bash
nmap --script asn-query [--script-args dns=<DNS server>] <target>
```

--------------------------------

### Install Nmap using Yum

Source: https://nmap.org/book/inst-linux.html

Use this command to install Nmap on Red Hat, Fedora, Mandrake, and Yellow Dog Linux distributions that use Yum. This command also installs Zenmap if available.

```bash
flog~# **yum install nmap**
Setting up Install Process
Parsing package install arguments
Resolving Dependencies
--> Running transaction check
---> Package nmap.x86_64 2:4.52-1.fc8 set to be updated
--> Finished Dependency Resolution
Dependencies Resolved
=============================================================================
 Package                 Arch       Version          Repository        Size 
=============================================================================
Installing:
 nmap                    x86_64     2:4.52-1.fc8     updates           1.0 M

Transaction Summary
=============================================================================
Install      1 Package(s)         
Update       0 Package(s)         
Remove       0 Package(s)         

Total download size: 1.0 M
Is this ok [y/N]: y
Downloading Packages:
(1/1): nmap-4.52-1.fc8.x8 100% |=========================| 1.0 MB    00:02     
Running Transaction Test
Transaction Test Succeeded
Running Transaction
  Installing: nmap                         ######################### [1/1] 

Installed: nmap.x86_64 2:4.52-1.fc8
Complete!

```

--------------------------------

### Change Installation Directory

Source: https://nmap.org/book/inst-windows.html

Use the /D option to specify a custom installation directory for Nmap.

```bash
/D
```

--------------------------------

### IPv6 Fingerprint Example

Source: https://nmap.org/book/osdetect-fingerprint-format.html

An example of a raw IPv6 fingerprint in its ASCII-armored format, as captured by Nmap.

```text
OS:SCAN(V=5.61TEST1%E=6%D=9/27%OT=22%CT=443%CU=42192%PV=N%DS=5%DC=T%G=Y%TM
OS:=4E82908D%P=x86_64-unknown-linux-gnu)S1(P=6000{4}28063cXX{32}0016c1b002
OS:bbd213c57562f5a01212e0f8880000020404c40402080a5be177f2ff{4}01030307%ST=
OS:0.021271%RT=0.041661)S2(P=6000{4}28063cXX{32}0016c1b108d7da47c57562f6a0
OS:1212e0e9d20000020404c40402080a5be17856ff{4}01030307%ST=0.121251%RT=0.14
OS:4586)S3(P=6000{4}28063cXX{32}0016c1b21029efebc57562f7a01212e0cf63000002
OS:0404c40101080a5be178ceff{4}01030307%ST=0.221232%RT=0.268086)S4(P=6000{4
OS:}28063cXX{32}0016c1b31553d32dc57562f8a01212e0e3a40000020404c40402080a5b
OS:e1791eff{4}01030307%ST=0.321237%RT=0.340261)S5(P=6000{4}28063cXX{32}001
OS:6c1b41ae90087c57562f9a01212e0b04f0000020404c40402080a5be17982ff{4}01030
OS:307%ST=0.421246%RT=0.441253)S6(P=6000{4}24063cXX{32}0016c1b5207baa83c57
OS:562fa901212e014690000020404c40402080a5be179e6ff{4}%ST=0.521245%RT=0.541
OS:755)IE1(P=6000{4}803a3cXX{32}810927cbabcd00{122}%ST=0.565533%RT=0.59350
OS:5)U1(P=6000{3}01643a3cXX{32}0104be5300{4}6001234501341131XX{32}c1a9a4d0
OS:013482ff43{300}%ST=0.713832%RT=0.734263)TECN(P=6000{4}20063cXX{32}0016c
OS:1b62f0c74d8c57562fb80121310241c0000020404c40101040201030307%ST=0.763567
OS:%RT=0.784838)T2(P=6000{4}583a3cXX{32}0101ca5600{4}6001234500280632XX{32
OS:}c1b70016c57562fb85549cefa00000808c0d000003030a0102040109080aff{4}00{4}
OS:0402%ST=0.813012%RT=0.833344)T3(P=6000{4}583a3cXX{32}0101ca6000{4}60012
OS:34500280628XX{32}c1b80016c57562fc2b8e3db7a02b0100445f000003030a01020401
OS:09080aff{4}00{4}0402%ST=0.863293%RT=0.881198)T4(P=6000{4}14063cXX{32}00
OS:16c1b93a67fc8a00{4}500400000c7c0000%ST=0.912394%RT=0.93247)T5(P=6000{4}
OS:14063cXX{32}01bbc1ba00{4}c57562ff5014000019430000%ST=0.96164%RT=0.98347
OS:5)T6(P=6000{4}14063cXX{32}01bbc1bba9e336d500{4}50040000610e0000%ST=1.01
OS:164%RT=1.03554)T7(P=6000{4}583a3cXX{32}0101ca5800{4}6001234500280630XX{
OS:32}c1bc01bbc5756300095eb241a029ffffec59000003030f0102040109080aff{4}00{
OS:4}0402%ST=1.06173%RT=1.07961)EXTRA(FL=12345)
```

--------------------------------

### Example Host OS Table

Source: https://nmap.org/book/nse-api.html

A concrete example of the 'host.os' Lua table, derived from an Nmap OS detection fingerprint. It shows how OS match details, including vendor, OS family, generation, type, and CPE entries, are represented.

```lua
host.os = {
  {
    name = "Linux 2.6.32 - 3.2",
    classes = {
      {
        vendor = "Linux",
        osfamily = "Linux",
        osgen = "2.6.X",
        type = "general purpose",
        cpe = { "cpe:/o:linux:linux_kernel:2.6" }
      },
      {
        vendor = "Linux",
        osfamily = "Linux",
        osgen = "3.X",
        type = "general purpose",
        cpe = { "cpe:/o:linux:linux_kernel:3" }
      }
    },
  }
}

```

--------------------------------

### Bandwidth Usage Example

Source: https://nmap.org/book/toc.html

Illustrates how to monitor bandwidth usage on a local network during an Nmap scan. Useful for understanding network impact.

```bash
nmap --bandwidth -T4 <target_network>
```

--------------------------------

### Install Nmap using Apt-get

Source: https://nmap.org/book/inst-linux.html

This command installs Nmap on Debian, Ubuntu, and other Debian-based Linux distributions.

```bash
apt-get install nmap
```

--------------------------------

### Nmap Installer Options

Source: https://nmap.org/book/inst-windows.html

Use these command-line options to customize the Nmap installation. By default, all components are selected.

```bash
/NMAP=NO
    Don't install Nmap
```

```bash
/NPCAP=NO
    Don't install Npcap. Unless Npcap is installed separately, some features of Nmap and Nping will not work.
```

```bash
/NCAT=NO
    Don't install Ncat.
```

```bash
/NPING=NO
    Don't install Nping.
```

```bash
/ZENMAP=NO
    Don't install Zenmap. Nmap OEM does not include Zenmap.
```

```bash
/NDIFF=NO
    Don't install Ndiff. Nmap OEM does not include Ndiff.
```

```bash
/REGISTRYMODS=NO
    Don't install performance-related registry modifications.
```

```bash
/REGISTERPATH=NO
    Don't add the installation directory to `PATH`.
```

--------------------------------

### Show Zenmap Help Message

Source: https://nmap.org/book/zenmap-command-line.html

Display a help message detailing all available command-line options.

```bash
zenmap --help
```

```bash
zenmap -h
```

--------------------------------

### Enabling OS and Version Detection with -A

Source: https://nmap.org/book/osdetect-usage.html

The -A option enables OS detection, version detection, script scanning, and traceroute. It's a comprehensive option for gathering detailed information about a host.

```bash
nmap -A target.example.com
```

--------------------------------

### Version Detection Against Microsoft

Source: https://nmap.org/book/toc.html

An example of using version detection against www.microsoft.com to identify specific services and versions running on their servers.

```bash
nmap -sV www.microsoft.com
```

--------------------------------

### Nmap Bandwidth Usage Example

Source: https://nmap.org/book/reduce-scantime.html

This example demonstrates how to monitor Nmap's bandwidth usage by running a verbose scan and observing the raw packet counts and execution time. This helps determine if network hardware is a limiting factor.

```bash
# **nmap -v -n -p- sec.titan.net**

Starting Nmap ( https://nmap.org )
[10 lines cut]
Nmap scan report for 192.168.0.8
Not shown: 65534 closed ports
PORT   STATE SERVICE
22/tcp open  ssh
MAC Address: 00:1A:6B:C1:33:37 (USI)

Nmap done: 1 IP address (1 host up) scanned in 2.20 seconds
           Raw packets sent: 65536 (2.884MB) | Rcvd: 65536 (2.621MB) 

```

--------------------------------

### NSEDoc Output Tag Example

Source: https://nmap.org/book/nse-tutorial.html

Provides an example of the @output NSEDoc tag, illustrating the expected output format for a script.

```lua
--@output
-- 21/tcp   open     ftp       ProFTPD 1.3.1
-- |_ auth-owners: nobody
-- 22/tcp   open     ssh       OpenSSH 4.3p2 Debian 9etch2 (protocol 2.0)
-- |_ auth-owners: root
-- 25/tcp   open     smtp      Postfix smtpd
-- |_ auth-owners: postfix
-- 80/tcp   open     http      Apache httpd 2.0.61 ((Unix) PHP/4.4.7 ...)
-- |_ auth-owners: dhapache
-- 113/tcp  open     auth?
-- |_ auth-owners: nobody
-- 587/tcp  open     submission Postfix smtpd
-- |_ auth-owners: postfix
-- 5666/tcp open     unknown
-- |_ auth-owners: root
```

--------------------------------

### Example NSE Script Help Output

Source: https://nmap.org/book/nse-usage.html

Sample output when requesting help for specific NSE scripts. This includes script names, categories, and descriptions.

```text
$ nmap --script-help "afp-* and discovery"

Starting Nmap 7.40 ( https://nmap.org ) at 2017-04-21 14:15 UTC

afp-ls
Categories: discovery safe
https://nmap.org/nsedoc/scripts/afp-ls.html
  Attempts to get useful information about files from AFP volumes.
  The output is intended to resemble the output of ls.

afp-serverinfo
Categories: default discovery safe
https://nmap.org/nsedoc/scripts/afp-serverinfo.html
  Shows AFP server information. This information includes the server's
  hostname, IPv4 and IPv6 addresses, and hardware type (for example
  Macmini or MacBookPro).

afp-showmount
Categories: discovery safe
https://nmap.org/nsedoc/scripts/afp-showmount.html
  Shows AFP shares and ACLs.


```

--------------------------------

### Nmap Service Fingerprint Example

Source: https://nmap.org/book/vscan-community.html

An example of a service fingerprint generated by Nmap when it cannot identify a service. This output is used for community submissions.

```text
SF-Port21-TCP:V=3.40PVT16%D=9/6%Time=3F5A961C%r(NULL,3F,"220\x20stage\x20F
SF:TP\x20server\x20\(Version\x202\.1WU\(1\)\+SCO-2\.6\.1\+-sec\)\x20ready
SF:"')%r(GenericLines,81,"220\x20stage\x20FTP\x20server\x20\(Version
SF:202.1WU(1)+SCO-2.6.1+-sec) ready.
500 '': command not understood.
500 '': command not understood.
");

```

--------------------------------

### Install Alien for RPM to DEB conversion

Source: https://nmap.org/book/inst-linux.html

Install the 'alien' command on Debian/Ubuntu systems to convert RPM packages to the Debian (.deb) format.

```bash
sudo apt-get install alien
```

--------------------------------

### Nping TCP Probe Example

Source: https://nmap.org/book/determining-firewall-rules.html

This example demonstrates sending TCP probes to a target port and analyzing the responses. Observe the sequential IP ID fields in the received packets to determine if the firewall is predictable.

```bash
nping -c 5 --delay 1 -p 80 --tcp playground
```

--------------------------------

### Example Debug Output

Source: https://nmap.org/book/nping-man.html

An example of the detailed debug output that Nping can produce, which may include information about Nsock callbacks and event handlers.

```text
NSOCK (1.0000s) Callback: TIMER SUCCESS for EID 12; tcpconnect_event_handler(): Received callback of type TIMER with status SUCCESS
```

--------------------------------

### Basic TCP Port Scan with Nping

Source: https://nmap.org/book/nping-man.html

This example demonstrates a basic Nping execution using TCP probe mode to scan specific ports on multiple hosts. It shows how to specify the number of probes, the protocol, and target ports.

```bash
# **nping -c 1 --tcp -p 80,433 scanme.nmap.org google.com**

Starting Nping ( https://nmap.org/nping )
SENT (0.0120s) TCP 96.16.226.135:50091 > 64.13.134.52:80 S ttl=64 id=52072 iplen=40  seq=1077657388 win=1480 
RCVD (0.1810s) TCP 64.13.134.52:80 > 96.16.226.135:50091 SA ttl=53 id=0 iplen=44  seq=4158134847 win=5840 <mss 1460>
SENT (1.0140s) TCP 96.16.226.135:50091 > 74.125.45.100:80 S ttl=64 id=13932 iplen=40  seq=1077657388 win=1480 
RCVD (1.1370s) TCP 74.125.45.100:80 > 96.16.226.135:50091 SA ttl=52 id=52913 iplen=44  seq=2650443864 win=5720 <mss 1430>
SENT (2.0140s) TCP 96.16.226.135:50091 > 64.13.134.52:433 S ttl=64 id=8373 iplen=40  seq=1077657388 win=1480 
SENT (3.0140s) TCP 96.16.226.135:50091 > 74.125.45.100:433 S ttl=64 id=23624 iplen=40  seq=1077657388 win=1480 

Statistics for host scanme.nmap.org (64.13.134.52):
 |  Probes Sent: 2 | Rcvd: 1 | Lost: 1  (50.00%)
 |_ Max rtt: 169.720ms | Min rtt: 169.720ms | Avg rtt: 169.720ms
Statistics for host google.com (74.125.45.100):
 |  Probes Sent: 2 | Rcvd: 1 | Lost: 1  (50.00%)
 |_ Max rtt: 122.686ms | Min rtt: 122.686ms | Avg rtt: 122.686ms
Raw packets sent: 4 (160B) | Rcvd: 2 (92B) | Lost: 2 (50.00%)
Tx time: 3.00296s | Tx bytes/s: 53.28 | Tx pkts/s: 1.33
Rx time: 3.00296s | Rx bytes/s: 30.64 | Rx pkts/s: 0.67
Nping done: 2 IP addresses pinged in 4.01 seconds

```

--------------------------------

### SSL Ports Directive Example

Source: https://nmap.org/book/vscan-fileformat.html

An example of the `sslports` directive, which is similar to `ports` but specifies ports commonly used to wrap a service in SSL.

```nmap-service-probes
sslports 443
```

--------------------------------

### BSD-Style License Example

Source: https://nmap.org/book/nse-script-format.html

Specifies a BSD-style license for the script, allowing for alternative licensing.

```lua
license = "Simplified (2-clause) BSD license--See https://nmap.org/svn/docs/licenses/BSD-simplified"
```

--------------------------------

### Nmap SYN Scan Example

Source: https://nmap.org/book/scan-methods-null-fin-xmas-scan.html

Demonstrates a SYN scan on a SCO/Caldera machine. This is an example of a common scan type used for network reconnaissance.

```bash
nmap -sS Docsrv
```

--------------------------------

### Install FreeBSD Nmap from Source Ports

Source: https://nmap.org/book/inst-other-platforms.html

Installs Nmap from the FreeBSD source ports tree. Requires root privileges and a pre-existing ports tree.

```bash
cd /usr/ports/security/nmap && make install clean
```

--------------------------------

### Create HTTP Proxy Server

Source: https://nmap.org/book/ncat-man.html

Create an HTTP proxy server listening on a specified local address and port.

```bash
ncat -l --proxy-type http localhost 8888
```

--------------------------------

### NSE Script Dependencies Example

Source: https://nmap.org/book/nse-script-format.html

Lists other NSE scripts that must be executed before this script if they are also selected.

```lua
dependencies = {"smb-brute"}
```

--------------------------------

### Typical Grepable Output Example

Source: https://nmap.org/book/output-formats-grepable-output.html

Demonstrates the structure of Nmap's grepable output, including comment lines and host information. This format is useful for parsing with standard Unix tools.

```text
# **nmap -T4 -A -v -oG - scanme.nmap.org**
# Nmap 5.35DC18 scan initiated [time] as: nmap -T4 -A -v -oG - scanme.nmap.org
# Ports scanned: TCP(1000;1,3-4,6-7,...,,65389) UDP(0;) SCTP(0;) PROTOCOLS(0;)
Host: 64.13.134.52 (scanme.nmap.org)	Status: Up
Host: 64.13.134.52 (scanme.nmap.org)	Ports: 22/open/tcp//ssh//OpenSSH 4.3 (protocol 2.0)/, 25/closed/tcp//smtp///, 53/open/tcp//domain///, 70/closed/tcp//gopher///, 80/open/tcp//http//Apache httpd 2.2.3 ((CentOS))/, 113/closed/tcp//auth///, 31337/closed/tcp//Elite///  Ignored State: filtered (993)   OS: Linux 2.6.13 - 2.6.31       Seq Index: 204  IP ID Seq: All zeros
# Nmap done at [time] -- 1 IP address (1 host up) scanned in 21.90 seconds

```

--------------------------------

### Exclude Directive Example

Source: https://nmap.org/book/vscan-fileformat.html

Example of the `Exclude` directive, which takes a comma-separated list of ports to exclude from probing. The format is the same as Nmap's `-p` switch.

```nmap-service-probes
Exclude T:9100-9107
```

--------------------------------

### ASN Query Script Output Example

Source: https://nmap.org/book/nsedoc.html

Demonstrates the expected output format for the asn-query script, showing BGP prefixes, country, and origin/peer AS information.

```text
Host script results:
|  asn-query:
|  BGP: 64.13.128.0/21 | Country: US
|    Origin AS: 10565 SVCOLO-AS - Silicon Valley Colocation, Inc.
|      Peer AS: 3561 6461
|  BGP: 64.13.128.0/18 | Country: US
|    Origin AS: 10565 SVCOLO-AS - Silicon Valley Colocation, Inc.
|_     Peer AS: 174 2914 6461
```

--------------------------------

### Total Wait Milliseconds Directive Example

Source: https://nmap.org/book/vscan-fileformat.html

Example of the `totalwaitms` directive, which sets the maximum time Nmap should wait before giving up on a probe against a specific service.

```nmap-service-probes
totalwaitms 6000
```

--------------------------------

### Example Fingerprint Lines

Source: https://nmap.org/book/osdetect-fingerprint-format.html

Illustrates various formats for the 'Fingerprint' line, showing vendor, product, and version details.

```text
Fingerprint HP LaserJet printer (4050, 4100, 4200, or 8150)
Fingerprint Sun Solaris 9 or 10 (SPARC)
Fingerprint Linux 2.6.22 - 2.6.24
Fingerprint Microsoft Windows Server 2003 SP1
Fingerprint Microsoft Windows XP Professional SP1
Fingerprint Minolta Di550 laser printer
```
Tokens:
Raw