Nmap Scan Types and Flags for PenTest+

Q: What is the difference between -sn and -Pn?

-sn finds which hosts are up and stops without port scanning. -Pn skips finding hosts and port scans every address as if it were up. People often mix them up because both change host discovery. Using both together, -Pn -sn, skips discovery and port scanning while still allowing NSE to run.

Guides › Study topics

Updated 1 Nov 2026 · 6 min read

On this page

How Nmap reports ports
Host discovery: -sn and -Pn
Scan types: -sS, -sT and -sU
Choosing ports with -p
Version, OS and script detection
Timing templates and output files
How this fits your exam
Frequently asked questions
Sources

This page explains the Nmap options you need to read and write scan commands with confidence: the scan types, host discovery, port selection, version, OS and script detection, timing templates and output formats. You will also know which options need root privileges and how to read the port states Nmap reports. Everything is taken from the official Nmap Reference Guide. Only scan systems you are authorised to test: the guide itself warns that some of these options should not be used against a network without permission.

How Nmap reports ports

By default, Nmap scans the most common 1,000 ports for each protocol. It then places each port in one of six states. The guide stresses that these states are not intrinsic properties of the port but describe how Nmap sees them, so the same port can look open from inside a network and filtered from the Internet.

State	Meaning
open	An application is actively accepting TCP connections, UDP datagrams or SCTP associations on the port.
closed	The port is reachable and responds, but no application is listening.
filtered	Packet filtering prevents probes reaching the port, so Nmap cannot tell whether it is open.
unfiltered	The port is accessible but Nmap cannot tell open from closed. Only the ACK scan uses this state.
open\|filtered	Nmap cannot tell open from filtered. The UDP, IP protocol, FIN, NULL and Xmas scans use this state.
closed\|filtered	Nmap cannot tell closed from filtered. Only the IP ID idle scan uses it.

Host discovery: -sn and -Pn

Before port scanning, Nmap works out which targets are up. If you give no discovery options and have raw packet privileges, it sends an ICMP echo request, a TCP SYN to port 443, a TCP ACK to port 80 and an ICMP timestamp request (the timestamp request is left out for IPv6). For targets on a local Ethernet network it uses ARP (IPv4) or Neighbor Discovery (IPv6) instead. An unprivileged Unix user gets a different default: a SYN to ports 80 and 443 using the connect system call.

-sn (no port scan) does host discovery only and prints the hosts that responded. It is often called a ping scan, and older Nmap releases called it -sP. -Pn (no ping) does the opposite: it skips host discovery and runs the requested scan against every target address as if it were up. The guide notes that with a /16 network, all 65,536 addresses are scanned. -Pn was previously -P0 and -PN.

Scan types: -sS, -sT and -sU

Most Nmap scan types send and receive raw packets, which requires root access on Unix systems. On Windows, the guide recommends an administrator account. Unprivileged users can only run the connect and FTP bounce scans. Only one TCP scan method can be used at a time, although a UDP scan (-sU) or an SCTP scan type can be combined with one TCP scan type.

Option	What it does	Root on Unix?
`-sS` TCP SYN scan	Sends a SYN and waits. SYN/ACK means open, RST means closed, no response after retransmissions means filtered. It never completes the TCP connection, so it is called half-open scanning. It is the default scan when you have raw packet privileges.	Yes
`-sT` TCP connect scan	Asks the operating system to make a full connection with the `connect` system call. It is the default TCP scan when SYN scan is not an option. It is slower and target machines are more likely to log the connection.	No
`-sU` UDP scan	Sends a UDP packet to each targeted port. An ICMP port unreachable error (type 3, code 3) means closed. No response after retransmissions gives open\|filtered.	Yes

UDP scanning is generally slower than TCP. The guide notes that the Linux 2.4.20 kernel limits destination unreachable messages to one per second, and that a Linux-style limit like that makes a 65,536-port scan take more than 18 hours. Adding -sV can help separate truly open UDP ports from filtered ones.

Choosing ports with -p

-p overrides the default port list. You can give single ports or hyphenated ranges such as -p 1-1023, and -p- scans ports 1 through 65535. When scanning TCP and UDP together, prefix ports with T: or U:, for example -p U:53,111,137,T:21-25,80,139,8080. To scan both protocols you must also specify -sU and at least one TCP scan type. -F reduces the default 1,000 ports to 100.

Version, OS and script detection

-sV enables version detection. After ports are found, it interrogates them to work out the service protocol, application name and version number, and sometimes the hostname, device type and OS family.

-O enables OS detection by TCP/IP stack fingerprinting. Nmap sends a series of TCP and UDP packets, examines the responses and compares the results with its database of more than 2,600 known OS fingerprints. The guide says OS detection is far more effective when at least one open and one closed TCP port are found.

-sC runs a script scan with the default set of Nmap Scripting Engine (NSE) scripts and is equivalent to --script=default. --script takes a comma-separated list of script files, categories, directories or expressions. The guide warns that some default scripts are intrusive and should not be run against a target network without permission, and that NSE includes dangerous scripts such as exploits, brute force authentication crackers and denial of service attacks.

-A turns on OS detection (-O), version scanning (-sV), script scanning (-sC) and traceroute (--traceroute) together. It does not set timing or verbosity. Parts that need privileges, such as OS detection and traceroute, are only enabled if you have them.

Timing templates and output files

-T0 to -T5

Option	Name	Guide's description
`-T0`	paranoid	For IDS evasion. Scans one port at a time and waits five minutes between probes.
`-T1`	sneaky	For IDS evasion. Waits 15 seconds between probes.
`-T2`	polite	Slows the scan to use less bandwidth and target resources. Waits 0.4 seconds between probes.
`-T3`	normal	The default, so `-T3` does nothing.
`-T4`	aggressive	Assumes a reasonably fast and reliable network.
`-T5`	insane	Assumes an extraordinarily fast network or accepts some lost accuracy for speed.

-oN, -oX, -oG and -oA

-oN writes normal output to a file, -oX writes XML, and -oG writes grepable output, which puts most of the information for each host on a single line. The guide describes grepable output as deprecated in favour of XML. -oA <basename> saves normal, XML and grepable output at once as .nmap, .xml and .gnmap files.

Putting it together, an authorised scan run as root might be:

nmap -sS -sV -O -p 1-1024 -T4 -oA webcheck <target>

That is a SYN scan of ports 1 to 1024 with version and OS detection, the aggressive timing template, and results saved in all three file formats.

How this fits your exam

CompTIA PenTest+ PT0-003: objective 2.4, "Given a scenario, use the appropriate tools for reconnaissance and enumeration", lists Nmap and the Nmap Scripting Engine (NSE). Objective 2.1 lists TCP/UDP scanning, and 2.2 lists OS fingerprinting, service discovery and host discovery. Objective 3.1 lists network scans, including TCP/UDP scans and stealth scans, and objective 4.2 lists Nmap and NSE among its tools. Objective 1.1 lists authorisation letters under legal and ethical considerations. Domain 2.0, Reconnaissance and Enumeration, is 21% of the exam. Read the PenTest+ PT0-003 study guide for the rest.

EC-Council CEH (312-50): the CEH Exam Blueprint v5.0, which EC-Council links from its 312-50 exam page, places Scanning Networks in the Reconnaissance Techniques domain (17%). It lists network scanning concepts, scanning tools, host discovery, port and service discovery, OS discovery (banner grabbing and OS fingerprinting), scanning beyond IDS and firewall, and network scanning countermeasures. See the CEH v13 study guide.

Frequently asked questions

Why does Nmap run a connect scan when I asked for the default?

The default is a SYN scan, but Nmap substitutes a connect scan (-sT) when you lack the privileges to send raw packets, which on Unix means you are not root.

What is the difference between -sn and -Pn?

-sn finds which hosts are up and stops without port scanning. -Pn skips finding hosts and port scans every address as if it were up. People often mix them up because both change host discovery. Using both together, -Pn -sn, skips discovery and port scanning while still allowing NSE to run.

Why are my UDP results full of open|filtered?

Open and filtered UDP ports rarely send any response, so a silent port cannot be classified further by the UDP scan alone. Version detection (-sV) tries to get a response from those ports and changes the state to open if it succeeds.

Sources

Check your flag knowledge with the PenTest+ PT0-003 practice questions, then plan your revision with the PenTest+ exam guide.