Documentation

The Nmap project tries to defy the stereotype of some open source software being poorly documented by providing a comprehensive set of documentation for installing and using Nmap. This page links to official Insecure.Org documentation, and generous contributions from other parties.

Nmap Reference Guide

The primary documentation for using Nmap is the Nmap Reference Guide. This is also the basis for the Nmap man page (nroff version of nmap.1). It is regularly updated for each release and is meant to serve as a quick-reference to virtually all Nmap command-line arguments, but you can learn even more about Nmap by reading it straight through. The 18 sections include Brief Options Summary, Firewall/IDS Evasion and Spoofing, Timing and Performance, Port Scanning Techniques, Usage Examples, and much more.

The original Nmap manpage has been translated into 15 languages. That is fantastic, as it makes Nmap more accessible around the world. The following languages are now available:

The links above go to the HTML guide. Nroff (man page format) and DocBook XML (source) versions of each man page translation can be found here. If you would like to update one of our existing translations or translate to a language not mentioned above, please read the instructions and FAQ and then mail our developers or open a pull request on Github. It is a lot of work, but the reward is that thousands of people may benefit from your translation every month.

Nmap Book

Nmap Network Scanning front cover Nmap Network Scanning is the official guide to Nmap. From explaining port scanning basics for novices to detailing low-level packet crafting methods used by advanced hackers, this book by Nmap's original author suits all levels of security and networking professionals. The reference guide documents every Nmap feature and option, while the remainder demonstrates how to apply them to quickly solve real-world tasks. Examples and diagrams show actual communication on the wire. Topics include subverting firewalls and intrusion detection systems, optimizing Nmap performance, and automating common networking tasks with the Nmap Scripting Engine. More than half of the book is available free online. It was written in English but has already been translated to other languages.

Other Insecure.Org Documentation

Installation is made easy by the detailed Nmap Installation Guide. This covers topics such as UNIX compilation and configure directives and Installing Nmap on Linux, Windows, Mac OS X, Free/Open/NetBSD, Solaris, Amiga, and HP-UX. It also covers Nmap removal in case you change your mind.

One of Nmap's most exciting new features is the Nmap Scripting Engine, which extends Nmap's functionality using the simple and efficient Lua programming language. Nmap includes about 50 valuable scripts for network discovery and vulnerability detection, and you can also write your own. We describe the system in depth (from simple usage instructions to writing your own scripts) in our NSE guide. We also have an NSE Documentation Portal which includes detailed documentation for every NSE script and library.

Fyodor regularly gives conference presentations covering advanced Nmap usage and new features. Audio, video, and/or slides for many of these are available on his presentations page.

Interested in how nmap uses TCP/IP fingerprinting for remote OS detection? We have written a detailed article on the 2nd Generation Nmap OS Detection System. We also have an old article about the 1st generation system, which people have generously translated into French, Portuguese, Italian, Russian, Spanish, German, Japanese, Chinese, Traditional Chinese (Big5), Turkish, Hebrew, Indonesian, Dutch. Polish, and Swedish.

Nmap Version Detection: Instead of using a simple nmap-services table lookup to determine a port's likely purpose, Nmap will (if asked) interrogate that TCP or UDP port to determine what service is really listening. In many cases it can determine the application name and version number as well. Obstacles like SSL encryption and Sun RPC are no threat, as Nmap can connect using OpenSSL (if available) as well as utilizing Nmap's RPC bruteforcer. IPv6 is also supported. Learn all about this great feature in our Version Detection Paper

Nmap now has an official cross-platform GUI named Zenmap. It is included in most of the packages on the Nmap download page. It is documented in the Zenmap User's Guide. More information is available from the Zenmap site and Zenmap man page.

One of the coolest, yet still relatively obscure features of Nmap is the IPID Idle scan (-sI). Not only does this allow for a completely blind portscan (no packets sent to the target from your real IP), but it can even allow you to bypass packet filters in certain circumstances. We wrote a Idle scanning paper describing this technique as well as several other exploits based on predictable IPID sequence numbers. It includes real-life examples as well as a section on defending yourself from these techniques.

The most important changes (features, bugfixes, etc) in each Nmap version are described in its ChangeLog.

While it is now only of historical interest, Nmap was first released in a September 1, 1997 Phrack 51 Article titled The Art of Port Scanning

More Books

This section covers books written/co-authored by Nmap author Fyodor or that cover Nmap extensively.

3rd Party Docs

Some of the best (and certainly most creative!) documentation has been contributed by Nmap users themselves. If you write an interesting or useful document about Nmap, please send the announcement to nmap-dev or directly to Fyodor.

James “Professor” Messer's "Nmap Secrets" training course is no longer available, but he still has lots of Nmap-related content at ProfessorMesser.Com.

A detailed Nmap Tutorial was maintained between 2003 and 2006 by Andrew Bennieston (Stormhawk).

Mohamed Aly has created this single-page (PDF) Nmap Mindmap as a convenient reference to all of the major Nmap options. [2006]

Mark Wolfgang has written an excellent paper on advanced host discovery using Nmap. Here is the PDF paper [local copy] and associated source code. [2002]

Adrian Crenshaw has made a couple excellent video tutorials in Flash. Check out Volume 1: Basic Nmap Usage and Volume 2: Port Scan Boogaloo. [2005]

Long-time Nmap contributor Lamont Granquist wrote a clear and useful (if dated) guide to getting started with nmap. [1999]

Raven Alder has written a short guide named Nmap -- looking from the outside in for LinuxChix. [2002]

Uh-oh! Security expert and Counter Hack author Ed Skoudis has discovered our secret partnership with Microsoft!