Script nat-pmp-mapport

Script types: portrule
Categories: discovery, safe

Script Summary

Maps a WAN port on the router to a local port on the client using the NAT Port Mapping Protocol (NAT-PMP). It supports the following operations:

  • map - maps a new external port on the router to an internal port of the requesting IP
  • unmap - unmaps a previously mapped port for the requesting IP
  • unmapall - unmaps all previously mapped ports for the requesting IP

See also:

Script Arguments


operation, can be either map, unmap or unmap all o map allows you to map an external port to an internal port of the calling IP o unmap removes the external port mapping for the specified ports and protocol o unmapall removes all mappings for the specified protocol and calling IP


the protocol to map, can be either tcp or udp.


the internal port of the calling IP to map requests to. This port will receive all requests coming in to the external port on the router.


the external port to map on the router. The specified port is treated as the requested port. If the port is available it will be allocated to the caller, otherwise the router will simply choose another port, create the mapping and return the resulting port.


the lifetime of the mapping in seconds (default: 3600)

Example Usage

nmap -sU -p 5351 <ip> --script nat-pmp-mapport --script-args='op=map,pubport=8080,privport=8080,protocol=tcp'
nmap -sU -p 5351 <ip> --script nat-pmp-mapport --script-args='op=unmap,pubport=8080,privport=8080,protocol=tcp'
nmap -sU -p 5351 <ip> --script nat-pmp-mapport --script-args='op=unmapall,protocol=tcp'

Script Output

5351/udp open  nat-pmp
| nat-pmp-mapport:
|_  Successfully mapped tcp ->



  • Patrik Karlsson

License: Same as Nmap--See