-A (Aggressive scan options) .
This option enables additional advanced and aggressive options. I haven´t decided exactly which it
stands for yet. Presently this enables OS detection (-O), version scanning (-sV), script scanning
(-sC) and traceroute (--traceroute). More features may be added in the future. The point is to
enable a comprehensive set of scan options without people having to remember a large set of flags.
However, because script scanning with the default set is considered intrusive, you should not use -A
against target networks without permission. This option only enables features, and not timing options
(such as -T4) or verbosity options (-v) that you might want as well.
|
-T paranoid|sneaky|polite|normal|aggressive|insane (Set a timing template) .
While the fine-grained timing controls discussed in the previous section are powerful and effective,
some people find them confusing. Moreover, choosing the appropriate values can sometimes take more
time than the scan you are trying to optimize. So Nmap offers a simpler approach, with six timing
templates. You can specify them with the -T option and their number (0–5) or their name. The template
names are paranoid (0), sneaky (1), polite (2), normal (3), aggressive (4), and insane (5). The first
two are for IDS evasion. Polite mode slows down the scan to use less bandwidth and target machine
resources. Normal mode is the default and so -T3 does nothing. Aggressive mode speeds scans up by
making the assumption that you are on a reasonably fast and reliable network. Finally insane mode.
assumes that you are on an extraordinarily fast network or are willing to sacrifice some accuracy for
speed.
These templates allow the user to specify how aggressive they wish to be, while leaving Nmap to pick
the exact timing values. The templates also make some minor speed adjustments for which fine-grained
control options do not currently exist. For example, -T4. prohibits the dynamic scan delay from
exceeding 10 ms for TCP ports and -T5 caps that value at 5 ms. Templates can be used in combination
with fine-grained controls, and the fine-grained controls will you specify will take precedence over
the timing template default for that parameter. I recommend using -T4 when scanning reasonably modern
and reliable networks. Keep that option even when you add fine-grained controls so that you benefit
from those extra minor optimizations that it enables.
If you are on a decent broadband or ethernet connection, I would recommend always using -T4. Some
people love -T5 though it is too aggressive for my taste. People sometimes specify -T2 because they
think it is less likely to crash hosts or because they consider themselves to be polite in general.
They often don´t realize just how slow -T polite. really is. Their scan may take ten times longer
than a default scan. Machine crashes and bandwidth problems are rare with the default timing options
(-T3) and so I normally recommend that for cautious scanners. Omitting version detection is far more
effective than playing with timing values at reducing these problems.
While -T0. and -T1. may be useful for avoiding IDS alerts, they will take an extraordinarily long
time to scan thousands of machines or ports. For such a long scan, you may prefer to set the exact
timing values you need rather than rely on the canned -T0 and -T1 values.
The main effects of T0 are serializing the scan so only one port is scanned at a time, and waiting
five minutes between sending each probe. T1 and T2 are similar but they only wait 15 seconds and 0.4
seconds, respectively, between probes. T3 is Nmap´s default behavior, which includes
parallelization.. -T4 does the equivalent of --max-rtt-timeout 1250 --initial-rtt-timeout 500
--max-retries 6 and sets the maximum TCP scan delay to 10 milliseconds. T5 does the equivalent of
--max-rtt-timeout 300 --min-rtt-timeout 50 --initial-rtt-timeout 250 --max-retries 2 --host-timeout
15m as well as setting the maximum TCP scan delay to 5 ms.
|
-v (Increase verbosity level) .
Increases the verbosity level, causing Nmap to print more information about the scan in progress.
Open ports are shown as they are found and completion time estimates are provided when Nmap thinks a
scan will take more than a few minutes. Use it twice or more for even greater verbosity.
Most changes only affect interactive output, and some also affect normal and script kiddie output.
The other output types are meant to be processed by machines, so Nmap can give substantial detail by
default in those formats without fatiguing a human user. However, there are a few changes in other
modes where output size can be reduced substantially by omitting some detail. For example, a comment
line in the grepable output that provides a list of all ports scanned is only printed in verbose mode
because it can be quite long.
|
-oX filespec (XML output) .
Requests that XML output be directed to the given filename. Nmap includes a document type definition
(DTD) which allows XML parsers to validate Nmap XML output. While it is primarily intended for
programmatic use, it can also help humans interpret Nmap XML output. The DTD defines the legal
elements of the format, and often enumerates the attributes and values they can take on. The latest
version is always available from http://nmap.org/data/nmap.dtd.
XML offers a stable format that is easily parsed by software. Free XML parsers are available for all
major computer languages, including C/C++, Perl, Python, and Java. People have even written bindings
for most of these languages to handle Nmap output and execution specifically. Examples are
Nmap::Scanner[15] and Nmap::Parser[16] in Perl CPAN. In almost all cases that a non-trivial
application interfaces with Nmap, XML is the preferred format.
The XML output references an XSL stylesheet which can be used to format the results as HTML. The
easiest way to use this is simply to load the XML output in a web browser such as Firefox or IE. By
default, this will only work on the machine you ran Nmap on (or a similarly configured one) due to
the hard-coded nmap.xsl filesystem path. Use the --webxml or --stylesheet options to create portable
XML files that render as HTML on any web-connected machine.
|