Reviewed October 16, 2026. This reference summarizes twenty option groups, not exactly twenty individual flags. It reports no personal scan history, measured time savings or validated duration model. No scan or configuration change was performed for this revision.
Choose options to answer a defined question, then record what they leave untested. A wider port set, extra probes or scripts increase the work; they do not automatically make the finding more reliable. Use only owned or expressly authorized targets, with permitted traffic and script behavior.
Write the Goal and Coverage Before the Command
Record target addresses, protocols, ports, vantage point, permitted intensity and output location. Separate discovery from port inventory, service identification and script checks. Nmap’s output depends on responses and the selected method. An apparent negative result needs to be read alongside scope, exclusions, timeouts and errors.
Use Measured Conditions Instead of a Duration Calculator
Target count, port count and a timing label cannot predict scan duration on their own. Filtering, retries, latency, rate limits and script behavior can dominate. Choose a small permitted test and log completion and errors before planning a wider run. No minute range or “quiet scan” guarantee is supplied here.
Discovery and Reasons
Use the host discovery reference to check probe behavior and local-link exceptions. The output reference covers state reasons and progress reporting.
1. -Pn: Skip Host Discovery
Attempts the requested scan against every specified address as if online. It does not prove reachability, bypass filtering or hide traffic. Local-link ARP/ND may still occur.
2. -sn: Discovery Without the Port Scan
Omits the port-scan stage. Discovery still sends probes; traceroute or NSE host scripts may also be requested. Document what was actually enabled.
3. -PR, -PE, -PS, -PA and -PU: Select Discovery Probes
ARP applies to local Ethernet; the others select ICMP, TCP SYN/ACK or UDP discovery probes. Choose based on the path and authorized scope, not a universal speed ranking.
4. –disable-arp-ping: Change Local Discovery Assumptions
Disables implicit ARP/ND discovery. It is situational, such as investigating misleading proxy ARP. It does not repair a wrong target or route.
5. –reason: Preserve the Reported Reason
Shows the response reason behind a reported state. The reason supports interpretation of this observation; it is not proof of exploitability or a complete explanation of the network.
Protocol and Port Coverage
The port selection reference defines these ranges and frequency-based sets. For UDP behavior and privilege requirements, see the scan technique reference.
6. -p-: Expand the Requested Protocol’s Port Range
Selects ports 1–65535. It does not add UDP to a TCP scan, and port zero requires explicit selection. Full port coverage is different from full vulnerability coverage.
7. –top-ports and -F: Use a Frequency-Based Subset
–top-ports selects a chosen number of common ports. With normal frequency data, -F reduces the usual 1,000-port set to 100. Record the subset as a coverage limit.
8. –port-ratio: Choose a Frequency Threshold
Uses frequency information in the services data to select ports. Frequency does not establish what runs on this target or which service is important to the exercise.
9. -sU: Request UDP Scanning
Selects UDP rather than adding it implicitly to a TCP scan. Suitable privileges are needed. Missing responses can leave open|filtered uncertainty; a small sample does not assess all UDP ports.
10. –exclude-ports: State What Was Omitted
Excludes specified ports, including from discovery. Keep exclusions in the evidence record; do not describe the resulting scan as complete coverage of the excluded set.
Version and Script Decisions
Check the version probe documentation and NSE selection rules before treating an additional check as appropriate. A script’s capability and the assessment scope both matter.
11. -sV and –version-intensity: Control Version Probes
Requests active service identification. Intensity ranges from 0 to 9, with 7 as the default. A matched banner is a research lead, not confirmation of an affected build.
12. –version-light and –version-all: Use Probe Presets
These correspond to version intensity 2 and 9. Fewer probes may miss details; more probes add work and traffic. Neither guarantees identification or a fixed duration.
13. -sC and –script Expressions: Select Scripts Deliberately
-sC selects default scripts, some intrusive. –script=”default and safe” selects the intersection; –script=default,safe selects the union. Categories do not guarantee harmless behavior. Review individual scripts and arguments.
14. –script-timeout and –host-timeout: Recognize Lost Results
A timed-out script instance has no output, and a host timeout can omit its port table. Record incomplete work explicitly. A time limit does not turn a partial scan into a clean result.
Timing and Incomplete Results
The timing reference describes the trade-offs below. Preserving accuracy, respecting scope and recognizing unfinished work take priority over a faster-looking completion time.
15. -T2, -T3 and -T4: Choose Timing Assumptions
Timing templates change scanning behavior; T3 is normal. Slower timing does not certify safety or invisibility. Choose within the permitted traffic and target constraints.
16. –min-rate and –max-rate: Understand the Limited Scope
They control average packet throughput for discovery/port scanning, not total NSE, service or OS-detection traffic. A minimum can push too fast for the path; a maximum is not a universal traffic cap.
17. –defeat-rst-ratelimit: Know the Accuracy Trade-Off
Favors speed when RST replies are rate-limited, at the expense of distinguishing closed from filtered ports. Do not interpret the altered classification as stronger evidence.
18. –scan-delay and –max-scan-delay: Control Probe Spacing
One imposes spacing between probes to a host; the other limits adaptive delay. Restricting delay can interfere with handling rate limits. Neither supplies a predictable scan duration.
19. –stats-every: Observe Progress
Prints periodic timing/progress statistics. It is an observation aid, not a throttle, completion guarantee or evidence that missing results are negative.
Preserve the Evidence
20. -oA: Keep Three Output Formats
Writes normal .nmap, XML .xml and grepable .gnmap files using one prefix. Use a writable directory and unique prefixes; keep XML for structured review and retain command/version context.
Build a Small Profile, Then Review What It Does
Do not combine all twenty groups into one command. Start with a bounded target and port scope; add version or script checks only when the next question needs them. The Kioptrix Nmap evidence workflow gives proposed single-host examples and explains how to separate observations from vulnerability assumptions.
Keep a Reproducible Record
Save the full command, scanner version, targets, vantage point, timestamps, warnings and output. When comparing runs, change one assumption at a time and note any target reset or path change. Preserve incomplete scans as incomplete. A timeout, an excluded port or an unresolved UDP state is not a negative vulnerability finding.
Common Questions
Does conservative timing make a scan invisible?
No. Probes and application requests can be logged and detected. Timing is not permission.
Does a safe-category script guarantee no harm?
No. Review its implementation, arguments, target behavior and authorized scope.
Does -p- cover all protocols?
No. It changes the port range for the requested scan protocol or protocols.
Can I calculate scan time from these options?
Not reliably from flags alone. Use your observed conditions and keep uncertainty explicit.
Review One Profile Before Reusing It
The local checklist does not run Nmap, save a profile or certify that a target is safe to scan. Use the official reference for exact behavior in your installed version and review a saved profile whenever its scope changes.