Editing Nmap (section)

== <span id="options"></span>Scan Type(s) ==
These flags define *how* Nmap interacts with the target (e.g., TCP, UDP, stealth, protocol-level scans):

{| class="wikitable"
! Option !! Description
|-
| [[#ex-sS|<code>-sS</code>]] || TCP SYN scan (stealth mode)
|-
| [[#ex-sT|<code>-sT</code>]] || TCP connect scan (full TCP handshake)
|-
| [[#ex-sU|<code>-sU</code>]] || UDP scan
|-
| [[#ex-sN|<code>-sN</code>]] || TCP NULL scan (no flags set)
|-
| [[#ex-sF|<code>-sF</code>]] || TCP FIN scan (bypasses some firewalls)
|-
| [[#ex-sX|<code>-sX</code>]] || Xmas scan (sets FIN, PSH, URG flags)
|-
| [[#ex-sA|<code>-sA</code>]] || ACK scan (used to map firewall rules)
|-
| [[#ex-sW|<code>-sW</code>]] || Window scan (analyzes TCP window size)
|-
| [[#ex-sM|<code>-sM</code>]] || TCP Maimon scan (obscure IDS evasion)
|-
| [[#ex-sL|<code>-sL</code>]] || List scan (lists targets without scanning)
|-
| [[#ex-sn|<code>-sn</code>]] || Ping scan (host discovery only; replaces <code>-sP</code>)
|-
| [[#ex-sY|<code>-sY</code>]] || SCTP INIT scan (SCTP equivalent of TCP SYN)
|-
| [[#ex-sZ|<code>-sZ</code>]] || SCTP COOKIE-ECHO scan
|-
| [[#ex-sO|<code>-sO</code>]] || IP protocol scan (scans for supported protocols)
|-
| [[#ex-sI|<code>-sI</code>]] || Idle scan (ultra-stealth scan using zombie host)
|}