Nmap Command Builder

Only scan systems you own or have explicit, written authorization to test. Port scanning networks you do not control can be illegal and against most providers' terms of service. This tool only assembles a command string in your browser. It never runs nmap or contacts any host, so what you do with the command is your responsibility.

-sS is a SYN (half-open) scan: nmap sends a SYN, watches for the SYN/ACK that signals an open port, then sends a RST instead of completing the handshake. It is fast and relatively stealthy but needs raw-socket (root) privileges. -sT is a connect scan that asks the operating system to complete the full TCP handshake. It works without elevated privileges but is slower and more likely to be logged.

--top-ports 1000 scans the 1000 ports nmap considers most common, which covers the vast majority of real services and finishes quickly, so it is a sensible default. -p- scans all 65,535 TCP ports and will find services on unusual ports, but it takes far longer. Use --top-ports for a fast first pass and -p- when you need full coverage.

The -T flag sets how aggressively nmap sends probes. -T0 (paranoid) and -T1 (sneaky) are very slow and used to evade detection or rate limits. -T2 (polite) eases load on the target. -T3 is the default. -T4 (aggressive) speeds things up on fast, reliable networks and is a common choice. -T5 (insane) is the fastest but can miss results or trip defenses.

No. The command is built entirely in your browser from the options you choose. Nothing is uploaded, logged or stored, and no scan is performed.

-Pn tells nmap to skip host discovery and treat every target as online. Many hosts and firewalls block the ping probes nmap uses by default, which can make a live host look down. Adding -Pn forces nmap to scan ports anyway. A ping sweep (-sn) is the opposite: it only does discovery, so the builder leaves -Pn off in that case.