What are the default nmap options?

Which options are used by default, when the user fires

# nmap target

without any explicit option?

I am going to write the defaults of the three options I consider the most important. It would be nice to have all the default options, probably with some short commentary on when it is appropriate to change them.

The most important distinction I can think of is, that under root a TCP SYN scan (-sS) is used by default, while under regular user it uses TCP Connect() scan (-sT), as it has not privileges to work with raw packets.

Second think are the target (TCP) ports. The docs says, that "Normally Nmap scans the most common 1,000 ports for each scanned protocol". I presume these are some selected ports lower than 1024, probably known services.

The last thing of interest are scan timings, for IDS evasion.

-T paranoid|sneaky|polite|normal|aggressive|insane (Set a timing template)

The default is of course

-T3

or

-T normal

Recent Questions...