Here are 8 excellent Nmap options, what they do, and why you would use them.
Most of the options can be run together. You will normally want to perform scans with administrator or root privileges.
| Option | What is does | Why you would use | |
| 1. | -sn | No port scan | Helpful for quickly discovering hosts that are up |
| 2. | -iL file.lst | Scan IP addresses in file.lst | Helpful if you already have a list IP addresses to scan |
| 3. | -n | Skip reverse DNS lookup | This can help speed up scanning |
| 4. | -Pn | Pretend host is up | Use when hosts have Ping disabled. e.g. Windows |
| 5. | -O | OS detection | Use to detect OS version |
| 6. | -T4 | Speed up scan | Increases scan speed (Default is -T3) |
| 7. | -A | Aggressive scan options | Shorthand option. Enables OS detection (-O), version Scanning (-sV), script scanning (-sC), and runs a traceroute |
| 8. | -oA filename | Save output to ALL formats | This saves the output to separate files for XML and grepable formats |