Nmap Cheatsheet

Service and Version Detection

Use this Nmap reference while you build software engineering projects, review code, or refresh the syntax you reach for most.

What -sV does

-sV connects to each open port and compares the response against roughly 12,000 signatures in nmap-service-probes. Without it, the SERVICE column is only a guess from the port number.

sudo nmap -sV 10.0.0.5
sudo nmap -sV -p 22,80,443,3306 10.0.0.5
sudo nmap -sSV --open 10.0.0.0/24            # combine SYN scan and versioning

PORT     STATE SERVICE  VERSION
22/tcp   open  ssh      OpenSSH 9.6p1 Ubuntu 3ubuntu13.5 (Ubuntu Linux; protocol 2.0)
80/tcp   open  http     nginx 1.24.0 (Ubuntu)
3306/tcp open  mysql    MySQL 8.0.36-0ubuntu0.24.04.1

Without -sV that same host prints only ssh, http, and mysql, inferred purely from the port numbers, which is wrong the moment a service runs on a non-standard port.

Intensity and probe selection

Each probe carries a rarity value from 1 to 9. Intensity sets the ceiling, so higher means more probes tried, more time spent, and more chance of identifying an unusual service.

Option	Intensity	Effect
`--version-light`	2	only the most likely probes, much faster
default	7	the balanced setting
`--version-all`	9	every probe, ignores rarity
`--version-intensity <0-9>`	explicit	set the ceiling yourself

sudo nmap -sV --version-light 10.0.0.0/24        # sweeps, speed matters
sudo nmap -sV --version-all -p 8443 10.0.0.5     # one stubborn port
sudo nmap -sV --version-intensity 0 -p U:161 10.0.0.5
sudo nmap -sV --version-trace -p 8080 10.0.0.5   # see every probe and reply

Intensity 0 sends only probes tied to that exact port number. It is the right choice for wide UDP scans, where full versioning is prohibitively slow.

Reading the version output

Column or marker	Meaning
`VERSION`	product, version, and extra info from a matched signature
`Service Info:`	aggregated OS, hostname, and domain hints
`(protocol 2.0)`	extra fields the signature captured
`tcpwrapped`	handshake completed then closed immediately, so the real service is unknown
`unknown`	port is open, no signature matched
a printed fingerprint	nmap is asking you to submit it to the signature database

tcpwrapped is commonly misread as a finding. It means something accepted the TCP connection and dropped it before speaking, which points at a proxy, a load balancer, a port knocker, or an IPS resetting the session, not at a specific service.

An unknown service with a printed fingerprint is genuinely useful data. Combine -sV with a banner grab to see the raw bytes yourself:

sudo nmap -sV --script banner -p 8080 10.0.0.5
printf 'HEAD / HTTP/1.0\r\n\r\n' | nc 10.0.0.5 8080

RPC, SSL, and tunnelled services

Version detection recurses. When it finds TLS it renegotiates inside it and probes the wrapped service, and when it finds an RPC portmapper it enumerates the programs behind it.

sudo nmap -sV -p 443,8443 10.0.0.5           # detects TLS, then the inner service
sudo nmap -sV -p 111 10.0.0.5                # RPC grinder enumerates programs
sudo nmap -sV --script ssl-cert -p 443 10.0.0.5

443/tcp open  ssl/http  nginx 1.24.0
111/tcp open  rpcbind   2-4 (RPC #100000)

The ssl/http form is the tell that TLS wraps the service. -sV reporting the inner protocol is why it beats assuming port 443 means HTTPS.

Version detection with UDP

UDP versioning is what turns the useless open|filtered verdict into a real answer, because a protocol-specific payload forces a reply where an empty datagram gets none.

sudo nmap -sU -sV -p 53,123,161,500,1900 10.0.0.5
sudo nmap -sU -sV --version-intensity 0 --top-ports 50 10.0.0.5

Without `-sV`	With `-sV`
`53/udp open\|filtered domain`	`53/udp open domain ISC BIND 9.18.28`
`161/udp open\|filtered snmp`	`161/udp open snmp SNMPv1 server`

Keep intensity low here. Full-intensity UDP versioning across many ports is one of the slowest things nmap can do.

Aggressive mode and the useful combinations

-A is shorthand, not a scan type. It turns on OS detection, version detection, default scripts, and traceroute at once.

Invocation	Equivalent to
`-A`	`-O -sV -sC --traceroute`
`-sC`	`--script=default`
`-sV -sC`	versioning plus the default script set

sudo nmap -A 10.0.0.5                          # loud, thorough, slow
sudo nmap -sV -sC --open -p- 10.0.0.5          # the practical workhorse
sudo nmap -sV -sC -oA report 10.0.0.5          # save all three formats
sudo nmap -sV --version-light -T4 --open 10.0.0.0/24

-A is deliberately noisy and needs root. On an engagement where scan volume matters, prefer the explicit combination so you control exactly which of the four behaviours you pay for.