NAME
nmap - Network exploration tool and security scanner
# 注释 ：nmap 是网络探测工具和安全扫描工具
namp 的 official 站点 ：http://insecure.org/nmap
SYNOPSIS
nmap [Scan Type(s)] [Options] <host or net #1 ... [#N]>
# 注释 ：nmap 的语法比较简单 ：
# -）1、关键字 nmap
# -）2、指定一个扫描类型
# -）3、指定扫描选项
# -）4、指定要扫描的主机或者网络
DESCRIPTION
Nmap is designed to allow system administrators and curious individu-
als to scan large networks to determine which hosts are up and what
services they are offering. nmap supports a large number of scanning
techniques such as: UDP, TCP connect(), TCP SYN (half open), ftp proxy
(bounce attack), ICMP (ping sweep), FIN, ACK sweep, Xmas Tree, SYN
sweep, IP Protocol, and Null scan. See the Scan Types section for
more details. nmap also offers a number of advanced features such as
remote OS detection via TCP/IP fingerprinting, stealth scanning,
dynamic delay and retransmission calculations, parallel scanning,
detection of down hosts via parallel pings, decoy scanning, port fil-
tering detection, direct (non-portmapper) RPC scanning, fragmentation
scanning, and flexible target and port specification.
# 注释 ：nmap 是用于允许系统管理员来扫描大型网络，以探测有那些主机是 up 的，
# 它们上面都提供了什么服务。nmap 支持很多扫描技术 ：UDP、TCP 连接、TCP SYN （half open）、
# ftp 代理（bounce attack）、IMCP （ping sweep）、FIN，ACK sweep、Xmas Tree、SYN sweep 、
# IP 协议、Null scan 。
# 注释 ：nmap 同样提供了一系列的高级特性，例如远程操作系统探测（通过 TCP/IP 指纹）、
# stealth scan、动态延迟、重传计算、并行扫描、诱骗扫描、端口过滤检测、
# 直接 RPC 扫描、分片扫描、以及灵活的主机/端口扫描
Significant effort has been put into decent nmap performance for non-
root users. Unfortunately, many critical kernel interfaces (such as
raw sockets) require root privileges. nmap should be run as root
whenever possible (not setuid root, of course).
# 注释 ：尽可能地以 root 身份运行 nmap ，不过 nmap 不是 setUID 程序
The result of running nmap is usually a list of interesting ports on
the machine(s) being scanned (if any). Nmap always gives the port’s
"well known" service name (if any), number, state, and protocol. The
state is either "open", "filtered", or "unfiltered". Open means that
the target machine will accept() connections on that port. Filtered
means that a firewall, filter, or other network obstacle is covering
the port and preventing nmap from determining whether the port is
open. Unfiltered means that the port is known by nmap to be closed
and no firewall/filter seems to be interfering with nmap’s attempts to
determine this. Unfiltered ports are the common case and are only
shown when most of the scanned ports are in the filtered state.
# 注释 ：运行 nmap 一般会得到目标主机上的端口列表。nmap 会自动识别出 well-known 端口、服务、协议
# 以及端口的状态 ：open、filtered、unfiltered 。
# "open" 意味着目标主机可以在该端口上接受连接。
# "filtered" 意味着有一个防火墙存在，它禁止了 nmap 对该端口状态的探测
# "unfiltered" 意味着 nmap 知道该端口被关闭，且没有防火墙对 nmap 的行为进行阻止，应该就是真的关闭了。
# unfiltered 端口是很常见的状况，只有在被扫描的很多端口都是 filtered 状态时才会被显示
Depending on options used, nmap may also report the following charac-
teristics of the remote host: OS in use, TCP sequentiality, usernames
running the programs which have bound to each port, the DNS name,
whether the host is a smurf address, and a few others.
# 注释 ：根据不同的选项，nmap 会自动报告远程主机的某些属性 ：
# -）1、正在使用的操作系统
# -）2、TCP sequentiality
# -）3、运行于每个端口上的程序的用户名
# -）4、DNS 名称
OPTIONS
Options that make sense together can generally be combined. Some
options are specific to certain scan modes. nmap tries to catch and
warn the user about psychotic or unsupported option combinations.
If you are impatient, you can skip to the examples section at the end,
which demonstrates common usage. You can also run nmap -h for a quick
reference page listing all the options.
# 注释 ：你可以执行 nmap -h 打印一个快速的参考用法
SCAN TYPES
# 注释 ：下面的选项都是用于指定扫描选项的
-sS TCP SYN scan: This technique is often referred to as "half-
open" scanning, because you don’t open a full TCP connection.
You send a SYN packet, as if you are going to open a real con-
nection and you wait for a response. A SYN|ACK indicates the
port is listening. A RST is indicative of a non-listener. If a
SYN|ACK is received, a RST is immediately sent to tear down the
connection (actually our OS kernel does this for us). The pri-
mary advantage to this scanning technique is that fewer sites
will log it. Unfortunately you need root privileges to build
these custom SYN packets. This is the default scan type for
privileged users.
# 注释 ：-sS 指定采用 "TCP SYN scan" 的扫描模式。这个技术也常被称为 "half open scan" 。
# 因为该方法并不会打开一个完整的 TCP 连接，你只是发出一个 SYN 包，就象你要打开一个 TCP
# 连接一样，然后你就等待 SYN+ACK 包。
# 如果收到一个 SYN+ACK 的包，就表明该接口是处于监听的状态； 如果是 RST 则表示处于关闭的状态（inactive）
# 一旦收到了 SYN+ACK，nmap 就发送一个 RST 取消这次连接
# 这个方法的好处是很多站点不会记录这种类型的尝试，也就是不会留下痕迹。不过你需要有 root 权限才能构造一个 SYN 包
# 这也是对于 root 用户来说的默认扫描类型
-sT TCP connect() scan: This is the most basic form of TCP scan-
ning. The connect() system call provided by your operating sys-
tem is used to open a connection to every interesting port on
the machine. If the port is listening, connect() will succeed,
otherwise the port isn’t reachable. One strong advantage to
this technique is that you don’t need any special privileges.
Any user on most UNIX boxes is free to use this call.
# 注释 ：-sT 是 TCP connect（）扫描模式。这是 TCP 扫描中最基本的形式。
# connect（）系统调用用于打开一个到你想测试的端口的连接。
# 假如端口是处于 LISTENING 的状态，connect（）会成功，否则表示端口不可达（port unreachable）
# 一个很大的好处就是使用这项技术时你不需要是特权用户（例如 root），
# 任何普通用户都可以自由使用该扫描模式
This sort of scan is easily detectable as target host logs will
show a bunch of connection and error messages for the services
which accept() the connection just to have it immediately shut-
down. This is the default scan type for unprivileged users.
# 注释 ：这类扫描很容易被检测到并被目标主机检测到。
# 因为在日志中将会看到有很多的 inbound 的连接，而在服务接受连接后，又立刻中断连接
# 这是非特权用户的默认扫描模式
-sF -sX -sN
Stealth FIN, Xmas Tree, or Null scan modes: There are times
when even SYN scanning isn’t clandestine enough. Some firewalls
and packet filters watch for SYNs to restricted ports, and pro-
grams like Synlogger and Courtney are available to detect these
scans. These advanced scans, on the other hand, may be able to
pass through unmolested.
# 注释 ：-sF，-sX，-sN 分别代表 Stealth FIN、Xmas Tree、Null scan 这三种模式。
# 有些情况即使使用 SYN 扫描也不够隐秘，某些防火墙会持续监控那些到受限端口的 SYN 连接。
# 还有一些象 synlogger 或者 Courtney 的工具可以检测出这些扫描（-sS）
# 而 Stealth FIN、Xmas Tree、Null scan 可能可以骗过这些检测工具
The idea is that closed ports are required to reply to your
probe packet with an RST, while open ports must ignore the
packets in question (see RFC 793 pp 64). The FIN scan uses a
bare (surprise) FIN packet as the probe, while the Xmas tree
scan turns on the FIN, URG, and PUSH flags. The Null scan
turns off all flags. Unfortunately Microsoft (like usual)
decided to completely ignore the standard and do things their
own way. Thus this scan type will not work against systems
running Windows95/NT. On the positive side, this is a good way
to distinguish between the two platforms. If the scan finds
open ports, you know the machine is not a Windows box. If a
-sF,-sX,or -sN scan shows all ports closed, yet a SYN (-sS)
scan shows ports being opened, you are probably looking at a
Windows box. This is less useful now that nmap has proper OS
detection built in. There are also a few other systems that
are broken in the same way Windows is. They include Cisco,
BSDI, HP/UX, MVS, and IRIX. All of the above send resets from
the open ports when they should just drop the packet.
# 注释 ：想法是 : 一个端口如果是被关闭的状态，则它需要对你的探测返回一个 RST 包。
# 而那些处于 open 状态的端口，应该忽略你的探测包，也就是直接 DROP 掉。
# 所以 Stealth FIN 就是 nmap 发送一个 FIN 包作为探测，而 Xmas Tree scan 则是使用 FIN、URG、PUSH
# 至于 Null scan 则关闭所有标记（什么标记都不设置）。
# 不幸的是，微软完全并不遵照标准，而是以它们的方式行事
# 所以这类型的扫描对于 Win95/NT 来说不其作用。
# 不过从另外一个角度来说，这也可以用于区分目标主机的操作系统类型是否为 Windows
# -）1、如果扫描可以找到 open 的端口，则可以确定目标主机不是 Windows 主机
# -）2、如果扫描显示所有端口都是关闭的状态，则可能目标主机是一台 Windows 主机
# 不过现在 nmap 已经有了 OS 探测功能，所以这个功能没有太大用途。
# 也有一些操作系统的行为和 windows 类似，包括 Cisco、HP/UX、IRIX 等。
# 补充 ：TCP flags 中的 8 个控制位的含义 ：
CWR – Congestion Window Reduced (CWR) flag is set by the sending host to indicate that it received a TCP segment with the ECE flag set (added to header by RFC 3168).
ECE (ECN-Echo) – indicate that the TCP peer is ECN capable during 3-way handshake (added to header by RFC 3168).
URG – indicates that the URGent pointer field is significant # 注释 ：表示这是一个紧急连接
ACK – indicates that the ACKnowledgement field is significant # 注释 ：响应包
PSH – Push function # 注释 ：PUSH 功能
RST – Reset the connection # 注释 ：重置
SYN – Synchronize sequence numbers
FIN – No more data from sender
-sP Ping scanning: Sometimes you only want to know which hosts on a
network are up. Nmap can do this by sending ICMP echo request
packets to every IP address on the networks you specify. Hosts
that respond are up. Unfortunately, some sites such as
microsoft.com block echo request packets. Thus nmap can also
send a TCP ack packet to (by default) port 80. If we get an
RST back, that machine is up. A third technique involves send-
ing a SYN packet and waiting for a RST or a SYN/ACK. For non-
root users, a connect() method is used.
# 注释 ：-sP 代表 Ping scanning 模式。有时候你只是想知道目标主机是否处于运行状态。
# Nmap 通过发送 ICMP ECHO_REQUEST 包到你指定的每台主机上来扫描
# 不过很多站点都屏蔽了 ICMP ECHO_REQUEST ，所以 nmap 允许发送一个 TCP ack 包到 80 端口，
# 如果收到一个 RST 包，则表明机器是 up 的状态，否则它也不会返回 RST 包了
By default (for root users), nmap uses both the ICMP and ACK
techniques in parallel. You can change the -P option described
later.
# 注释 ：对于 root 用户来说，nmap 默认同时使用 ICMP 和 ACK ，
Note that pinging is done by default anyway, and only hosts
that respond are scanned. Only use this option if you wish to
ping sweep without doing any actual port scans.
# 注释 ：要注意，ping 是在什么情况下都会做的，只有回应的主机才会被扫描
# 所以该功能实际上不能做什么
-sV Version detection: Afer TCP and/or UDP ports are discovered
using one of the other scan methods, version detection communi-
cates with those ports to try and determine more about what is
actually running. A file called nmap-service-probes is used to
determine the best probes for detecting various services and
the match strings to expect. Nmap tries to determine the ser-
vice protocol (e.g. ftp, ssh, telnet, http), the application
name (e.g. ISC Bind, Apache httpd, Solaris telnetd), the ver-
sion number, and sometimes miscellaneous details like whether
an X server is open to connections or the SSH protocol ver-
sion). If Nmap was compiled with OpenSSL support, it will con-
nect to SSL servers to deduce the service listening behind the
encryption. When RPC services are discovered, the Nmap RPC
grinder is used to determine the RPC program and version num-
bers. Some UDP ports are left in the "open|filtered" state
after a UDP scan is unable to determine whether the port is
open or filtered. Version detection will try to elicit a
response from these ports (just as it does with open ports),
and change the state to open if it succeeds. Note that the Nmap
-A option also enables this feature. For a much more detailed
description of Nmap service detection, read our paper at
http://www.insecure.org/nmap/versionscan.html . There is a
related --version_trace option which causes Nmap to print out
extensive debugging info about what version scanning is doing
(this is a subset of what you would get with --packet_trace).
# 注释 ：-sV 是 version 探测模式。它在端口状态探测后尝试做更多的探测。
# 例如上面都运行有那些服务？服务的进程名是什么？版本是多少？
# 还会探测其他有用的信息，例如是否启动了 X Window server ？
# 如果 Nmap 在编译时加入了 OpenSSL 支持，它还会尝试连接到 SSL 服务器
# 来推导出在 SSL 后面有那些隐藏的服务。
# Nmap 还可以探测 RPC 服务，例如 NFS 服务
# 注释 ：不过 -sV 可能会导致某些 UDP 端口的状态是 "open|filtered" ，表示 nmap 无法判断是什么状态
-sU UDP scans: This method is used to determine which UDP (User
Datagram Protocol, RFC 768) ports are open on a host. The
technique is to send 0 byte UDP packets to each port on the
target machine. If we receive an ICMP port unreachable mes-
sage, then the port is closed. If a UDP response is received
to the probe (unusual), the port is open. If we get no
response at all, the state is "open|filtered", meaning that the
port is either open or packet filters are blocking the communi-
cation. Versions scan (-sV) can be used to help differentiate
the truly open ports from the filtered ones.
# 注释 ：-sU 表示 UDP scan 模式。它用于探测一台主机上有那些 UDP 端口是处于打开的状态。
# 该模式发送一个 0 字节的 UDP 包到目标主机的每个端口。
# 假如收到一个 ICMP port-unreachable 消息，则表示端口是关闭的状态。
# 如果收到一个响应，则表示是打开的状态。
# 这时使用 -sV 可以帮助你区分该端口是 open 还是被过滤的状态
Some people think UDP scanning is pointless. I usually remind
them of the Solaris rpcbind hole. Rpcbind can be found hiding
on an undocumented UDP port somewhere above 32770. So it
doesn’t matter that 111 is blocked by the firewall. But can you
find which of the more than 30,000 high ports it is listening
on? With a UDP scanner you can! There is also the cDc Back
Orifice backdoor program which hides on a configurable UDP port
on Windows machines. Not to mention the many commonly vulnera-
ble services that utilize UDP such as snmp, tftp, NFS, etc.
# 注释 ：某些人认为 UDP scanning 没有什么用。但实际上它可以用于发现一些
# 不被注意的端口，尤其是 RPC 服务打开的 3xxxx 端口、或者 DNS 服务的 query 端口。
# 使用 UDP scanning 你可以发现这些被忽略的端口
Unfortunately UDP scanning is sometimes painfully slow since
most hosts implement a suggestion in RFC 1812 (section 4.3.2.8)
of limiting the ICMP error message rate. For example, the
Linux kernel (in net/ipv4/icmp.h) limits destination unreach-
able message generation to 80 per 4 seconds, with a 1/4 second
penalty if that is exceeded. Solaris has much more strict lim-
its (about 2 messages per second) and thus takes even longer to
scan. nmap detects this rate limiting and slows down accord-
ingly, rather than flood the network with useless packets that
will be ignored by the target machine.
# 注释 ：不幸的是，UDP scanning 有时候会非常慢，
# 因为大部分主机都会按照 RFC 1812 标准，用于自动抑制 ICMP 消息的发送速率
# 例如 linux 内核会限制 ICMP destination unreachable 消息的速率为 80个/4秒，也就是1秒最多 20个。
# 而 Solaris 则更加严格了，每秒最多2个。
# 所以 UDP scanning 有时会很长时间
# 补充 ：操作系统那里可以配置 ICMP 的发送速率
# linux 下允许配置的速率有 ：
# -）1、icmp_destunreach_rate
# -）2、icmp_echoreply_rate
# -）3、icmp_paramprob_rate
# -）4、icmp_timeexceed_rate
As is typical, Microsoft ignored the suggestion of the RFC and
does not seem to do any rate limiting at all on Win95 and NT
machines. Thus we can scan all 65K ports of a Windows machine
very quickly. Whoop!
# 注释 ：不过 Win95/NT 不做该限制。所以在 windows 主机上可以非常快的扫描完 65535 个 UDP 端口
-sO IP protocol scans: This method is used to determine which IP
protocols are supported on a host. The technique is to send
raw IP packets without any further protocol header to each
specified protocol on the target machine. If we receive an
ICMP protocol unreachable message, then the protocol is not in
use. Otherwise we assume it is open. Note that some hosts
(AIX, HP-UX, Digital UNIX) and firewalls may not send protocol
unreachable messages. This causes all of the protocols to
appear "open".
# 注释 ：-sO 是 "IP Protocol scan" 的含义。这个方法是用于判断目标主机上使用的是什么协议。
# 注释 ：由于 -sO 也是依赖于 ICMP protocol unreachable 消息，所以也会收到 ICMP 消息速率限制的影响。
# 注释 ：由于某些操作系统不返回 ICMP protocol unreachable ，所以可能造成探测错误
Because the implemented technique is very similar to UDP port
scanning, ICMP rate limit might apply too. But the IP protocol
field has only 8 bits, so at most 256 protocols can be probed
which should be possible in reasonable time anyway.
# 注释 ：由于 ip 包的 protocol 字段有8bit，所以最多可以探测 256 种协议
-sI <zombie host[:probeport]>
Idlescan: This advanced scan method allows for a truly blind
TCP port scan of the target (meaning no packets are sent to the
target from your real IP address). Instead, a unique side-
channel attack exploits predictable "IP fragmentation ID"
sequence generation on the zombie host to glean information
about the open ports on the target. IDS systems will display
the scan as coming from the zombie machine you specify (which
must be up and meet certain criteria). I wrote an informal
paper about this technique at http://www.insecure.org/nmap/idlescan.html .
# 注释 ：-sI 也叫 Idle scan 。这个高级扫描模式允许对目标主机的完全透明的 TCP 端口扫描。
# 也就是说不会有任何来自你的真正 ip 的包被发送到目标主机。
Besides being extraordinarily stealthy (due to its blind
nature), this scan type permits mapping out IP-based trust
relationships between machines. The port listing shows open
ports from the perspective of the zombie host. So you can try
scanning a target using various zombies that you think might be
trusted (via router/packet filter rules). Obviously this is
crucial information when prioritizing attack targets. Other-
wise, you penetration testers might have to expend considerable
resources "owning" an intermediate system, only to find out
that its IP isn’t even trusted by the target host/network you
are ultimately after.
You can add a colon followed by a port number if you wish to
probe a particular port on the zombie host for IPID changes.
Otherwise Nmap will use the port it uses by default for "tcp
pings".
-sA ACK scan: This advanced method is usually used to map out fire-
wall rulesets. In particular, it can help determine whether a
firewall is stateful or just a simple packet filter that blocks
incoming SYN packets.
# 注释 ：-sA 表示 ACK scan 。主要是用于映射出防火墙的规则集。
# 也就是说，它可以帮助以判断是防火墙的原因还是只是 SYN 包被阻挡了而已
This scan type sends an ACK packet (with random looking
acknowledgment/sequence numbers) to the ports specified. If a
RST comes back, the ports is classified as "unfiltered". If
nothing comes back (or if an ICMP unreachable is returned), the
port is classified as "filtered". Note that nmap usually
doesn’t print "unfiltered" ports, so getting no ports shown in
the output is usually a sign that all the probes got through
(and returned RSTs). This scan will obviously never show ports
in the "open" state.
# 注释 ：这个类型的扫描会发送一个 ACK 包（带有随机的 ack/seq 编号） 到指定端口，
# 假如返回一个 RST ，则端口被认为是 "unfiltered" 。
# 假如什么都不返回（或者返回一个 ICMP 不可达消息），则认为是 "filter"
# 注释 ：要注意，nmap 通常不打印 “filtered" 状态的端口。所以返回的结果都是那些通过的端口（返回 RST ）
# 这个扫描永远不会出现处于 open 状态的端口
-sW Window scan: This advanced scan is very similar to the ACK
scan, except that it can sometimes detect open ports as well as
filtered/unfiltered due to an anomaly in the TCP window size
reporting by some operating systems. Systems vulnerable to
this include at least some versions of AIX, Amiga, BeOS, BSDI,
Cray, Tru64 UNIX, DG/UX, OpenVMS, Digital UNIX, FreeBSD, HP-UX,
OS/2, IRIX, MacOS, NetBSD, OpenBSD, OpenStep, QNX, Rhapsody,
SunOS 4.X, Ultrix, VAX, and VxWorks. See the nmap-hackers
mailing list archive for a full list.
# 注释 ：-sW 表示 Window scan 。和它 ACK scan （-sA）很像，但它有时候可以探测
# 出 open 状态的端口，而 -sA 只能探测出 filtered、unfiltered 状态的而已。
# 主要是由于 -sW 发送的 ACK 包中有异常的 window size 值。
# 受次探测类型影响的有很多。
-sR RPC scan. This method works in combination with the various
port scan methods of Nmap. It takes all the TCP/UDP ports
found open and then floods them with SunRPC program NULL com-
mands in an attempt to determine whether they are RPC ports,
and if so, what program and version number they serve up. Thus
you can effectively obtain the same info as "rpcinfo -p" even
if the target’s portmapper is behind a firewall (or protected
by TCP wrappers). Decoys do not currently work with RPC scan,
at some point I may add decoy support for UDP RPC scans.
# 注释 ：-sR 表示 RPC Scan 。该方法组合了 nmap 多种端口扫描方法，
# 它找出所有 open 状态的 TCP/UDP 端口，然后用 SunRPC 的 NULL 命令
# 进行测试，看是否它们是一个 RPC 端口。
# 如果是的话，是什么程序运行在上面？版本是多少？
# 所以你可以获得类似于 rpcinfo -p 的输出，即使目标主机在防火墙之后，或者被 Tcpwrapper 所保护
-sL List scan. This method simply generates and prints a list of
IP addresses or hostnames without actually pinging or port
scanning them. DNS name resolution will be performed unless
you use -n.
# 注释 ：-sL 表示 List scan 。该方法生成并打印一个 ip 地址/主机名列表
# 但不 ping 或者扫描端口。你可以用 -n 禁止 DNS 解释
-b <ftp relay host>
FTP bounce attack: An interesting "feature" of the ftp protocol
(RFC 959) is support for "proxy" ftp connections. In other
words, I should be able to connect from evil.com to the FTP
server of target.com and request that the server send a file
ANYWHERE on the Internet! Now this may have worked well in
1985 when the RFC was written. But in today’s Internet, we
can’t have people hijacking ftp servers and requesting that
data be spit out to arbitrary points on the Internet. As *Hob-
bit* wrote back in 1995, this protocol flaw "can be used to
post virtually untraceable mail and news, hammer on servers at
various sites, fill up disks, try to hop firewalls, and gener-
ally be annoying and hard to track down at the same time." What
we will exploit this for is to (surprise, surprise) scan TCP
ports from a "proxy" ftp server. Thus you could connect to an
ftp server behind a firewall, and then scan ports that are more
likely to be blocked (139 is a good one). If the ftp server
allows reading from and writing to some directory (such as
/incoming), you can send arbitrary data to ports that you do
find open (nmap doesn’t do this for you though).
The argument passed to the "b" option is the host you want to
use as a proxy, in standard URL notation. The format is: user-
name:password@server:port. Everything but server is optional.
To determine what servers are vulnerable to this attack, you
can see my article in Phrack 51. An updated version is avail-
able at the nmap URL (http://www.insecure.org/nmap).
GENERAL OPTIONS
# 注释 ：下面介绍通用选项部分
None of these are required but some can be quite useful. Note
that the -P options can now be combined -- you can increase
your odds of penetrating strict firewalls by sending many probe
types using different TCP ports/flags and ICMP codes.
# 注释 ：下面这些选项都不是必须的，但都很有用。
# 要注意，-P 选项现在可以被组合，你可以使用不同的 TCP 端口/标记和 ICMP 消息
-P0 Do not try to ping hosts at all before scanning them. This
allows the scanning of networks that don’t allow ICMP echo
requests (or responses) through their firewall. microsoft.com
is an example of such a network, and thus you should always use
-P0 or -PS80 when portscanning microsoft.com. Note tht "ping"
in this context may involve more than the traditional ICMP echo
request packet. Nmap supports many such probes, including
arbitrary combinations of TCP, UDP, and ICMP probes. By
default, Nmap sends an ICMP echo request and a TCP ACK packet
to port 80.
# 注释 ：-P0 表示在扫描主机前不先做 ping 操作。这样对那些不允许 ICMP ECHO_REQUEST
# 的主机也会进行扫描。要注意，在这里的 ping 不仅仅指 ICMP ping ，而是指前面的 -sP 操作
# 也就是 ICMP ping + 发送到 80 端口的 ACK
-PA [portlist]
Use TCP ACK "ping" to determine what hosts are up. Instead of
sending ICMP echo request packets and waiting for a response,
we spew out TCP ACK packets throughout the target network (or
to a single machine) and then wait for responses to trickle
back. Hosts that are up should respond with a RST. This
option preserves the efficiency of only scanning hosts that are
up while still allowing you to scan networks/hosts that block
ping packets. For non root UNIX users, we use connect() and
thus a SYN is actually being sent. To set the destination
ports of the probe packets use -PA<port1>[,port2][...]. The
default port is 80, since this port is often not filtered out.
Note that this option now accepts multiple, comma-separated
port numbers.
# 注释 ：-PA 表示使用 TCP ACK ping 来判断主机是否 up ，而不是使用 ICMP ping
# nmap 发送一个 TCP ACK 包到目的主机/网络，然后等待 RST 包的响应。
# 如果收到 RST 包，表示主机是 up 的。
# 所以你可以用功能得出那些主机是禁止了 PING 包。对于非 root 用户，nmap 使用 connect（）而不是 TCP ACK
# 你可以指定目标端口，默认是 80 。因为这个端口一般不会被过滤掉。
# 多个端口可以使用逗号进行分隔。
-PS [portlist]
This option uses SYN (connection request) packets instead of
ACK packets for root users. Hosts that are up should respond
with a RST (or, rarely, a SYN|ACK). You can set the destina-
tion ports in the same manner as -PA above.
# 注释 ：-PS 表示对于 root 用户，使用 SYN （连接请求）来代替 ACK ping
# 如果是 up 的主机应该返回一个 RST 或者 SYN+ACK ，你也可以设置端口
-PU [portlist]
This option sends UDP probes to the specified hosts, expecting
an ICMP port unreachable packet (or possibly a UDP response if
the port is open) if the host is up. Since many UDP services
won’t reply to an empty packet, your best bet might be to send
this to expected-closed ports rather than open ones.
# 注释 ：-PU 表示使用 UDP 来探测主机，
-PE This option uses a true ping (ICMP echo request) packet. It
finds hosts that are up and also looks for subnet-directed
broadcast addresses on your network. These are IP addresses
which are externally reachable and translate to a broadcast of
incoming IP packets to a subnet of computers. These should be
eliminated if found as they allow for numerous denial of ser-
vice attacks (Smurf is the most common).
# 注释 ：-PE 表示使用真正的 ping 包 （ICMP ECHO_REQUEST）。、
-PP Uses an ICMP timestamp request (type 13) packet to find listening hosts.
# 注释 ：-PP 表示使用一个 ICMP timestamp 请求（type=13）来探测
-PM Same as -PE and -PP except uses a netmask request (ICMP type 17).
# 注释 ：-PM 表示使用 ICMP NETMASK 请求（类型=17）
-PB This is the default ping type. It uses both the ACK ( -PA )
and ICMP echo request ( -PE ) sweeps in parallel. This way you
can get firewalls that filter either one (but not both). The
TCP probe destination port can be set in the same manner as
with -PA above. Note that this flag is now deprecated as ping-
type flags can now be used in combination. So you should use
both "PE" and "PA" (or rely on the default behavior) to achieve
this same effect.
# 注释 ：-PB 是默认的 ping 类型。使用 TCP ACK ping 和 ICMP ping
# 现在不建议使用该项，使用 -PE 后者 -PA 更好
-O This option activates remote host identification via TCP/IP
fingerprinting. In other words, it uses a bunch of techniques
to detect subtleties in the underlying operating system network
stack of the computers you are scanning. It uses this informa-
tion to create a "fingerprint" which it compares with its
database of known OS fingerprints (the nmap-os-fingerprints
file) to decide what type of system you are scanning.
# 注释 ：-O 选项通过 TCP/IP 指纹激活远程主机的身份认证。
# 也就是说，它使用一系列的技术来检测目标主机的操作系统的网络堆栈的信息，
# 然后和一些已知的“指纹”数据库比较，得出远程主机的操作系统类型
If Nmap is unable to guess the OS of a machine, and conditions
are good (e.g. at least one open port), Nmap will provide a URL
you can use to submit the fingerprint if you know (for sure)
the OS running on the machine. By doing this you contribute to
the pool of operating systems known to nmap and thus it will be
more accurate for everyone. Note that if you leave an IP
address on the form, the machine may be scanned when we add the
fingerprint (to validate that it works).
# 注释 ：假如 nmap 无法获得一个主机的 OS 类型，但可以探测到一个打开的端口，
# 则 nmap 会提供一个 URL ，你可以用它来提交该指纹，前提是你知道目标主机的 OS
The -O option also enables several other tests. One is the
"Uptime" measurement, which uses the TCP timestamp option (RFC
1323) to guess when a machine was last rebooted. This is only
reported for machines which provide this information.
# 注释 ：-O 选项允许其他的测试。其中一个就是 Uptime 的计算，它使用 TCP timestamp 选项
# 来猜测一台机器最近一次重启的时间。
Another test enabled by -O is TCP Sequence Predictability Clas-
sification. This is a measure that describes approximately how
hard it is to establish a forged TCP connection against the
remote host. This is useful for exploiting source-IP based
trust relationships (rlogin, firewall filters, etc) or for hid-
ing the source of an attack. The actual difficulty number is
based on statistical sampling and may fluctuate. It is gener-
ally better to use the English classification such as "worthy
challenge" or "trivial joke". This is only reported in normal
output with -v.
# 注释 ：另外一个测试就是 TCP sequence 预测功能。
# 这其实是为了伪造 TCP 连接所用的，它可以猜出大概的 TCP 序号
# 这对于窃取基于ip信任关系的会话（rlogin、rsh 等）或者隐藏自己的 ip 都有用。
# 它并不能百分百的猜对，它是依靠统计和采样来计算的。
# 这个只有用 -v 时才会显示
When verbose mode (-v) is on with -O, IPID Sequence Generation
is also reported. Most machines are in the "incremental"
class, which means that they increment the "ID" field in the IP
header for each packet they send. This makes them vulnerable
to several advanced information gathering and spoofing attacks.
# 注释 ：当 -v 和 -O 一起使用时，IPID sequence Generation 会被报告
# 大部分主机是以升序的方式来生成它们所发送的每个 packet 的 ip header 中的ID 域的
# 这就造成了有***的可能性
--osscan_limit
OS detection is far more effective if at least one open and one
closed TCP port are found. Set this option and Nmap will not
even try OS detection against hosts that do not meet this cri-
teria. This can save substantial time, particularly on -P0
scans against many hosts. It only matters when OS detection is
requested (-O or -A options).
# 注释 ：如果至少找到一个 open 和 unfiltered 状态的端口，则 os 的探测的效率还是可以的。
# --osscan_limit 选项表示如果被探测的主机不符合上面的两个条件就不做 OS 的探测。
# 这可以省下不少时间，尤其是在使用 -p0 扫描每个主机时。
# 该选项只有在你使用了 -O 或者 -A 时才有意义
-A This option enables _a_dditional _a_dvanced and _a_ggressive
options. I haven’t decided exactly which it stands for yet :).
Presently this enables OS Detection (-O) and version scanning
(-sV). More features may be added in the future. The point is
to enable a comprehensive set of scan options without people
having to remember a large set of flags. This option only
enables features, and not timing options (such as -T4) or ver-
bosity options (-v) that you might wan’t as well.
# 注释 ：-A 选项允许操作系统检测和 Version scan ，也就是集合了 -O 和 -sV
-6 This options enables IPv6 support. All targets must be IPv6 if
this option is used, and they can be specified via normal DNS
name (AAAA record) or as a literal IP address such as
3ffe:501:4819:2000:210:f3ff:fe03:4d0 . Currently, connect()
TCP scan and TCP connect() Ping scan are supported. If you
need UDP or other scan types, have a look at
http://nmap6.sourceforge.net/ .
-f This option causes the requested SYN, FIN, XMAS, or NULL scan
to use tiny fragmented IP packets. The idea is to split up the
TCP header over several packets to make it harder for packet
filters, intrusion detection systems, and other annoyances to
detect what you are doing. Be careful with this! Some programs
have trouble handling these tiny packets. My favorite sniffer
segmentation faulted immediately upon receiving the first
36-byte fragment. After that comes a 24 byte one! While this
method won’t get by packet filters and firewalls that queue all
IP fragments (like the CONFIG_IP_ALWAYS_DEFRAG option in the
Linux kernel), some networks can’t afford the performance hit
this causes and thus leave it disabled.
# 注释 ：-f 表示 SYN scan、Stealth FIN、Xmas Tree、Null scan 都是很小的分段的 ip 报文
# 这么做主要是不让信息全部集中在一个 packet 中，这样可以逃过防火墙的检测。
# 不过要注意，很多的工具都无法检测/处理这些小的报文
# 注意，该方法对于那些会暂存报文的防火墙来说是无效的。
Note that I do not yet have this option working on all systems.
It works fine for my Linux, FreeBSD, and OpenBSD boxes and some
people have reported success with other *NIX variants.
# 注释 ：该选项在 linux / FreeBSD、OpenBSD 上可以使用
-v Verbose mode. This is a highly recommended option and it gives
out more information about what is going on. You can use it
twice for greater effect. You can also use -d a few times if
you really want to get crazy with scrolling the screen!
# 注释 ：-v 表示 verbose 模式。强烈建议使用该选项，不管你在做什么测试。
# 你可以使用多次已获得更多的信息。
-h This handy option display a quick reference screen of nmap
usage options. As you may have noticed, this man page is not
exactly a "quick reference" :)
# 注释 ：-h 显示快速指引
-oN <logfilename>
This logs the results of your scans in a normal human readable
form into the file you specify as an argument.
# 注释 ：-oN 表示把结果写入一个 human-readable 的文件
-oX <logfilename>
This logs the results of your scans in XML form into the file
you specify as an argument. This allows programs to easily
capture and interpret Nmap results. You can give the argument
"-" (without quotes) to shoot output into stdout (for shell
pipelines, etc). In this case normal output will be sup-
pressed. Watch out for error messages if you use this (they
will still go to stderr). Also note that "-v" may cause some
extra information to be printed. The Document Type Definition
(DTD) defining the XML output structure is available at
http://www.insecure.org/nmap/data/nmap.dtd .
# 注释 ：-oX 表示以 XML 的格式输出结果到一个文件
-oG <logfilename>
This logs the results of your scans in a grepable form into the
file you specify as an argument. This simple format provides
all the information on one line (so you can easily grep for
port or OS information and see all the IPs. This used to be
the preferred mechanism for programs to interact with Nmap, but
now we recommend XML output (-oX instead). This simple format
may not contain as much information as the other formats. You
can give the argument "-" (without quotes) to shoot output into
stdout (for shell pipelines, etc). In this case normal output
will be suppressed. Watch out for error messages if you use
this (they will still go to stderr). Also note that "-v" will
cause some extra information to be printed.
# 注释 ：-oG 以适用于 grep 的格式输出到指定文件。每个主机只有1行输出而已
# 不过该格式可能有些信息不会被输出
# 你可以用 - 作为指定文件名，表示输出到 stdout ，这样原来正常的输出就会被禁止。
-oA <basefilename>
This tells Nmap to log in ALL the major formats (normal,
grepable, and XML). You give a base for the filename, and the
output files will be base.nmap, base.gnmap, and base.xml.
# 注释 ：-oA 表示以全部的格式记录（normal、xml、grepable）。
# 你只需给出一个 basename ，nmap 会自动加上 .nmap , .gnmap , .xml 作为后缀名
-oS <logfilename>
thIs l0gz th3 r3suLtS of YouR ScanZ iN a s|<ipT kiDd|3 f0rM
iNto THe fiL3 U sPecfy 4s an arGuMEnT! U kAn gIv3 the 4rgument
"-" (wItHOUt qUOteZ) to sh00t output iNT0 stDouT!@!!
--resume <logfilename>
A network scan that is canceled due to control-C, network out-
age, etc. can be resumed using this option. The logfilename
must be either a normal (-oN) or grepable (-oG) log from the
aborted scan. No other options can be given (they will be the
same as the aborted scan). Nmap will start on the machine
after the last one successfully scanned in the log file.
# 注释 ：如果你因为某些原因用 CTRL-C 中断了扫描，你可以用 --resume 来恢复
# 不过指定的 log 必须是一个 normal 格式的（-oN）或者 grepable （-oG）文件，且该
# 文件是这次意味终止的扫描所输出的日志才可以恢复
# nmap 会自动从最后一个成功扫描的机器后开始继续
--exclude <host1 [,host2][,host3],...">
Specifies a list of targets (hosts, ranges, netblocks) that
should be excluded from a scan. Useful to keep from scanning
yourself, your ISP, particularly sensitive hosts, etc.
# 注释 ：--exclude 指定一个 target 列表，可以是由主机、ip 范围等组成。
# nmap 在扫描时将会跳过它们。
--excludefile <exclude_file>
Same functionality as the --exclude option, only the excluded
targets are provided in an newline-delimited exclude_file
rather than on the command line.
# 注释 ：--excludefile 和 --excluce 类似，不过是从文件读取
--append_output
Tells Nmap to append scan results to any output files you have
specified rather than overwriting those files.
# 注释 ：--append_output 告诉 nmap 把扫描结果“追加”到输出文件
# 输出文件由上面的 -oN、-oX、-oG 指定
-iL <inputfilename>
Reads target specifications from the file specified RATHER than
from the command line. The file should contain a list of host
or network expressions separated by spaces, tabs, or newlines.
Use a hyphen (-) as inputfilename if you want nmap to read host
expressions from stdin (like at the end of a pipe). See the
section target specification for more information on the
expressions you fill the file with.
# 注释 ：-iL 表示从指定文件读入要扫描的主机
# 可以用空格、tab、newline 作为分行
# 也可以用 - 表示从 stdin 读取输入
-iR <num hosts>
This option tells Nmap to generate its own hosts to scan by
simply picking random numbers :). It will never end after the
given number of IPs has been scanned -- use 0 for a never-end-
ing scan. This option can be useful for statistical sampling
of the Internet to estimate various things. If you are ever
really bored, try nmap -sS -PS80 -iR 0 -p 80 to find some web
servers to look at.
-p <port ranges>
This option specifies what ports you want to specify. For exam-
ple "-p 23" will only try port 23 of the target host(s). "-p
20-30,139,60000-" scans ports between 20 and 30, port 139, and
all ports greater than 60000. The default is to scan all ports
between 1 and 1024 as well as any ports listed in the services
file which comes with nmap. For IP protocol scanning (-sO),
this specifies the protocol number you wish to scan for
(0-255).
# 注释 ：-p 选项用于指定要扫描的目标端口。你可以指定端口范围，p1-p2。
# 也可已指定一个起始值，格式是 p1- 。 多个端口用逗号隔开。
# 默认是扫描所有端口（从 1- 1024），还有 /etc/services 文件中列出的所有端口。
# 对于 -sO 来说，由于协议位只有 8 bit ，所以只能从 0 -255 而已
When scanning both TCP and UDP ports, you can specify a partic-
ular protocol by preceding the port numbers by "T:" or "U:".
The qualifier lasts until you specify another qualifier. For
example, the argument "-p U:53,111,137,T:21-25,80,139,8080"
would scan UDP ports 53,111,and 137, as well as the listed TCP
ports. Note that to scan both UDP & TCP, you have to specify
-sU and at least one TCP scan type (such as -sS, -sF, or -sT).
If no protocol qualifier is given, the port numbers are added
to all protocol lists.
# 注释 ：当同时扫描 TCP 和 UDP 端口时，你可以指定一个协议，例如 "T:" 后者 "U:" 。
# 它会一直起作用，直到你指定另外一个协议为止。
# 例如 -p U:53,111,T:22 表示扫描 UDP 53 和 111 以及 TCP 22 端口。
# 注释 ：注意，如果要扫描两种协议，必须指定 -sU 和至少一种 TCP 扫描（-sS、-sF、-sT）
# 假如没有指定协议类型，则所有协议都会用
-F Fast scan mode.
Specifies that you only wish to scan for ports listed in the
services file which comes with nmap (or the protocols file for
-sO). This is obviously much faster than scanning all 65535
ports on a host.
# 注释 ：-F 表示快速扫描模式。表示只扫描 /etc/services 文件中的端口，
# 或者 -sO 指定的协议，这当然比扫描 65535 要快多了。
-D <decoy1 [,decoy2][,ME],...>
Causes a decoy scan to be performed which makes it appear to
the remote host that the host(s) you specify as decoys are
scanning the target network too. Thus their IDS might report
5-10 port scans from unique IP addresses, but they won’t know
which IP was scanning them and which were innocent decoys.
While this can be defeated through router path tracing,
response-dropping, and other "active" mechanisms, it is gener-
ally an extremely effective technique for hiding your IP
address.
# 注释 ：-D 表示进行 decoy scan 可以对目标主机造成一种假象 ： 有很多台主机都在扫描它
# 这样目标主机就会无法区分究竟那个是真正的扫描它们的 ip ，
# 不过这可以通过路由跟踪来发现最终的 ip
# 总而言之，decoy scan 是一种可以很好的隐藏你的 IP 的扫描方式
Separate each decoy host with commas, and you can optionally
use "ME" as one of the decoys to represent the position you
want your IP address to be used. If you put "ME" in the 6th
position or later, some common port scan detectors (such as
Solar Designer’s excellent scanlogd) are unlikely to show your
IP address at all. If you don’t use "ME", nmap will put you in
a random position.
# 注释 ：-D 允许你指定多个主机名，你可以用 'ME' 这个关键字来代表你的 ip
# 尽量把 'ME' 放在最后，因为有些检测软件无法列出很多的 ip
# 如果没有指定，nmap 将随机的插入到一个位置
Note that the hosts you use as decoys should be up or you might
accidentally SYN flood your targets. Also it will be pretty
easy to determine which host is scanning if only one is actu-
ally up on the network. You might want to use IP addresses
instead of names (so the decoy networks don’t see you in their
nameserver logs).
# 注释 ：要注意，你用来做 Decoy 的主机应该是 up 状态的，
# 否则你可能会导致目标主机受到 SYN Flood ***（由于目标主机不是 up ，导致目标主机一直收不到 ACK ，造成 SYN Flood）
# 同样也很从一大堆的 down 状态的主机中找出唯一的 up 主机
Also note that some "port scan detectors" will firewall/deny
routing to hosts that attempt port scans. The problem is that
many scan types can be forged (as this option demonstrates).
So attackers can cause such a machine to sever connectivity
with important hosts such as its internet gateway, DNS TLD
servers, sites like Windows Update, etc. Most such software
offers whitelist capabilities, but you are unlikely to
enumerate all of the critical machines. For this reason we
never recommend taking action against port scans that can be
forged, including SYN scans, UDP scans, etc. The machine you
block could just be a decoy.
Decoys are used both in the initial ping scan (using ICMP, SYN,
ACK, or whatever) and during the actual port scanning phase.
Decoys are also used during remote OS detection ( -O ).
# 注释 ：Decoy 同样也用于 ping scan 和真正的端口扫描过程，也用于 -O （OS Scan）
It is worth noting that using too many decoys may slow your
scan and potentially even make it less accurate. Also, some
ISPs will filter out your spoofed packets, although many (cur-
rently most) do not restrict spoofed IP packets at all.
# 注释 ：要注意，使用太多的 decoys 也会降低扫描的速度和精度
-S <IP_Address>
In some circumstances, nmap may not be able to determine your
source address ( nmap will tell you if this is the case). In
this situation, use -S with your IP address (of the interface
you wish to send packets through).
# 注释 ：某些情况下，nmap 无法判断你的ip 地址（这时它会告诉你该情况）
# 使用 -S 可以指定你的源 ip
Another possible use of this flag is to spoof the scan to make
the targets think that someone else is scanning them. Imagine
a company being repeatedly port scanned by a competitor! This
is not a supported usage (or the main purpose) of this flag. I
just think it raises an interesting possibility that people
should be aware of before they go accusing others of port scan-
ning them. -e would generally be required for this sort of
usage.
-e <interface>
Tells nmap what interface to send and receive packets on. Nmap
should be able to detect this but it will tell you if it can-
not.
# 注释 ：-e 告示 nmap 使用什么端口来发送/接收 packets 。
--source_port <portnumber>
Sets the source port number used in scans. Many naive firewall
and packet filter installations make an exception in their
ruleset to allow DNS (53) or FTP-DATA (20) packets to come
through and establish a connection. Obviously this completely
subverts the security advantages of the firewall since intrud-
ers can just masquerade as FTP or DNS by modifying their source
port. Obviously for a UDP scan you should try 53 first and TCP
scans should try 20 before 53. Note that this is only a
request -- nmap will honor it only if and when it is able to.
For example, you can’t do TCP ISN sampling all from one
host:port to one host:port, so nmap changes the source port
even if you used this option. This is an alias for the
shorter, but harder to remember, -g option.
# 注释 ：--source_port 指定探测包的源端口。有些防火墙会允许从 53 （DNS） 或者 20 （FTP-DATA）
# 的源端口的数据进入，所以这个时候你可以用 --source_port 来增加扫描成功的机率。
# 显而易见，在做 UDP 扫描时，你应该首先对 53 端口进行测试，而在做 TCP 端口扫描时，首选 20
# 不过要注意，这个选项并不是固定起作用，nmap 只是在可能的情况下才会这么做。
Be aware that there is a small performance penalty on some
scans for using this option, because I sometimes store useful
information in the source port number.
--data_length <number>
Normally Nmap sends minimalistic packets that only contain a
header. So its TCP packets are generally 40 bytes and ICMP
echo requests are just 28. This option tells Nmap to append
the given number of random bytes to most of the packets it
sends. OS detection (-O) packets are not affected, but most
pinging and portscan packets are. This slows things down, but
can be slightly less conspicuous.
-n Tells Nmap to NEVER do reverse DNS resolution on the active IP
addresses it finds. Since DNS is often slow, this can help
speed things up.
# 注释 ：-n 告诉 nmap 不做 DNS 正向解释，这可以加快扫描的进度
-R Tells Nmap to ALWAYS do reverse DNS resolution on the target IP
addresses. Normally this is only done when a machine is found
to be alive.
# 注释 ：-R 表示对目标主机固定做 PTR 解释，找出其主机名。一般只有检测到目标主机是 up 时才做
-r Tells Nmap NOT to randomize the order in which ports are
scanned.
# 注释 ：-r 告诉 nmap 不要随机扫描端口，要按顺序扫描
--ttl <value>
Sets the IPv4 time to live field in sent packets to the given
value.
# 注释 ：--ttl 设置发出去的扫描包的 TTL
--randomize_hosts
Tells Nmap to shuffle each group of up to 2048 hosts before it
scans them. This can make the scans less obvious to various
network monitoring systems, especially when you combine it with
slow timing options (see below).
-M <max sockets>
Sets the maximum number of sockets that will be used in paral-
lel for a TCP connect() scan (the default). This is useful to
slow down the scan a little bit and avoid crashing remote
machines. Another approach is to use -sS, which is generally
easier for machines to handle.
# 注释 ：-M 设置在做 TCP connect（）scan 时同时允许使用的最多 sockets 数量。
# 它会稍微降低 scan 的速度，并防止远程主机的崩溃。另外一个方式是使用 -sS ，这样对于远程主机来说比较容易接受
--packet_trace
Tells Nmap to show all the packets it sends and receives in a
tcpdump-like format. This can be tremendously useful for
debugging, and is also a good learning tool.
# 注释 ：--packet_trace 告诉nmap按照 tcpdump 的格式输出它所发送/接收到的每个 packets
--datadir [directoryname]
Nmap obtains some special data at runtime in files named nmap-
services, nmap-protocols, nmap-rpc, and nmap-os-fingerprints.
Nmap first searches these files in the directory option to
--nmapdir. Any files not found there, are searched for in the
directory specified by the NMAPDIR environmental variable.
Next comes ~/nmap, and then a compiled-in location such as
/usr/share/nmap . As a last resort, Nmap will look in the cur-
rent directory.
# 注释 ：--datadir 指的是 nmap 一些静态数据的存放位置。默认是 /usr/share/nmap
# 这些数据包括 nmap-services、nmap-protocols、nmap-rpc、nmap-os-fingerprints
# nmap 首先搜索 --datadir 指定的目录，
# 其次搜索 NMAPDIR 环境变量指定的目录
# 再搜索 ~/nmap 目录
# 再搜索 /usr/share/nmap
# 如果还不行，最后是当前目录
TIMING OPTIONS
Generally Nmap does a good job at adjusting for Network charac-
teristics at runtime and scanning as fast as possible while
minimizing that chances of hosts/ports going undetected. How-
ever, there are same cases where Nmap’s default timing policy
may not meet your objectives. The following options provide a
fine level of control over the scan timing:
# 注释 ：一般情况下，nmap 在调整网络特性，
-T <Paranoid|Sneaky|Polite|Normal|Aggressive|Insane>
These are canned timing policies for conveniently expressing
your priorities to Nmap. Paranoid mode scans very slowly in
the hopes of avoiding detection by IDS systems. It serializes
all scans (no parallel scanning) and generally waits at least 5
minutes between sending packets. Sneaky is similar, except it
only waits 15 seconds between sending packets. Polite is meant
to ease load on the network and reduce the chances of crashing
machines. It serializes the probes and waits at least 0.4 sec-
onds between them. Note that this is generally at least an
order of magnitude slower than default scans, so only use it
when you need to. Normal is the default Nmap behavior, which
tries to run as quickly as possible without overloading the
network or missing hosts/ports. Aggressive This option can
make certain scans (especially SYN scans against heavily fil-
tered hosts) much faster. It is recommended for impatient
folks with a fast net connection. Insane is only suitable for
very fast networks or where you don’t mind losing some informa-
tion. It times out hosts in 15 minutes and won’t wait more
than 0.3 seconds for individual probes. It does allow for very
quick network sweeps though :).
# 注释 ：-T 用于控制 nmap 以什么速度探测，从最慢到最快分别是
# -）1、Paranoid
# -）2、Sneaky
# -）3、Polite
# -）4、Normal
# -）5、Aggressive
# -）6、Insane
You can also reference these by number (0-5). For example,
"-T0" gives you Paranoid mode and "-T5" is Insane mode.
--host_timeout <milliseconds>
Specifies the amount of time Nmap is allowed to spend scanning
a single host before giving up on that IP. The default timing
mode has no host timeout.
# 注释 ：--host_timeout 设置 nmap 在一台主机身上所消耗的最长时间，单位是毫秒。默认是无限
--max_rtt_timeout <milliseconds>
Specifies the maximum amount of time Nmap is allowed to wait
for a probe response before retransmitting or timing out that
particular probe. The default mode sets this to about 9000.
--min_rtt_timeout <milliseconds>
When the target hosts start to establish a pattern of respond-
ing very quickly, Nmap will shrink the amount of time given per
probe. This speeds up the scan, but can lead to missed packets
when a response takes longer than usual. With this parameter
you can guarantee that Nmap will wait at least the given amount
of time before giving up on a probe.
--initial_rtt_timeout <milliseconds>
Specifies the initial probe timeout. This is generally only
useful when scanning firewalled hosts with -P0. Normally Nmap
can obtain good RTT estimates from the ping and the first few
probes. The default mode uses 6000.
--max_hostgroup <numhosts>
Specifies the maximum number of hosts that Nmap is allowed to
scan in parallel. Most of the port scan techniques support
multi-host operation, which makes them much quicker. Spreading
the load among multiple target hosts makes the scans gentler.
The downside is increast results latency. You need to wait for
all hosts in a group to finish, rather than having them pop up
one by one. Specify an argument of one for old-style (one host
at a time) Nmap behavior. Note that the ping scanner handles
its own grouping, and ignores this value.
--min_hostgroup <milliseconds>
Specifies the minimum host group size (see previous entry).
Large values (such as 50) are often beneficial for unattended
scans, though they do take up more memory. Nmap may override
this preference when it needs to, because a group must all use
the same network interface, and some scan types can only handle
one host at a time.
--max_parallelism <number>
Specifies the maximum number of scans Nmap is allowed to per-
form in parallel. Setting this to one means Nmap will never
try to scan more than 1 port at a time. It also effects other
parallel scans such as ping sweep, RPC scan, etc.
--min_parallelism <number>
Tells Nmap to scan at least the given number of ports in paral-
lel. This can speed up scans against certain firewalled hosts
by an order of magnitude. But be careful -- results will
become unreliable if you push it too far.
--scan_delay <milliseconds>
Specifies the minimum amount of time Nmap must wait between
probes. This is mostly useful to reduce network load or to
slow the scan way down to sneak under IDS thresholds.
# 注释 ：--scan_delay 用于控制 nmap 在每次探测之间的
TARGET SPECIFICATION
Everything that isn’t an option (or option argument) in nmap is
treated as a target host specification. The simplest case is
listing single hostnames or IP addresses on the command line.
If you want to scan a subnet of IP addresses, you can append
/mask to the hostname or IP address. mask must be between 0
(scan the whole Internet) and 32 (scan the single host speci-
fied). Use /24 to scan a class "C" address and /16 for a class "B".
# 注释 ：任何不被 nmap 所识别的选项都被认为是目标主机的定义
# 你可以一次列出多个主机或者 ip 地址。
# 你可以用 <ip/mask> 的方式来指定子网掩码，mask 值是从 0 - 32
Nmap also has a more powerful notation which lets you specify
an IP address using lists/ranges for each element. Thus you
can scan the whole class "B" network 192.168.*.* by specifying
"192.168.*.*" or "192.168.0-255.0-255" or even
"192.168.1-50,51-255.1,2,3,4,5-255". And of course you can use
the mask notation: "192.168.0.0/16". These are all equivalent.
If you use asterisks ("*"), remember that most shells require
you to escape them with back slashes or protect them with
quotes.
# 注释 ：nmap 也允许你指定一个范围，例如它支持 wildcard ，不过需要用括号括起来。
# -）1、主机名 ：例如 mail.bob.com.
# -）2、ip/mask ：例如 172.17.64.11/24
# -）3、ip1-ip2 ：172.17.64.11-20
# -）4、wildcard ：172.17.*.*
# -）5、综合 ：mail.bob.com,172.17.64.11/24,172.17.64.12-20,30-40,172.17.65.*/24
Another interesting thing to do is slice the Internet the other
way. Instead of scanning all the hosts in a class "B", scan
"*.*.5.6-7" to scan every IP address that ends in .5.6 or .5.7
Pick your own numbers. For more information on specifying
hosts to scan, see the examples section.
# 注释 ；有一个有趣的例子是 *.*.*.11 ，它可以扫描所有以 11 结尾的 ip
EXAMPLES
Here are some examples of using nmap, from simple and normal to a lit-
tle more complex/esoteric. Note that actual numbers and some actual
domain names are used to make things more concrete. In their place
you should substitute addresses/names from your own network. I do not
think portscanning other networks is illegal; nor should portscans be
construed by others as an attack. I have scanned hundreds of thou-
sands of machines and have received only one complaint. But I am not
a lawyer and some (anal) people may be annoyed by nmap probes. Get
permission first or use at your own risk.
nmap -v target.example.com
This option scans all reserved TCP ports on the machine target.exam-
ple.com . The -v means turn on verbose mode.
# 注释 ：上面的命令扫描 target.example.com 主机的 0-1024 端口，以及 /etc/services 中定义的端口
# -v 表示 verbose 模式
nmap -sS -O target.example.com/24
Launches a stealth SYN scan against each machine that is up out of the
255 machines on class "C" where target.example.com resides. It also
tries to determine what operating system is running on each host that
is up and running. This requires root privileges because of the SYN
scan and the OS detection.
# 注释 ：上面的命令对 target.example.com/24 主机所在的 C 网的每个 up 主机进行 SYN scan 以及 OS scan
# 由于使用了 -sS ，所以需要 root 权限
nmap -sX -p 22,53,110,143,4564 198.116.*.1-127
Sends an Xmas tree scan to the first half of each of the 255 possible
8 bit subnets in the 198.116 class "B" address space. We are testing
whether the systems run sshd, DNS, pop3d, imapd, or port 4564. Note
that Xmas scan doesn’t work on Microsoft boxes due to their deficient
TCP stack. Same goes with CISCO, IRIX, HP/UX, and BSDI boxes.
# 注释 ：上面的命令使用 Xmas Tree scan 对 198.116 的所有以 1-127 结尾的主机进行扫描
# 目的端口是 22，53，110，143，4564 。
# 要注意，Xmas Tree 对 windows 主机不起作用
nmap -v --randomize_hosts -p 80 *.*.2.3-5
Rather than focus on a specific IP range, it is sometimes interesting
to slice up the entire Internet and scan a small sample from each
slice. This command finds all web servers on machines with IP
addresses ending in .2.3, .2.4, or .2.5. If you are root you might as
well add -sS. Also you will find more interesting machines starting
at 127. so you might want to use "127-222" instead of the first aster-
isks because that section has a greater density of interesting
machines (IMHO).
# 注释 ：
host -l company.com | cut -d -f 4 | ./nmap -v -iL -
Do a DNS zone transfer to find the hosts in company.com and then feed
the IP addresses to nmap. The above commands are for my GNU/Linux
box. You may need different commands/options on other operating sys-
tems.
