Ubuntu 22.04 nmap 安装与命令参数详解

目标：在 Ubuntu 22.04 上安装 nmap，并逐参数实测主机发现、端口扫描、服务版本与操作系统探测、脚本引擎、时序性能与输出格式等命令的输入输出。本文命令与输出均为 Ubuntu 22.04（Nmap 7.80）实测回显。raw socket 权限可用时，SYN/UDP/ACK 等基于原始套接字的扫描方式全部实测通过。

环境信息

操作系统：Ubuntu 22.04 LTS
nmap 版本：7.80（发行版包名 7.91+really7.80）；平台 x86_64-pc-linux-gnu
网卡：eth0，IP 172.22.0.2/16
靶机：172.22.0.2（本机，开放 22/3306/6379/8000/8080；其中 3306/6379 为回显 netdiag target service 的裸 socket，8000 为 Python SimpleHTTPServer）
对照机：172.22.0.3（CentOS 8，Nmap 7.70，仅开放 8000）
说明：本机对自身扫描为自扫（时延约 0.00000x 秒、Network Distance 0 hops）；默认端口集（前 1000）不含 6379，默认扫描仅见 4 个开放端口

工具概述

nmap（Network Mapper）是网络探测与安全审计工具，支持主机发现、端口扫描、服务/版本探测、操作系统指纹、NSE 脚本引擎等，常用于资产盘点、端口开放核查与安全评估。本文针对 Ubuntu 22.04 实测。

安装

在线安装（apt）

sudo apt update
sudo apt install -y nmap

安装后验证依赖库：

nmap --version

Nmap version 7.80 ( https://nmap.org )
Platform: x86_64-pc-linux-gnu
Compiled with: liblua-5.3.6 openssl-3.0.2 nmap-libssh2-1.8.2 libz-1.2.11 libpcre-8.39 libpcap-1.10.1 nmap-libdnet-1.12 ipv6
Compiled without:
Available nsock engines: epoll poll select

离线安装（.deb 包）

# 在可联网机器下载 nmap 及其依赖
cd /opt/netdiag-offline
apt-get download nmap libpcap0.8 libssh2-1 liblua5.3-0 libpcre3

# 目标机离线安装
sudo dpkg -i nmap_*.deb libpcap0.8_*.deb libssh2-1_*.deb liblua5.3-0_*.deb libpcre3_*.deb

主机发现

Ping 扫描 -sn

用途：只做主机发现、禁用端口扫描，快速盘点在线主机。对回环地址探测瞬时完成。

nmap -sn 127.0.0.1

Starting Nmap 7.80 ( https://nmap.org ) at 2026-10-06 04:53 UTC
Nmap scan report for localhost (127.0.0.1)
Host is up.
Nmap done: 1 IP address (1 host up) scanned in 0.00 seconds

Ping 扫描靶机 -sn

特权模式下默认组合探测（ICMP echo + TCP ACK 443 + TCP SYN 443 + ICMP timestamp），任一响应即判在线。

nmap -sn 172.22.0.2

Starting Nmap 7.80 ( https://nmap.org ) at 2026-10-06 04:53 UTC
Nmap scan report for netdiag-ubuntu (172.22.0.2)
Host is up.
Nmap done: 1 IP address (1 host up) scanned in 0.00 seconds

ICMP echo 主机发现 -PE -sn

用途：只使用 ICMP echo 请求做发现探测，目标回 echo reply 即判在线。适合禁用其他协议探测的场景。

nmap -PE -sn 172.22.0.2

Starting Nmap 7.80 ( https://nmap.org ) at 2026-10-06 04:53 UTC
Nmap scan report for netdiag-ubuntu (172.22.0.2)
Host is up.
Nmap done: 1 IP address (1 host up) scanned in 0.00 seconds

TCP SYN 主机发现 -PS80 -sn

用途：向目标指定端口发 SYN 包，回 SYN/ACK 判在线（开放）、回 RST 也判在线（关闭）。常用于穿透只放行 TCP 的防火墙，80 是最常用探测端口。

nmap -PS80 -sn 172.22.0.2

Starting Nmap 7.80 ( https://nmap.org ) at 2026-10-06 04:53 UTC
Nmap scan report for netdiag-ubuntu (172.22.0.2)
Host is up.
Nmap done: 1 IP address (1 host up) scanned in 0.00 seconds

UDP 主机发现 -PU -sn

用途：发 UDP 包（默认 40125 端口），目标回 ICMP port unreachable 即判在线，用于探测只过滤 TCP 的主机。

nmap -PU -sn 172.22.0.2

Starting Nmap 7.80 ( https://nmap.org ) at 2026-10-06 04:53 UTC
Nmap scan report for netdiag-ubuntu (172.22.0.2)
Host is up.
Nmap done: 1 IP address (1 host up) scanned in 0.00 seconds

跳过主机发现 -Pn

用途：假定所有目标在线、跳过发现阶段直接扫端口。目标禁 ping 时必用。注意默认 1000 端口集不含 6379。

nmap -Pn 172.22.0.2

Starting Nmap 7.80 ( https://nmap.org ) at 2026-10-06 04:53 UTC
Nmap scan report for netdiag-ubuntu (172.22.0.2)
Host is up (0.0000050s latency).
Not shown: 996 closed ports
PORT     STATE SERVICE
22/tcp   open  ssh
3306/tcp open  mysql
8000/tcp open  http-alt
8080/tcp open  http-proxy

Nmap done: 1 IP address (1 host up) scanned in 0.06 seconds

列表扫描 -sL

用途：只做 DNS 解析并列出目标，不发包探测，所以 0 hosts up 是正常现象（未做在线判断）。

nmap -sL 127.0.0.1/32

Starting Nmap 7.80 ( https://nmap.org ) at 2026-10-06 04:53 UTC
Nmap scan report for localhost (127.0.0.1)
Nmap done: 1 IP address (0 hosts up) scanned in 0.00 seconds

ARP ping 主机发现 -sn -PR

用途：用 ARP 请求/应答做发现，仅限本网段，比 ICMP 更隐蔽且不可路由。在以太网环境对局域网目标默认且最可靠。

nmap -sn -PR 172.22.0.2

Starting Nmap 7.80 ( https://nmap.org ) at 2026-10-06 04:57 UTC
Nmap scan report for netdiag-ubuntu (172.22.0.2)
Host is up.
Nmap done: 1 IP address (1 host up) scanned in 0.00 seconds

💡 对自身执行时目标即本机，无需跨链路 ARP，报告中不含 MAC 行；跨主机执行 -PR 时会出现 MAC Address: 72:18:8C:51:B4:75 行（见对照机实测）。

端口扫描

TCP connect 扫描 -sT

用途：用系统 connect() 系统调用完成三次握手，无需特权，日志会留痕但兼容性最好。默认扫前 1000 端口，6379 不在默认集内。

nmap -sT 172.22.0.2

Starting Nmap 7.80 ( https://nmap.org ) at 2026-10-06 04:53 UTC
Nmap scan report for netdiag-ubuntu (172.22.0.2)
Host is up (0.00012s latency).
Not shown: 996 closed ports
PORT     STATE SERVICE
22/tcp   open  ssh
3306/tcp open  mysql
8000/tcp open  http-alt
8080/tcp open  http-proxy

Nmap done: 1 IP address (1 host up) scanned in 0.05 seconds

SYN 半开扫描 -sS

用途：发 SYN 收到 SYN/ACK 后回 RST 中断握手，不建立完整连接，速度快且目标应用层无日志。需要 raw socket 权限。

nmap -sS 172.22.0.2

Starting Nmap 7.80 ( https://nmap.org ) at 2026-10-06 04:53 UTC
Nmap scan report for netdiag-ubuntu (172.22.0.2)
Host is up (0.0000050s latency).
Not shown: 996 closed ports
PORT     STATE SERVICE
22/tcp   open  ssh
3306/tcp open  mysql
8000/tcp open  http-alt
8080/tcp open  http-proxy

Nmap done: 1 IP address (1 host up) scanned in 0.06 seconds

快速扫描 -sS -F

用途：只扫 nmap-services 中记录的前 100 个端口，速度约为默认的 1/10。closed 计数变为 96，印证端口集缩小为 100。

nmap -sS -F 172.22.0.2

Starting Nmap 7.80 ( https://nmap.org ) at 2026-10-06 04:53 UTC
Nmap scan report for netdiag-ubuntu (172.22.0.2)
Host is up (0.0000050s latency).
Not shown: 96 closed ports
PORT     STATE SERVICE
22/tcp   open  ssh
3306/tcp open  mysql
8000/tcp open  http-alt
8080/tcp open  http-proxy

Nmap done: 1 IP address (1 host up) scanned in 0.04 seconds

指定端口扫描 -p

用途：精确指定端口列表。靶机 5 个监听端口（22/3306/6379/8000/8080）全开，6379 只有显式指定（或全端口扫描）才会出现。

nmap -p 22,3306,6379,8000,8080 172.22.0.2

Starting Nmap 7.80 ( https://nmap.org ) at 2026-10-06 04:53 UTC
Nmap scan report for netdiag-ubuntu (172.22.0.2)
Host is up (0.000035s latency).

PORT     STATE SERVICE
22/tcp   open  ssh
3306/tcp open  mysql
6379/tcp open  redis
8000/tcp open  http-alt
8080/tcp open  http-proxy

Nmap done: 1 IP address (1 host up) scanned in 0.05 seconds

端口范围扫描 -p 1-100

用途：-p 1-100 扫连续范围，该范围内仅 22 开放，其余 99 个 closed。

nmap -p 1-100 172.22.0.2

Starting Nmap 7.80 ( https://nmap.org ) at 2026-10-06 04:53 UTC
Nmap scan report for netdiag-ubuntu (172.22.0.2)
Host is up (0.000010s latency).
Not shown: 99 closed ports
PORT   STATE SERVICE
22/tcp open  ssh

Nmap done: 1 IP address (1 host up) scanned in 0.05 seconds

UDP 端口扫描 -sU

用途：发 UDP 探测：回 UDP 响应判 open，回 ICMP port unreachable 判 closed，无响应判 open|filtered。

nmap -sU -p 53,111,5353 127.0.0.1

Starting Nmap 7.80 ( https://nmap.org ) at 2026-10-06 04:53 UTC
Nmap scan report for localhost (127.0.0.1)
Host is up (0.000045s latency).

PORT     STATE  SERVICE
53/udp   closed domain
111/udp  closed rpcbind
5353/udp closed zeroconf

Nmap done: 1 IP address (1 host up) scanned in 0.05 seconds

全端口扫描 -p- --min-rate

用途：-p- 扫全部 65535 端口，--min-rate 10000 强制发包速率下限加速。

nmap -sT -p- 127.0.0.1 --min-rate 10000 2>&1 | tail -15

Starting Nmap 7.80 ( https://nmap.org ) at 2026-10-06 04:53 UTC
Nmap scan report for localhost (127.0.0.1)
Host is up (0.00025s latency).
Not shown: 65530 closed ports
PORT     STATE SERVICE
22/tcp   open  ssh
3306/tcp open  mysql
6379/tcp open  redis
8000/tcp open  http-alt
8080/tcp open  http-proxy

Nmap done: 1 IP address (1 host up) scanned in 1.44 seconds

常用端口扫描 --top-ports

用途：按 nmap-services 频率排序扫最常用的端口，兼顾速度与覆盖面。

nmap -sT --top-ports 20 172.22.0.2

Starting Nmap 7.80 ( https://nmap.org ) at 2026-10-06 04:53 UTC
Nmap scan report for netdiag-ubuntu (172.22.0.2)
Host is up (0.00013s latency).

PORT     STATE  SERVICE
21/tcp   closed ftp
22/tcp   open   ssh
23/tcp   closed telnet
25/tcp   closed smtp
53/tcp   closed domain
80/tcp   closed http
110/tcp  closed pop3
111/tcp  closed rpcbind
135/tcp  closed msrpc
139/tcp  closed netbios-ssn
143/tcp  closed imap
443/tcp  closed https
445/tcp  closed microsoft-ds
993/tcp  closed imaps
995/tcp  closed pop3s
1723/tcp closed pptp
3306/tcp open   mysql
3389/tcp closed ms-wbt-server
5900/tcp closed vnc
8080/tcp open   http-proxy

Nmap done: 1 IP address (1 host up) scanned in 0.03 seconds

只显示开放端口 --open

用途：过滤输出只显示 open（或 open|filtered）端口，大幅精简大范围扫描输出。

nmap -sT -p 8000 --open 172.22.0.2

Starting Nmap 7.80 ( https://nmap.org ) at 2026-10-06 04:53 UTC
Nmap scan report for netdiag-ubuntu (172.22.0.2)
Host is up (0.00015s latency).

PORT     STATE SERVICE
8000/tcp open  http-alt

Nmap done: 1 IP address (1 host up) scanned in 0.03 seconds

ACK 扫描 -sA（防火墙/IDS 侦测）

用途：只发 ACK 包：回 RST 判 unfiltered（端口可达、未被过滤），无响应判 filtered。不能区分 open/closed，专用于探测防火墙过滤规则。

nmap -sA -p 8000 172.22.0.2

Starting Nmap 7.80 ( https://nmap.org ) at 2026-10-06 04:57 UTC
Nmap scan report for netdiag-ubuntu (172.22.0.2)
Host is up (0.000086s latency).

PORT     STATE      SERVICE
8000/tcp unfiltered http-alt

Nmap done: 1 IP address (1 host up) scanned in 0.04 seconds

服务与版本探测

服务版本探测 -sV

用途：对开放端口发送探测指纹串，匹配服务与版本。靶机 8000 为 Python SimpleHTTPServer，被准确识别；22/3306 是回显裸 socket，无法匹配已知指纹，标记为 ssh?/mysql? 并输出未识别服务的原始指纹。

nmap -sV -p 22,3306,8000 172.22.0.2

Starting Nmap 7.80 ( https://nmap.org ) at 2026-10-06 04:53 UTC
Nmap scan report for netdiag-ubuntu (172.22.0.2)
Host is up (0.000044s latency).

PORT     STATE SERVICE VERSION
22/tcp   open  ssh?
3306/tcp open  mysql?
8000/tcp open  http    SimpleHTTPServer 0.6 (Python 3.10.12)
2 services unrecognized despite returning data. If you know the service/version, please submit the following fingerprints at https://nmap.org/cgi-bin/submit.cgi?new-service :
==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)==============
SF-Port22-TCP:V=7.80%I=7%D=10/6%Time=6AC47EE1%P=x86_64-pc-linux-gnu%r(Gene
SF:ricLines,18,"netdiag\x20target\x20service\r\n")%r(GetRequest,18,"netdia
SF:g\x20target\x20service\r\n")%r(HTTPOptions,18,"netdiag\x20target\x20ser
SF:vice\r\n")%r(RTSPRequest,18,"netdiag\x20target\x20service\r\n")%r(RPCCh
SF:eck,18,"netdiag\x20target\x20service\r\n")%r(DNSVersionBindReqTCP,18,"n
SF:etdiag\x20target\x20service\r\n")%r(DNSStatusRequestTCP,18,"netdiag\x20
……（截断，指纹块较长，每个探测串均回显 netdiag target service）……
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 6.46 seconds

版本探测强度 --version-intensity

用途：--version-intensity <0-9> 控制探测串数量：0 最轻量只试最可能匹配，9 全部尝试。强度 5 为适中值。

nmap -sV --version-intensity 5 -p 8000 172.22.0.2

Starting Nmap 7.80 ( https://nmap.org ) at 2026-10-06 04:54 UTC
Nmap scan report for netdiag-ubuntu (172.22.0.2)
Host is up (0.000055s latency).

PORT     STATE SERVICE VERSION
8000/tcp open  http    SimpleHTTPServer 0.6 (Python 3.10.12)

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 6.36 seconds

OS 探测

操作系统指纹 -O

用途：通过 TCP/IP 协议栈特征（初始序列号、窗口大小、TTL、选项等）猜测目标 OS。

nmap -O 172.22.0.2

Starting Nmap 7.80 ( https://nmap.org ) at 2026-10-06 04:53 UTC
Nmap scan report for netdiag-ubuntu (172.22.0.2)
Host is up (0.000095s latency).
Not shown: 996 closed ports
PORT     STATE SERVICE
22/tcp   open  ssh
3306/tcp open  mysql
8000/tcp open  http-alt
8080/tcp open  http-proxy
Device type: general purpose
Running: Linux 2.6.X
OS CPE: cpe:/o:linux:linux_kernel:2.6.32
OS details: Linux 2.6.32
Network Distance: 0 hops

OS detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 1.53 seconds

⚠️ 自扫场景（Network Distance 0 hops）识别为 Linux 2.6.32——桥接 veth 环境下指纹特征有限，与实际 Ubuntu 22.04（5.x 内核）有偏差，如实记录。OS 指纹是概率性结论，仅供参考。

综合扫描 -A

用途：一次启用 OS 检测 + 版本检测 + 脚本扫描 + traceroute。

nmap -A -p 8000 172.22.0.2

Starting Nmap 7.80 ( https://nmap.org ) at 2026-10-06 04:54 UTC
Nmap scan report for netdiag-ubuntu (172.22.0.2)
Host is up (0.000061s latency).

PORT     STATE SERVICE VERSION
8000/tcp open  http    SimpleHTTPServer 0.6 (Python 3.10.12)
|_http-server-header: SimpleHTTP/0.6 Python/3.10.12
|_http-title: Site doesn't have a title (text/html).
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Linux 2.6.X
OS CPE: cpe:/o:linux:linux_kernel:2.6.32
OS details: Linux 2.6.32
Network Distance: 0 hops

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 8.01 seconds

脚本引擎

默认脚本扫描 -sC

用途：等价于 --script=default，运行默认分类脚本，对 HTTP 服务自动执行 http-title 等探测。

nmap -sC -p 8000 172.22.0.2

Starting Nmap 7.80 ( https://nmap.org ) at 2026-10-06 04:54 UTC
Nmap scan report for netdiag-ubuntu (172.22.0.2)
Host is up (0.000060s latency).

PORT     STATE SERVICE
8000/tcp open  http-alt
|_http-title: Site doesn't have a title (text/html).

Nmap done: 1 IP address (1 host up) scanned in 0.36 seconds

网页标题脚本 --script=http-title

用途：抓取页面 <title>，页面无标题时如回显所示。

nmap --script=http-title -p 8000 172.22.0.2

Starting Nmap 7.80 ( https://nmap.org ) at 2026-10-06 04:54 UTC
Nmap scan report for netdiag-ubuntu (172.22.0.2)
Host is up (0.000063s latency).

PORT     STATE SERVICE
8000/tcp open  http-alt
|_http-title: Site doesn't have a title (text/html).

Nmap done: 1 IP address (1 host up) scanned in 0.25 seconds

响应头脚本 --script=http-headers

用途：用 HEAD 请求抓取 HTTP 响应头，可见 Server、Content-type、Content-Length 等。

nmap --script=http-headers -p 8000 172.22.0.2

Starting Nmap 7.80 ( https://nmap.org ) at 2026-10-06 04:54 UTC
Nmap scan report for netdiag-ubuntu (172.22.0.2)
Host is up (0.000059s latency).

PORT     STATE SERVICE
8000/tcp open  http-alt
| http-headers:
|   Server: SimpleHTTP/0.6 Python/3.10.12
|   Date: Tue, 06 Oct 2026 04:54:23 GMT
|   Content-type: text/html
|   Content-Length: 18
|   Last-Modified: Tue, 06 Oct 2026 04:23:17 GMT
|
|_  (Request type: HEAD)

Nmap done: 1 IP address (1 host up) scanned in 0.24 seconds

脚本参数 --script-args

用途：为 NSE 脚本传参，如自定义 http.useragent，可绕过基于 UA 的简单过滤。

nmap -sV --script-args http.useragent="netdiag-test" -p 8000 172.22.0.2

Starting Nmap 7.80 ( https://nmap.org ) at 2026-10-06 04:54 UTC
Nmap scan report for netdiag-ubuntu (172.22.0.2)
Host is up (0.000056s latency).

PORT     STATE SERVICE VERSION
8000/tcp open  http    SimpleHTTPServer 0.6 (Python 3.10.12)

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 6.37 seconds

时序与性能

时序模板 -T4

用途：-T<0-5> 从 paranoid（0）到 insane（5）。T4 是高速扫描的常用档位（并行度与超时更激进）。

nmap -T4 -F 127.0.0.1

Starting Nmap 7.80 ( https://nmap.org ) at 2026-10-06 04:54 UTC
Nmap scan report for localhost (127.0.0.1)
Host is up (0.0000050s latency).
Not shown: 96 closed ports
PORT     STATE SERVICE
22/tcp   open  ssh
3306/tcp open  mysql
8000/tcp open  http-alt
8080/tcp open  http-proxy

Nmap done: 1 IP address (1 host up) scanned in 0.05 seconds

慢速模板 -T0 / -T2

用途：T0 极慢（串行发包、探测间隔最长 5 分钟），用于躲避 IDS。限时 60 秒实测未完成即被终止（退出码 124），仅输出首行。

nmap -T0 -p 8000 172.22.0.2

Starting Nmap 7.80 ( https://nmap.org ) at 2026-10-06 04:54 UTC

改测 T2（polite 档，速度明显慢于默认 T3，本机 0.43 秒完成）：

nmap -T2 -p 8000 172.22.0.2

Starting Nmap 7.80 ( https://nmap.org ) at 2026-10-06 04:55 UTC
Nmap scan report for netdiag-ubuntu (172.22.0.2)
Host is up (0.000089s latency).

PORT     STATE SERVICE
8000/tcp open  http-alt

Nmap done: 1 IP address (1 host up) scanned in 0.43 seconds

探测并行度 --min-parallelism

用途：设每组至少多个探测包并行，加速对高时延目标的扫描。

nmap --min-parallelism 10 -F 127.0.0.1

Starting Nmap 7.80 ( https://nmap.org ) at 2026-10-06 04:55 UTC
Nmap scan report for localhost (127.0.0.1)
Host is up (0.0000070s latency).
Not shown: 96 closed ports
PORT     STATE SERVICE
22/tcp   open  ssh
3306/tcp open  mysql
8000/tcp open  http-alt
8080/tcp open  http-proxy

Nmap done: 1 IP address (1 host up) scanned in 0.05 seconds

主机超时 --host-timeout

用途：单个目标超过阈值即放弃，避免慢速目标拖垮整批扫描。

nmap --host-timeout 30s -F 127.0.0.1

Starting Nmap 7.80 ( https://nmap.org ) at 2026-10-06 04:55 UTC
Nmap scan report for localhost (127.0.0.1)
Host is up (0.0000050s latency).
Not shown: 96 closed ports
PORT     STATE SERVICE
22/tcp   open  ssh
3306/tcp open  mysql
8000/tcp open  http-alt
8080/tcp open  http-proxy

Nmap done: 1 IP address (1 host up) scanned in 0.05 seconds

重试上限 --max-retries

用途：丢包探测最多重传 N 次，大幅缩短慢速/丢包网络的扫描时间（默认 10 次）。

nmap --max-retries 1 -F 127.0.0.1

Starting Nmap 7.80 ( https://nmap.org ) at 2026-10-06 04:55 UTC
Nmap scan report for localhost (127.0.0.1)
Host is up (0.0000050s latency).
Not shown: 96 closed ports
PORT     STATE SERVICE
22/tcp   open  ssh
3306/tcp open  mysql
8000/tcp open  http-alt
8080/tcp open  http-proxy

Nmap done: 1 IP address (1 host up) scanned in 0.04 seconds

输出格式

标准格式 -oN

用途：按标准文本写入文件，文件首行以 # 记录完整命令行与时间，适合人读与 --resume 续扫。

nmap -F -oN /tmp/nmap-normal.txt 127.0.0.1
head -20 /tmp/nmap-normal.txt

=====head=====
# Nmap 7.80 scan initiated Tue Oct  6 04:55:58 2026 as: nmap -F -oN /tmp/nmap-normal.txt 127.0.0.1
Nmap scan report for localhost (127.0.0.1)
Host is up (0.0000060s latency).
Not shown: 96 closed ports
PORT     STATE SERVICE
22/tcp   open  ssh
3306/tcp open  mysql
8000/tcp open  http-alt
8080/tcp open  http-proxy

# Nmap done at Tue Oct  6 04:55:58 2026 -- 1 IP address (1 host up) scanned in 0.06 seconds

Grepable 格式 -oG

用途：每主机一行 Host: ... Ports: ...，可直接 grep/awk 处理。

nmap -F -oG /tmp/nmap-grep.txt 127.0.0.1
head -10 /tmp/nmap-grep.txt

=====head=====
# Nmap 7.80 scan initiated Tue Oct  6 04:56:01 2026 as: nmap -F -oG /tmp/nmap-grep.txt 127.0.0.1
Host: 127.0.0.1 (localhost)     Status: Up
Host: 127.0.0.1 (localhost)     Ports: 22/open/tcp//ssh///, 3306/open/tcp//mysql///, 8000/open/tcp//http-alt///, 8080/open/tcp//http-proxy///   Ignored State: closed (96)
# Nmap done at Tue Oct  6 04:56:01 2026 -- 1 IP address (1 host up) scanned in 0.05 seconds

XML 格式 -oX

用途：输出结构化 XML（含 scaninfo 完整端口集、状态原因、时间戳），适合程序解析或经 XSL 转 HTML。

nmap -F -oX /tmp/nmap-xml.xml 127.0.0.1
head -15 /tmp/nmap-xml.xml

=====head=====
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE nmaprun>
<?xml-stylesheet href="file:///usr/bin/../share/nmap/nmap.xsl" type="text/xsl"?>
<!-- Nmap 7.80 scan initiated Tue Oct  6 04:56:02 2026 as: nmap -F -oX /tmp/nmap-xml.xml 127.0.0.1 -->
<nmaprun scanner="nmap" args="nmap -F -oX /tmp/nmap-xml.xml 127.0.0.1" start="1791262562" startstr="Tue Oct  6 04:56:02 2026" version="7.80" xmloutputversion="1.04">
<scaninfo type="syn" protocol="tcp" numservices="100" services="7,9,13,21-23,25-26,37,53,79-81,88,106,110-111,113,119,135,139,143-144,179,199,389,427,443-445,465,513-515,543-544,548,554,587,631,646,873,990,993,995,1025-1029,1110,1433,1720,1723,1755,1900,2000-2001,2049,2121,2717,3000,3128,3306,3389,3986,4899,5000,5009,5051,5060,5101,5190,5357,5432,5631,5666,5800,5900,6000-6001,6646,7070,8000,8008-8009,8080-8081,8443,8888,9100,9999-10000,32768,49152-49157"/>
<verbose level="0"/>
<debugging level="0"/>
<host starttime="1791262562" endtime="1791262562"><status state="up" reason="localhost-response" reason_ttl="0"/>
<address addr="127.0.0.1" addrtype="ipv4"/>
<hostnames>
<hostname name="localhost" type="PTR"/>
</hostnames>
<ports><extraports state="closed" count="96">
<extrareasons reason="resets" count="96"/>

三格式同时输出 -oA

用途：-oA <basename> 一次生成 .nmap（标准）、.gnmap（grepable）、.xml 三种文件。

nmap -F -oA /tmp/nmap-all 127.0.0.1
ls /tmp/nmap-all*

-rw-r--r-- 1 root root  388 Oct  6 04:56 /tmp/nmap-all.gnmap
-rw-r--r-- 1 root root  401 Oct  6 04:56 /tmp/nmap-all.nmap
-rw-r--r-- 1 root root 2129 Oct  6 04:56 /tmp/nmap-all.xml

详细输出 -v

用途：提升详细度，显示扫描阶段、逐个"Discovered open port"实时发现过程与收发包统计。

nmap -v -F 127.0.0.1

Starting Nmap 7.80 ( https://nmap.org ) at 2026-10-06 04:56 UTC
Initiating SYN Stealth Scan at 04:56
Scanning localhost (127.0.0.1) [100 ports]
Discovered open port 22/tcp on 127.0.0.1
Discovered open port 3306/tcp on 127.0.0.1
Discovered open port 8080/tcp on 127.0.0.1
Discovered open port 8000/tcp on 127.0.0.1
Completed SYN Stealth Scan at 04:56, 0.01s elapsed (100 total ports)
Nmap scan report for localhost (127.0.0.1)
Host is up (0.0000050s latency).
Not shown: 96 closed ports
PORT     STATE SERVICE
22/tcp   open  ssh
3306/tcp open  mysql
8000/tcp open  http-alt
8080/tcp open  http-proxy

Read data files from: /usr/bin/../share/nmap
Nmap done: 1 IP address (1 host up) scanned in 0.05 seconds
           Raw packets sent: 100 (4.400KB) | Rcvd: 204 (8.576KB)

目标与源规格

CIDR 列表列举 -sL 192.0.2.0/30

用途：192.0.2.0/24 是 RFC 5737 文档保留网段（TEST-NET-1）。-sL 列举 /30 的 4 个地址（含网络地址与广播地址），不做任何探测。

nmap -sL 192.0.2.0/30

Starting Nmap 7.80 ( https://nmap.org ) at 2026-10-06 04:56 UTC
Nmap scan report for 192.0.2.0
Nmap scan report for 192.0.2.1
Nmap scan report for 192.0.2.2
Nmap scan report for 192.0.2.3
Nmap done: 4 IP addresses (0 hosts up) scanned in 0.01 seconds

从文件读取目标 -iL

用途：从文件逐行读入目标，适合大批量目标管理。

echo 127.0.0.1 > /tmp/targets.txt
nmap -F -iL /tmp/targets.txt

Starting Nmap 7.80 ( https://nmap.org ) at 2026-10-06 04:56 UTC
Nmap scan report for localhost (127.0.0.1)
Host is up (0.0000070s latency).
Not shown: 96 closed ports
PORT     STATE SERVICE
22/tcp   open  ssh
3306/tcp open  mysql
8000/tcp open  http-alt
8080/tcp open  http-proxy

Nmap done: 1 IP address (1 host up) scanned in 0.05 seconds

排除目标 --exclude

用途：从扫描集中剔除指定主机。⚠️ 注意：逗号分隔的多个目标作为单个参数传入时不被识别（nmap 目标之间用空格分隔，逗号只用于 --exclude 自身），实测报解析失败：

nmap -F --exclude 127.0.0.1 127.0.0.1,127.0.0.2

Starting Nmap 7.80 ( https://nmap.org ) at 2026-10-06 04:56 UTC
Nmap done: 0 IP addresses (0 hosts up) scanned in 0.03 seconds
Failed to resolve "127.0.0.1,127.0.0.2".
WARNING: No targets were specified, so 0 hosts scanned.

改用空格分隔两个目标，127.0.0.1 被排除，仅扫 127.0.0.2：

nmap -F --exclude 127.0.0.1 127.0.0.1 127.0.0.2

Starting Nmap 7.80 ( https://nmap.org ) at 2026-10-06 04:57 UTC
Nmap scan report for ops (127.0.0.2)
Host is up (0.0000050s latency).
Not shown: 96 closed ports
PORT     STATE SERVICE
22/tcp   open  ssh
3306/tcp open  mysql
8000/tcp open  http-alt
8080/tcp open  http-proxy

Nmap done: 1 IP address (1 host up) scanned in 0.05 seconds

伪造源地址 -S -e

用途：-S 指定源 IP、-e 指定出口接口。用真实源 IP 经 eth0 扫回环时，nmap 仍按伪造场景告警，且发现探测无法收到应答，判定主机离线——如实记录此行为（实际渗透中 -S 常与 -Pn 及 decoy 配合使用）。

nmap -F -S 172.22.0.2 -e eth0 127.0.0.1

WARNING: If -S is being used to fake your source address, you may also have to use -e <interface> and -Pn .  If you are using it to specify your real source address, you can ignore this warning.
Starting Nmap 7.80 ( https://nmap.org ) at 2026-10-06 04:57 UTC
Note: Host seems down. If it is really up, but blocking our ping probes, try -Pn
Nmap done: 1 IP address (0 hosts up) scanned in 3.05 seconds

指定源端口 --source-port / -g

用途：让扫描包从固定源端口发出（-g 是其短选项）。部分防火墙信任特定源端口（如 53/44444）的回包，可借此穿透。

nmap -F --source-port 44444 172.22.0.2

Starting Nmap 7.80 ( https://nmap.org ) at 2026-10-06 04:57 UTC
Nmap scan report for netdiag-ubuntu (172.22.0.2)
Host is up (0.0000080s latency).
Not shown: 96 closed ports
PORT     STATE SERVICE
22/tcp   open  ssh
3306/tcp open  mysql
8000/tcp open  http-alt
8080/tcp open  http-proxy

Nmap done: 1 IP address (1 host up) scanned in 0.05 seconds

nmap -F -g 55555 172.22.0.2

Starting Nmap 7.80 ( https://nmap.org ) at 2026-10-06 04:57 UTC
Nmap scan report for netdiag-ubuntu (172.22.0.2)
Host is up (0.000011s latency).
Not shown: 96 closed ports
PORT     STATE SERVICE
22/tcp   open  ssh
3306/tcp open  mysql
8000/tcp open  http-alt
8080/tcp open  http-proxy

Nmap done: 1 IP address (1 host up) scanned in 0.06 seconds

帮助与版本输出

完整帮助 -h

nmap -h 输出全部选项摘要（完整输出，未截断）：

nmap -h

Nmap 7.80 ( https://nmap.org )
Usage: nmap [Scan Type(s)] [Options] {target specification}
TARGET SPECIFICATION:
  Can pass hostnames, IP addresses, networks, etc.
  Ex: scanme.nmap.org, microsoft.com/24, 192.168.0.1; 10.0.0-255.1-254
  -iL <inputfilename>: Input from list of hosts/networks
  -iR <num hosts>: Choose random targets
  --exclude <host1[,host2][,host3],...>: Exclude hosts/networks
  --excludefile <exclude_file>: Exclude list from file
HOST DISCOVERY:
  -sL: List Scan - simply list targets to scan
  -sn: Ping Scan - disable port scan
  -Pn: Treat all hosts as online -- skip host discovery
  -PS/PA/PU/PY[portlist]: TCP SYN/ACK, UDP or SCTP discovery to given ports
  -PE/PP/PM: ICMP echo, timestamp, and netmask request discovery probes
  -PO[protocol list]: IP Protocol Ping
  -n/-R: Never do DNS resolution/Always resolve [default: sometimes]
  --dns-servers <serv1[,serv2],...>: Specify custom DNS servers
  --system-dns: Use OS's DNS resolver
  --traceroute: Trace hop path to each host
SCAN TECHNIQUES:
  -sS/sT/sA/sW/sM: TCP SYN/Connect()/ACK/Window/Maimon scans
  -sU: UDP Scan
  -sN/sF/sX: TCP Null, FIN, and Xmas scans
  --scanflags <flags>: Customize TCP scan flags
  -sI <zombie host[:probeport]>: Idle scan
  -sY/sZ: SCTP INIT/COOKIE-ECHO scans
  -sO: IP protocol scan
  -b <FTP relay host>: FTP bounce scan
PORT SPECIFICATION AND SCAN ORDER:
  -p <port ranges>: Only scan specified ports
    Ex: -p22; -p1-65535; -p U:53,111,137,T:21-25,80,139,8080,S:9
  --exclude-ports <port ranges>: Exclude the specified ports from scanning
  -F: Fast mode - Scan fewer ports than the default scan
  -r: Scan ports consecutively - don't randomize
  --top-ports <number>: Scan <number> most common ports
  --port-ratio <ratio>: Scan ports more common than <ratio>
SERVICE/VERSION DETECTION:
  -sV: Probe open ports to determine service/version info
  --version-intensity <level>: Set from 0 (light) to 9 (try all probes)
  --version-light: Limit to most likely probes (intensity 2)
  --version-all: Try every single probe (intensity 9)
  --version-trace: Show detailed version scan activity (for debugging)
SCRIPT SCAN:
  -sC: equivalent to --script=default
  --script=<Lua scripts>: <Lua scripts> is a comma separated list of
           directories, script-files or script-categories
  --script-args=<n1=v1,[n2=v2,...]>: provide arguments to scripts
  --script-args-file=filename: provide NSE script args in a file
  --script-trace: Show all data sent and received
  --script-updatedb: Update the script database.
  --script-help=<Lua scripts>: Show help about scripts.
           <Lua scripts> is a comma-separated list of script-files or
           script-categories.
OS DETECTION:
  -O: Enable OS detection
  --osscan-limit: Limit OS detection to promising targets
  --osscan-guess: Guess OS more aggressively
TIMING AND PERFORMANCE:
  Options which take <time> are in seconds, or append 'ms' (milliseconds),
  's' (seconds), 'm' (minutes), or 'h' (hours) to the value (e.g. 30m).
  -T<0-5>: Set timing template (higher is faster)
  --min-hostgroup/max-hostgroup <size>: Parallel host scan group sizes
  --min-parallelism/max-parallelism <numprobes>: Probe parallelization
  --min-rtt-timeout/max-rtt-timeout/initial-rtt-timeout <time>: Specifies
      probe round trip time.
  --max-retries <tries>: Caps number of port scan probe retransmissions.
  --host-timeout <time>: Give up on target after this long
  --scan-delay/--max-scan-delay <time>: Adjust delay between probes
  --min-rate <number>: Send packets no slower than <number> per second
  --max-rate <number>: Send packets no faster than <number> per second
FIREWALL/IDS EVASION AND SPOOFING:
  -f; --mtu <val>: fragment packets (optionally w/given MTU)
  -D <decoy1,decoy2[,ME],...>: Cloak a scan with decoys
  -S <IP_Address>: Spoof source address
  -e <iface>: Use specified interface
  -g/--source-port <portnum>: Use given port number
  --proxies <url1,[url2],...>: Relay connections through HTTP/SOCKS4 proxies
  --data <hex string>: Append a custom payload to sent packets
  --data-string <string>: Append an ASCII string to sent packets
  --data-length <num>: Append random data to sent packets
  --ip-options <options>: Send packets with specified ip options
  --ttl <val>: Set IP time-to-live field
  --spoof-mac <mac address/prefix/vendor name>: Spoof your MAC address
  --badsum: Send packets with a bogus TCP/UDP/SCTP checksum
OUTPUT:
  -oN/-oX/-oS/-oG <file>: Output scan in normal, XML, s|<rIpt kIddi3,
     and Grepable format, respectively, to the given filename.
  -oA <basename>: Output in the three major formats at once
  -v: Increase verbosity level (use -vv or more for greater effect)
  -d: Increase debugging level (use -dd or more for greater effect)
  --reason: Display the reason a port is in a particular state
  --open: Only show open (or possibly open) ports
  --packet-trace: Show all packets sent and received
  --iflist: Print host interfaces and routes (for debugging)
  --append-output: Append to rather than clobber specified output files
  --resume <filename>: Resume an aborted scan
  --stylesheet <path/URL>: XSL stylesheet to transform XML output to HTML
  --webxml: Reference stylesheet from Nmap.Org for more portable XML
  --no-stylesheet: Prevent associating of XSL stylesheet w/XML output
MISC:
  -6: Enable IPv6 scanning
  -A: Enable OS detection, version detection, script scanning, and traceroute
  --datadir <dirname>: Specify custom Nmap data file location
  --send-eth/--send-ip: Send using raw ethernet frames or IP packets
  --privileged: Assume that the user is fully privileged
  --unprivileged: Assume that the user lacks raw socket privileges
  -V: Print version number
  -h: Print this help summary page.
EXAMPLES:
  nmap -v -A scanme.nmap.org
  nmap -v -sn 192.168.0.0/16 10.0.0.0/8
  nmap -v -iR 10000 -Pn -p 80
SEE THE MAN PAGE (https://nmap.org/book/man.html) FOR MORE OPTIONS AND EXAMPLES

常见问题

Q：默认扫描为什么看不到 6379（redis）端口？ A：nmap 默认只扫前 1000 个常用端口，6379 不在默认集内。用 -p 6379 指定或 -p- 全端口扫描即可看到。

Q：扫描报 Host seems down 但目标实际在线？ A：目标禁 ping（blocking our ping probes）时可加 -Pn 跳过主机发现阶段，直接扫端口。

Q：-t（小写）是什么？与 -T4 有什么区别？ A：-t 在 nmap 中不是标准选项（帮助里无对应项）；-T<0-5> 才是时序模板，如 -T4 为高速档位。二者完全不同。

Q：为什么自扫和自己扫自己的 -O 识别出 Linux 2.6.32？ A：桥接虚拟网卡环境下 TCP/IP 栈指纹特征有限，OS 探测是概率性结论。跨主机、多开放/关闭端口的场景下识别更准确。

Q：--script=ssh-auth-methods 在 CentOS 侧无任何输出？ A：nmap 7.70 未编入 libssh2（Compiled without: libssh2 libz），依赖 SSH2 库的 NSE 脚本无法执行。Ubuntu 的 7.80 编入了 libssh2，可正常执行（对非标准 SSH 服务会报脚本执行失败）。

参考链接

nmap 官方文档：https://nmap.org/book/man.html
nmap 官方下载：https://nmap.org/download.html