> For the complete documentation index, see [llms.txt](https://security-notes.gitbook.io/security-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://security-notes.gitbook.io/security-notes/networking/nmap/scan-types.md).

# Scan types

## -sS

* Quick and lightweigth since the handshake is not completed
* Allow to differentiate between opened, filtered and closed ports
* Default when nmap is run as root

## -sT

* Less efficient than -sS since it has to wait for the whole TCP handshake to complete
* Leaves traces in target's logfiles
* Default when nmap is not run with root privileges
* Guaranteed to work with proxychains

## -sU

* UDP scan, can be combined with TCP ones
* Very slow since most systems limit the number of responses per second
* Better prioritize the most used ports instead of scanning all 65535

## -sY

* SCTP equivalent of the TCP Syn scan
* Fast and efficient

## -sZ

* SCTP equivalent of -sN scan
* Stealthier and reliable
* Cannot distinguish between open and filtered ports

## -sN; -sF; -sX

* Exploit a loophole in RFC that can be used to sneak through IDS
* More chance of hiding the attack from detection
* The effectiveness of the scan depends on the implementation of the RFC 789 on the target machine
* More reliable against Unix-based systems
* Cannot distinguish open ports from filtered ones

## -sM

* Works like the -sN scan, but with ACK/FIN flags
* Many BSD-based systems simply drop the packet

## -sA

* Is used to map firewall rulesets, finding out which ports are filtered
* All reachable ports are mapped as unfiltered
* Ports that are unreachable or send back certain ICMP error messages are mapped as filtered
* Unable to determine if a port is open or closed

## -sW

* Works the same way as the -sA scan
* Is also able to differentiate between open and closed ports depending on the size of their window (0 if port is closed)
* Unreliable, only a minority of all devices implement the window in this way
* System that don't support this scan report all ports as closed
* If you find lots of closed ports and just a handful of filtered ones, than the system might be suscectible, even the reverse is true: if you find lots of filtered ports and just a couple of closed ones then they might actually be open

## -s0

* Allows to detect which IP protocols run on a given port
* Certain systems expect custom headers so some ports might be flagged as closed or open|filtered
* Does not test for TCP, UDP, ICMP, SCTP, and IGMP