-p<port range>

-sA ACK Scan

--scanflags<TCP flags> -sF FIN Scan
-g/--source_port<portnumber> -sI Idel Scan

--spoof_mac <macaddress/prefix/vendor> -sL List/DNS Scan

-sM Maimon Scan FIN/ACK
-F Fast scan
-sN NULL Scan
-r ports consecutively Scan Types
-sO Protocol Scan
--randomize_hosts -sP Ping Scan
-S SRC_IP_ADDR
Scan Options -sR RPC Scan
-D<decoy1[,decoy2][,ME],> -P0 No Ping
-sS SYN Scan
-PI Ping
-e <interface> -sT TCP Connect (Default)
--interactive -PS[port list] TCP SYN
-sU UDP Scan
--send_eth/--send_ip -PA[port list] TCP ACK
-sW Window Scan
-sV Version/Service Info -PU[port list] UDP
-sX XMAS Scan
--versionlight -PE ICMP Echo
-b<ftp relay host>:FTP bounce Scan
--version_trace Service/Version -PP ICMP Timestamp
--version_all Detection -PM ICMP netmask
request
Ping Options -PT TCP ping
NMAP -PB =PT+PI
--datadir <dirname>
--execludefile<filename>
-6 Enable IPv6 --execlude <host1[,host2],..>

-V Print version number -iR<num hosts> Choose random targets

Input Options -iL List
--privileged User is a Misc
root/admin -A OS version Detection
-T0 ( Paranoid , serial 300 sec wait)
-f fragmentation -T1 (Sneaky serial 15 sec wait) -O OS scan

--mtu <val> -T2 (Polite ( serial 0.4 sec wait) Timing OS detection --osscan_guess aggressively

-T3 (Parallel scan) --osscan_limit promosing targets

--data_length <num>
-T4 ( Aggressive 300 sec timeout, 1.25 sec/probe)
--ttl <val> -oN Normal
-T5 ( Insane ( Parallel , 75 sec timeout and 0.3 sec/probe)
-N DNS resolution -oX XML
--host_timeout<msec>
Output -oG Grepable
-R Do reverse lookup --max_rtt_timeout(9000 msec default)
Options -oS Script kiddies
-n No DNS resolution --min_rtt_timeout(6000 msec default)
-oA On three major formats
--initial_rtt_timeout(6000 msec default)
-h Help
--scan_delay <msec> --stylesheet<pathURL>
-d debug 1-9
--max_scan_delay<msec>
--packet_trace
--max_parallelism/min_parallelism<msec>
NMAP MINDMAP --iflist interface list

Mohamed M. Aly --append_output

--resume