Cram Sheet · Domain 4.1

Nmap Flags — Quick Reference

Network reconnaissance and discovery tools · CompTIA Security+ SY0-701

Flag	Function	Exam-relevant note
`-sS`	TCP SYN scan	“Stealth” / half-open scan — never completes the handshake, less likely to be logged
`-sT`	TCP connect scan	Full three-way handshake — used when SYN scan isn't available (no raw socket privileges)
`-sU`	UDP scan	Slower, less reliable than TCP scans
`-sV`	Service/version detection	Identifies what's running on open ports
`-O`	OS detection	Fingerprints the target OS
`-sn`	Ping scan	Host discovery only — no port scan
`-Pn`	Skip host discovery	Treats all hosts as up, scans anyway
`-p`	Port specification	e.g. `-p 1-1000`, `-p-` for all 65535
`-A`	Aggressive scan	Bundles OS detection, version detection, script scanning, traceroute
`-T0` – `-T5`	Timing template	Paranoid to insane — lower is slower/stealthier

Most-tested distinction: SYN scan vs. connect scan. SYN (-sS) is stealthier because it never completes the handshake; connect scan (-sT) is noisier and more likely to trip IDS/logging.

Nmap falls under Domain 4.1 as a network reconnaissance/discovery tool — often paired against Nessus (vulnerability scanning) or Wireshark/tcpdump (packet capture) in “which tool would you use” questions.