1

I am new to nmap and i read that you can limit the output of nmap to the top 100 ports by using the command -F such as:

nmap -F <IP>

My question is what are the top 100 ports. I have been looking everywhere but cannot find it. Appreciate if anyone can point me to the right direction

Mark E. Haase
  • 4,623
  • 1
  • 19
  • 18
user1234007
  • 13

4 Answers4

3

From the nmap man page:

Nmap needs an nmap-services file with frequency information in order to know which ports are the most common. If port frequency information isn´t available, perhaps because of the use of a custom nmap-services file, -F means to scan only ports that are named in the services file (normally Nmap scans all named ports plus ports 1–1024).

Further googling returns this file: https://svn.nmap.org/nmap/nmap-services

gronostaj
  • 57,004
  • 3
    You can see exactly which ports are scanned with this command: ./nmap -F -oG - 0.0.0.1 -v (The IP address 0.0.0.1 is reserved, and should cause an error instead of a port scan, to save time in this particular case) – bonsaiviking Aug 04 '14 at 12:15
1

nmap comes with a list. Here's the list in descending order of frequency. The -F option scans the top 100 on this list: Google Sheets » port_open_freq

Zaz
  • 2,506
  • 3
  • 28
  • 39
0

This fast scan will look at the top TCP and UDP ports most commonly found to be open following research by Gordon Lyon. The default scan looks at the top 1000 while in the past:

...The first 1024 ports as well as all named ports above 1024 were scanned (1715 TCP and 1488 UDP).

The fast scan is a further reduction and scans the most common of the 1000 most common.

Source: jahboite.co.uk

Matthew Williams
  • 4,324
0

If you want to know concretely which ports have been scanned, then let nmap create an XML-output file and within that search for the scaninfo tag.

countermode
  • 931