Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This is an extremely basic question but also one I can't really seem to find an answer for, despite looking through the nmap documentation (man, online, and google).

My question is, what is the difference between doing nmap <target> and nmap -sS <target>, for example? I know that -sS is a TCP SYN scan, but I guess what I am not sure of is how/why this differs from just scanning ports using nmap <target>?

share|improve this question

There is no difference. Per the man page -sS is the default scan type (usually.. see the man page for exceptions). I've confirmed this with a tcpdump.

share|improve this answer

-sS will force nmap to perform a SYN scan. Don't specifying a scan type will let nmap choose the best one.

If you're running nmap as a privileged user (typically: root), SYN scan will be selected by default. In this case there is no difference between both command lines (with or without -sS).

If you're running nmap as a simple user, SYN scan won't be available, in this case -sS will likely fail and the simple command nmap <target> command line will perform a TCP connect scan (equivalent of -sT).

If your system allows it you can force nmap to act as if it was (or not) privileged using --privileged or --unprivileged.

share|improve this answer
I don't remember, but won't nmap do ICMP echo when hosts are on different subnet and ARP requests when they are if no options are specified? Or is it an "on unless specified otherwise" option? – Hubert Kario Jul 18 '11 at 22:05

man nmap

 -sS (TCP SYN scan)
              SYN scan is the default and most popular scan option ...
share|improve this answer
In response to your updated question: no difference. – dmourati Jun 10 '11 at 15:49

-sS named "TCP SYN (Stealth) scan" (SYN,SYN-ACK,RST) is used by default for privileged (admin,root) user: there is no need to specify it.

Otherwise -sT named "TCP Connect scan" (full TCP handshake:SYN,SYN-ACK,ACK) is used for standard user, this is not as fast and stealthy.

Using -sS with standard (unprivileged) user will result in a failure as it required raw-packet privileges.

Using --packet-trace option will nmap will show you what happen at a low level and demonstrates the differences between -sT and -sS.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.