Nmap: what is the difference between “nmap <target>” and “nmap -sS <target>”?

Question

This is an extremely basic question but also one I can't really seem to find an answer for, despite looking through the nmap documentation (man, online, and google).

My question is, what is the difference between doing nmap <target> and nmap -sS <target>, for example? I know that -sS is a TCP SYN scan, but I guess what I am not sure of is how/why this differs from just scanning ports using nmap <target>?

Answer 1

There is no difference. Per the man page -sS is the default scan type (usually.. see the man page for exceptions). I've confirmed this with a tcpdump.

Answer 2

-sS will force nmap to perform a SYN scan. Don't specifying a scan type will let nmap choose the best one.

If you're running nmap as a privileged user (typically: root), SYN scan will be selected by default. In this case there is no difference between both command lines (with or without -sS).

If you're running nmap as a simple user, SYN scan won't be available, in this case -sS will likely fail and the simple command nmap <target> command line will perform a TCP connect scan (equivalent of -sT).

If your system allows it you can force nmap to act as if it was (or not) privileged using --privileged or --unprivileged.

Answer 3

man nmap

 -sS (TCP SYN scan)
              SYN scan is the default and most popular scan option ...