Your first command line, nmap -p 1-65535 hostname
, specifies all 65535 ports will be scanned. Your second command line does not specify which ports to scan, so nmap will default to the top 1000 ports.
The difference between your two scans is the set of ports you're scanning. The second scan is a small subset of the first, and so its results are a subset of the first scan.
Both scans are scanning TCP (implicit -sT
on the first, explicit -sS
on the second) and the second scans UDP as well (-sU
). The amount of UDP findings was probably very small if anything; it's really the number of TCP ports scanned that's making the difference.
Try adding -p 1-65535
to the second command line to equalize the scans.