I have a very weak memory, and i can't remember an option unless i understand what it stands for.

I can remember -sT option in nmap because i know that s stands for scan, and T for TCP Connect.

I know that -Pn skips the ping discovery and assumes directly that the host is up, but what does the P and the n stands for in -Pn ?

  • nmap man pages and the help text for the command itself will tell you all this. Knowing where to find the answer is better than memorizing the answer. – schroeder Jan 22 '16 at 16:12
  • @schroeder the user asked about the mnemonic of nmap switches. Man page remain just man..ual page and it doesn't cover that kind of content. – elsadek Jan 22 '16 at 16:38
  • @elsadek I know. One doesn't need a mnemonic when one has the documentation. – schroeder Jan 22 '16 at 17:40
  • @schroeder i know that i have documentation, but i need to remember the option in my head, not going through pages of manual to remember it each time i wanna scan. – Sidahmed Jan 22 '16 at 18:23

Here a cheat sheet that summarizes all nmap switches.


Notice all ping-related switches begin with 'P', so I assume Pn means Ping Not.
I thing it easy to remember now :)

| improve this answer | |
  • 2
    Yes, this is the intention. In 2010, the old -PN and -P0 names were replaced with -Pn, and -sP was replaced by -sn. This is so that the mnemonic for n means "don't do this." So -n means "don't do name resolution," -Pn means "don't do host discovery," and -sn means "don't do a port scan." – bonsaiviking Jan 22 '16 at 15:47

Not the answer you're looking for? Browse other questions tagged or ask your own question.