8

I'm a little bit confused about what is the default scan option for an nmap scan. For example:

nmap -A -p 22

Am I performing a SYN scan or TCP connect scan?

7

When scanning TCP ports, Nmap will do a SYN scan by default and fall back to a connect scan if the user doesn't have sufficient privileges.

From the docs:

-sS (TCP SYN scan)

SYN scan is the default and most popular scan option for good reasons. It can be performed quickly, scanning thousands of ports per second on a fast network not hampered by restrictive firewalls. [...]

-sT (TCP connect scan)

TCP connect scan is the default TCP scan type when SYN scan is not an option. This is the case when a user does not have raw packet privileges. [...]

You can also use the verbose flag (-v) to find out which exact scan types are being run:

$ nmap -v -p 22 1.2.3.4

Starting Nmap 7.60 ( https://nmap.org ) at 2017-12-11 12:14 CET
Initiating Ping Scan at 12:14
Scanning 1.2.3.4 [2 ports]
Completed Ping Scan at 12:14, 0.00s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 12:14
Completed Parallel DNS resolution of 1 host. at 12:14, 0.01s elapsed
Initiating Connect Scan at 12:14
Scanning xxx (1.2.3.4) [1 port]
Completed Connect Scan at 12:14, 0.00s elapsed (1 total ports)
Nmap scan report for xxx (1.2.3.4)
Host is up (0.000070s latency).

PORT   STATE  SERVICE
22/tcp closed ssh

Read data files from: /usr/bin/../share/nmap
Nmap done: 1 IP address (1 host up) scanned in 0.04 seconds
$ sudo nmap -v -p 22 1.2.3.4

Starting Nmap 7.60 ( https://nmap.org ) at 2017-12-11 12:15 CET
Initiating Parallel DNS resolution of 1 host. at 12:15
Completed Parallel DNS resolution of 1 host. at 12:15, 0.01s elapsed
Initiating SYN Stealth Scan at 12:15
Scanning xxx (1.2.3.4) [1 port]
Completed SYN Stealth Scan at 12:15, 0.04s elapsed (1 total ports)
Nmap scan report for xxx (1.2.3.4)
Host is up (0.000045s latency).

PORT   STATE  SERVICE
22/tcp closed ssh

Read data files from: /usr/bin/../share/nmap
Nmap done: 1 IP address (1 host up) scanned in 0.12 seconds
           Raw packets sent: 1 (44B) | Rcvd: 2 (84B)
1

It depends on the priv. of the user executing the scan:

  • for a privledged user, the default option is the -sS scan (TCP SYN scan)
  • for an unpriledged user, the default option is the -sT scan (TCP connect() scan)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.