I am a network guy and not a “hacker” or whatever the official term is these days.

I’ve been learning how to use nmap as I think it’s a great tool for just keeping the network secure.

The thing is Id like to run the “default or (discovery and safe)” against a set of IP addresses.

In this case though I already know what the IP addresses are and exactly what ports they run.

There are also a lot of hosts (over 800).

If I wanted to run the “default or (discovery and safe)” script on this list of 800 IPs which of the following is correct.

  1. Running nmap specifically at one IP with -p 80,443 --script “default or (discovery and safe)”. Does this just blindly run every script “default or (discovery and safe)”. Or does it only run the scripts that relate to port 80 and 443 only. Ignoring whois scripts etc as I know how to exclude those. Or do I have to only include the ones I’m interested in “http-*” etc.

  2. I suppose the question is as to above if the script is for SMB then will it not bother with the script as it can see its for different ports. My end goal is to scan a list of IPs that I know are alive and I know the ports for with “default or (discovery and safe)” without running pointless scripts I don’t need to. Doing a script for each IP and list of ports in turn is fine if that’s what I need to do.

In this particular task Im mainly trying to see what a "script kiddie" would see generally from options in zenmap without me having to do long IP and TCP / UDP port scans (as I already know them) as well as the scripts. I just want to run the scripts as above and feed in the IPs and ports.

I find nmaps docs quite poor on explaining this as generally most people are doing the scan for IPs and ports at the same time as the scripts. Hopefully that all makes sense.


In the nmap docs it says:

Script scanning is normally done in combination with a port scan, because scripts may be run or not run depending on the port states found by the scan.

So if a host doesn't have http-port open then http scripts won't run for this particular host. Also, in case the host has another port open (let's say 445) and you don't specify it, then using the -sC option (for default scripts) smb-related scripts won't be executed for this particular host. The above are only valid when script scanning is done in combination with a port scan of course.


Each Nmap script has 2 functions, the "rule" and the "action." The "rule" function is usually very simple and does not perform any network activity on its own. It simply takes as input the information from the port scan and determines whether the "action" function should be run. The most common example of this is simply checking the port number and the service name to ensure that, e.g., ssh-* scripts only run on port 22 or any port where SSH was detected.

The documentation for NSE is in the Nmap Network Scanning book, most of which is free to read online. The relevant section about rules and script selection is here.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.