What is the best option to use for a default port scan of a server on my test network without setting off the ids using nmap. -f is not a switch i am wanting to use.


You may not want to attempt a "default" scan at all if you attempting to evade IDS detection. A single connection attempt to a closed port could even be enough to trigger an alert; 100 or 1000 such attempts certainly will be detected.

To limit your chances of detection, focus on a small set of ports you are interested in, and specify them with the -p flag. Additionally, you can adjust the aggressiveness of nmap's timing. It may be possible to fly under the radar of the IDS with a slow enough scan. Use -Tn, where n is 1-5; 1 being least aggressive and 5 being most aggressive.

The nmap manual also contains some advice about IDS evasion, such as using fragmentation, decoys, spoofing, and host randomization.

| improve this answer | |

nmap by default scans 1000 top ports. By providing -F option you are telling nmap to scan only top 100 ports. These ports are the most common ports used for services such as ftp, ssh, telnet, etc. If you still want to scan few ports which are most common then you can use option --top-ports <n>. The option will scan top TCP and UDP ports. You can use it as following:

nmap --top-ports 1000 IP_ADDRESS

Source: https://nmap.org/book/man-port-specification.html

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.