Optimal flags to specify when using nmap to guess the OS on remote devices?

I'm currently using the following:

nmap --privileged -sS -sU -sY -sZ -O --osscan-guess -F -r

This seems to work ok but it takes quite a while to finish. Is there a more optimal set of flags i can use to balance performance and accuracy?

  • FYI, many of the probe packets on an OS scan are unique to nmap. Snort's community ruleset contains 43 different rules that detect various nmap scans and packets. If your target network is running snort, or another NDIS tool, they will likely detect this scan. Feb 24, 2014 at 22:50

1 Answer 1


Understanding how Nmap does OS fingerprinting will help you considerably. For the quick answer, though, here are the relevant points:

  1. Nmap needs responses from 1 closed and 1 open TCP port to do a fingerprint.
  2. Nmap can also use ICMP and UDP responses to further refine the match.

So you can see that you are wasting valuable time scanning for SCTP ports (-sY and -sZ) which are not used in OS fingerprinting. You wisely limit the port scanning phase to the 100-most-common ports with -F, but you may be able to reduce that even farther if you are not on a heavily-firewalled network.

Here's an example command that ought to be a good balance of speed and accuracy:

nmap -v -sSU -pT:20-25,80,443-445,U:54321-54330 -O $TARGET

EDIT: Nmap uses ICMP responses to probes to closed UDP ports in OS detection, so scanning likely-closed UDP ports will actually be better than what I said previously (-p U:53,111-161). Responses from open UDP ports are not used.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .