Kali Linux 2018: Assuring Security by Penetration Testing - Fourth Edition

Nmap port specification

In the default configuration, Nmap will only scan randomly the 1,000 most common ports for each protocol. The nmap-services file contains a popularity score for the selection of the top ports.

To change that configuration, Nmap provides several options:

• -p port range: This scans only the defined ports. To scan ports 1 to 1024, the command is -p 1-1024. To scan ports 1 to 65535, the command is -p-.
• -F (fast): This will scan only 100 common ports.
• -r (don't randomize port): This option will set sequential port scanning (from lowest to highest).
• --top-ports <1 or greater>: This option will only scan the N highest-ratio ports found in the nmap-service file.

To scan for ports 22 and 25 using the TCP NULL scan method, ...