Port Scanning Techniques

Nerd Cafe | نرد کا

SYN Scan (Half-open) — Most important

$ nmap -sS scanme.nmap.org

Starting Nmap 7.94 ( https://nmap.org ) at 2026-02-10 22:07 Iran Standard Time
Nmap scan report for scanme.nmap.org (188.40.181.50)
Host is up (0.15s latency).
Other addresses for scanme.nmap.org (not scanned): 178.63.240.97 50.7.85.221 88.99.249.74 69.197.146.179 50.7.87.82 69.197.138.82 50.7.85.222 50.7.87.86 50.7.85.219 69.197.146.178 50.7.85.220 188.40.181.51 50.7.87.84 50.7.87.83 50.7.85.218 69.197.138.83 204.12.192.218 188.40.181.49 178.63.240.96 188.40.181.48 50.7.87.85 204.12.192.219
rDNS record for 188.40.181.50: static.50.181.40.188.clients.your-server.de
Not shown: 994 closed tcp ports (reset)
PORT     STATE SERVICE
80/tcp   open  http
443/tcp  open  https
1119/tcp open  bnetgame
5810/tcp open  unknown
8888/tcp open  sun-answerbook
9100/tcp open  jetdirect

Nmap done: 1 IP address (1 host up) scanned in 23.34 seconds

Why it’s powerful

• Fast

• Stealthier than full connect

• Doesn’t complete TCP handshake

TCP Connect Scan

$ nmap -sT scanme.nmap.org

Starting Nmap 7.94 ( https://nmap.org ) at 2026-02-10 22:10 Iran Standard Time
Nmap scan report for scanme.nmap.org (188.40.181.50)
Host is up (0.13s latency).
Other addresses for scanme.nmap.org (not scanned): 178.63.240.97 50.7.85.221 88.99.249.74 69.197.146.179 50.7.87.82 69.197.138.82 50.7.85.222 50.7.87.86 50.7.85.219 69.197.146.178 50.7.85.220 188.40.181.51 50.7.87.84 50.7.87.83 50.7.85.218 69.197.138.83 204.12.192.218 188.40.181.49 178.63.240.96 188.40.181.48 50.7.87.85 204.12.192.219
rDNS record for 188.40.181.50: static.50.181.40.188.clients.your-server.de
Not shown: 994 filtered tcp ports (no-response)
PORT     STATE SERVICE
80/tcp   open  http
443/tcp  open  https
1119/tcp open  bnetgame
5810/tcp open  unknown
8888/tcp open  sun-answerbook
9100/tcp open  jetdirect

Nmap done: 1 IP address (1 host up) scanned in 35.23 seconds

When used

• When not running as root

• Less stealthy

UDP Scan

$ nmap -sU scanme.nmap.org

Notes

• Slow

• UDP has no handshake

• Often returns open|filtered

Common technique summary

Scan	Flag
SYN	-sS
TCP connect	-sT
UDP	-sU
ACK	-sA
FIN	-sF

💖 Support Our Work

If you find this post helpful and would like to support my work, you can send a donation via TRC-20 (USDT). Your contributions help us keep creating and sharing more valuable content.

TRC-20 Address: TAAVVf9ZxUpbyvTa6Gd5SGPmctBdy4PQwf

Thank you for your generosity! 🙏

Keywords

Nmap, Red Team, Blue Team, Reconnaissance, Port Scanning, Host Discovery, Service Enumeration, OS Fingerprinting, NSE Scripts, SYN Scan, IDS Detection, SIEM Correlation, Network Telemetry, Firewall Evasion, Timing Templates, Attack Surface, Defensive Monitoring, Incident Response, Purple Teaming, MITRE ATT&CK, nerd cafe , نرد کافه

Channel Overview

🌐 Website: www.nerd-cafe.ir

📺 YouTube: @nerd-cafe

🎥 Aparat: nerd_cafe

📌 Pinterest: nerd_cafe

📱 Telegram: @nerd_cafe

📝 Blog: Nerd Café on Virgool

💻 GitHub: nerd-cafe