Nmap Advanced Guide 2026: Stealth Scans, NSE Scripts & Firewall Evasion

External Perimeter Audit

Enumerate an internet-facing range through NAT and cloud firewalls, distinguishing filtered from closed to map the real attack surface.

Segmentation Testing

Prove whether a VLAN or micro-segmentation policy actually blocks lateral traffic using ACK and Window scans from inside each zone.

Red Team Recon

Fingerprint services and pull low-hanging vulnerabilities with NSE while keeping timing and packet signatures under IDS thresholds.

Purple Team Detection Tuning

Generate known scan patterns on demand to validate that firewall, IDS, and SIEM rules detect them — and to measure your alert latency.

Before anything else, confirm which Nmap you are actually running and that raw-socket features are compiled in. The --version output lists the libpcap/Npcap version and enabled features.

Evasion techniques are meaningless without something to evade. The fastest legal lab is two VMs plus a Linux host acting as a filtering router with iptables, so you can watch how each scan type reacts to different rules.

These three send packets with no SYN flag: Null sets no flags at all, FIN sets only FIN, and Xmas lights up FIN, PSH and URG ("like a Christmas tree"). Per RFC 793, a compliant stack replies with RST to a closed port and stays silent on an open one — so no response is read as open|filtered. The catch: Windows, Cisco IOS and many modern stacks reply RST to everything, making every port look closed.

The ACK scan (-sA) never tells you whether a port is open. It sends a bare ACK packet: an unfiltered port (open or closed) replies RST and is labelled unfiltered; a stateful firewall that drops the packet leaves it filtered. That makes the ACK scan the single best tool for discovering whether a firewall is stateful and which ports it guards.

The Window scan (-sW) is an ACK scan that inspects the TCP window field of returned RST packets — on a handful of stacks a positive window means open and zero means closed. The Maimon scan (-sM) sends a FIN/ACK; RFC-793-compliant BSD-derived systems drop the packet for open ports. Both are niche, but when they work they succeed exactly where SYN scans are being filtered.

When the built-in scan types are not enough, --scanflags lets you set any combination of TCP flags (URG, ACK, PSH, RST, SYN, FIN) by name or as a numeric value. This is how you test whether an IDS signature keys on a specific flag pattern, or craft a probe an inline device has never seen.

The idle scan is the stealthiest technique Nmap offers: your real IP address never sends a single packet to the target. Instead you bounce the scan off a "zombie" — a third host with a predictable, incrementing IP ID (IPID) sequence that is otherwise idle. By watching how the zombie's IPID jumps, Nmap infers which target ports are open. To the target, the scan appears to come entirely from the zombie.

The template sets sensible defaults for parallelism, timeouts and probe delay all at once. Start with -T4 on a healthy internal network, drop to -T1 or -T0 when you are deliberately trying to stay under a detection threshold.

The templates are shortcuts; for real control override them with explicit rate and delay flags. --min-rate/--max-rate bound packets per second, and --scan-delay forces a wait between probes to a single host — the most reliable way to defeat "N connections in M seconds" IDS logic.

On lossy links (VPNs, satellite, throttled WAN) accuracy comes from tuning retries and timeouts rather than raw speed. Reducing --max-retries speeds up huge sweeps; raising it recovers ports on flaky paths. --host-timeout stops one dead host from stalling a whole range.

The most valuable output Nmap gives you is not "open" — it is the difference between closed (a reachable host that actively refused the port) and filtered (something dropped the packet in transit). Combine a SYN scan with an ACK scan and use --reason to see exactly which packet drove each verdict.

When results do not make sense, drop to --packet-trace to watch every probe and reply on the wire. ICMP "administratively prohibited" (type 3, code 13) messages are a firewall's fingerprint — they tell you a device, not the host, is refusing you.

Several NSE scripts help identify what is filtering you — from WAFs in front of web apps to load balancers that spread you across back-ends. Knowing the device type tells you which evasion techniques are even worth trying.

Fragmentation splits the TCP header over several small IP fragments so that a packet filter inspecting only the first fragment never sees the flags. -f uses 8-byte data fragments, -ff uses 16, and --mtu sets an explicit size (always a multiple of 8). A firewall that reassembles fragments before inspecting — which any modern one does — defeats this entirely.

Decoys make the scan appear to originate from several IP addresses at once. The target's logs and IDS show port scans from every decoy plus your real IP mixed in, so an analyst cannot easily tell which source is real. Use ME to control where your own address sits in the list, or RND for random decoys.

Some firewalls trust traffic based on where it appears to come from. -S forges the source IP (you must specify the interface with -e and you will not see replies unless you can sniff the spoofed address's network). -g/--source-port sends from a port firewalls often whitelist, such as DNS 53 or HTTP 80.

These smaller tricks defeat specific, brittle signatures. --data-length appends random bytes so packets no longer match a fixed-size signature; --spoof-mac forges the Ethernet source (LAN-only, and accepts a vendor name); --badsum sends deliberately invalid checksums — a compliant stack silently drops them, so any reply proves an IDS/IPS or proxy is answering on the host's behalf.

--proxies routes TCP connect scans and some NSE traffic through a chain of one or more HTTP or SOCKS4 proxies, so the connection reaches the target from the last proxy's address. It only works with connection-based scans (-sT), not raw-packet scans, but it is invaluable when pivoting through a compromised host or a jump box.

You can run scripts by name, by wildcard, by category, or with a boolean expression combining them. -sC is shorthand for --script default. Wildcards make it easy to run every script for a protocol, and expressions let you scope to safe scripts only.

Many scripts take arguments — wordlists for brute-forcing, credentials, HTTP paths, timeouts. Pass them with --script-args, or load a whole file of them with --script-args-file. Read a script's own documentation with --script-help before you run it.

After upgrading Nmap or dropping a new .nse file into the scripts directory, rebuild the script database so --script can find it by name and category. The scripts live in a well-known path you can inspect directly.

NSE scripts are Lua. A minimal script declares metadata (description, categories), a portrule that decides when it runs, and an action that does the work. Save this as /usr/share/nmap/scripts/cyberhawk-banner.nse, run --script-updatedb, and call it by name.

Enumeration scripts pull the detail that a plain -sV misses: SMB shares and OS, HTTP directories and titles, DNS records, SSL certificate data. This is the bread and butter of the recon phase.

The auth and brute categories test for default and weak credentials across dozens of protocols. These are intrusive and will lock accounts if you are careless — throttle them and get written authorisation first.

The vuln category checks services for specific known flaws and reports CVE identifiers. For broader coverage, community scripts like vulners (which queries a CVE database using the versions Nmap detected) extend this considerably — install them into the scripts directory and update the DB.

Nmap writes normal (-oN), XML (-oX), and grepable (-oG) output. -oA basename writes all three at once — the correct default for any real engagement, so you never lose data to a closed terminal.

Grepable output is trivial to slice with shell tools; XML is the format every downstream tool understands. Convert XML to a readable HTML report with the bundled XSL stylesheet, or feed the grepable file straight into a one-liner to extract open ports.

Long scans die; --resume picks up where a saved run left off. ndiff compares two XML scans so you can alert on new ports appearing over time — an excellent lightweight attack-surface monitor. And XML imports cleanly into Metasploit for the next phase.

The reliable signal is fan-out: one source IP hitting an abnormal number of distinct destination ports (or hosts) in a short window. Below are paired queries over firewall/network logs — the KQL runs in Microsoft Sentinel; the SPL is the Splunk equivalent.

Null/FIN/Xmas scans are trivial to spot because their flag combinations never occur in legitimate traffic — a TCP packet with no flags, or FIN without an established session, is inherently anomalous. Decoy scans still generate the fan-out pattern above; the decoys just add noise you should correlate, not filter out.

You cannot stop scanning outright, but you can raise its cost and guarantee detection. The goal is a stateful, default-deny firewall that reassembles fragments, plus IDS scan-tracking and rate limiting so any sweep is both blocked and alerted.

• 1Default-deny + stateful: drop unsolicited packets so scans return filtered, giving attackers less state information.
• 2Reassemble fragments: ensure the firewall inspects reassembled packets, neutralising -f/--mtu.
• 3Enable IDS scan detection: Suricata/Snort and Zeek all ship scan-tracking; turn it on and forward alerts to the SIEM.
• 4Rate-limit new connections: iptables hashlimit or equivalent slows sweeps and creates a clean log signal.
• 5Anti-spoofing (BCP 38): uRPF/ingress filtering blocks the forged sources used by -S and decoys.