Take the 2-minute tour ×

This is an extremely basic question but also one I can't really seem to find an answer for, despite looking through the nmap documentation (man, online, and google).

My question is, what is the difference between doing nmap <target> and nmap -sS <target>, for example? I know that -sS is a TCP SYN scan, but I guess what I am not sure of is how/why this differs from just scanning ports using nmap <target>?

share|improve this question

3 Answers 3

There is no difference. Per the man page -sS is the default scan type (usually.. see the man page for exceptions). I've confirmed this with a tcpdump.

share|improve this answer

-sS will force nmap to perform a SYN scan. Don't specifying a scan type will let nmap choose the best one.

If you're running nmap as a privileged user (typically: root), SYN scan will be selected by default. In this case there is no difference between both command lines (with or without -sS).

If you're running nmap as a simple user, SYN scan won't be available, in this case -sS will likely fail and the simple command nmap <target> command line will perform a TCP connect scan (equivalent of -sT).

If your system allows it you can force nmap to act as if it was (or not) privileged using --privileged or --unprivileged.

share|improve this answer
I don't remember, but won't nmap do ICMP echo when hosts are on different subnet and ARP requests when they are if no options are specified? Or is it an "on unless specified otherwise" option? –  Hubert Kario Jul 18 '11 at 22:05

man nmap

 -sS (TCP SYN scan)
              SYN scan is the default and most popular scan option ...
share|improve this answer
In response to your updated question: no difference. –  dmourati Jun 10 '11 at 15:49

Your Answer


