> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/reconnaissance/active-reconnaissance-approach/nmap/port-specification-and-scan-order.md).

# Port Specification and Scan Order

By default, **Nmap** scans the **1,000 most commonly used ports** across various services and applications. However, **port specification** and **scan order** allow users to customize scans based on specific needs, improving efficiency by excluding unnecessary ports and prioritizing frequently used ones. **Nmap** provides several options to control which ports are scanned and in what order.

***

### **Port Specification Options**

#### **1. Specify Specific Ports (`-p <port ranges>`)**

The `-p` option enables scanning of **specific ports**, either individually or in ranges. You can specify:

* A **single port**
* A **comma-separated list** of ports
* A **range of ports**
* A **combination** of these

**Examples:**

Scan only port **22**:

```bash
nmap -v -p 22 192.168.1.1
```

Scan ports **80 and 443**:

```bash
nmap -v -p 80,443 192.168.1.1
```

Scan **all 65,536 ports**:

```bash
nmap -v -p 0-65535 192.168.1.1
```

Shortcut for scanning **all ports**:

```bash
nmap -v -p- example.com
```

Scan **specific TCP and UDP ports**:

```bash
nmap -v -p T:80,443,U:53,111 192.168.1.1
```

***

#### **2. Exclude Specific Ports (`--exclude-ports <port ranges>`)**

The `--exclude-ports` option allows **excluding** specific ports from the scan. This is useful when scanning large ranges but avoiding unnecessary or known closed ports.

Exclude **port 80** from scan:

```bash
nmap -v --exclude-ports 80 example.com
```

Exclude ports **100 to 400**:

```bash
nmap -v --exclude-ports 100-400 192.168.1.1/24
```

Exclude ports **1-1000 and 3389-3390**:

```bash
nmap --exclude-ports 1-1000,3389-3390
```

***

### **Scan Order Optimization**

#### **1. Fast Mode (`-F`)**

The `-F` option enables **fast scanning**, which reduces the number of scanned ports. Instead of **1,000 default ports**, it scans **only the 100 most common ports**.

Fast scan on a target:

```bash
nmap -F 192.168.1.1
```

Verbose fast scan:

```bash
nmap -v -F 192.168.1.1
```

***

#### **2. Sequential-Port Scanning (`-r`)**

By default, Nmap **randomizes** the port scan order to avoid detection by intrusion detection systems (IDS). The `-r` option **disables randomization** and scans ports **in sequential order**.

Scan **all ports sequentially** for multiple IPs:

```bash
nmap -r -p- 192.168.1.1-10
```

Perform a **sequential fast scan**:

```bash
nmap -v -r -F example.com
```

***

#### **3. Scan Only the Most Common Ports (`--top-ports <number>`)**

The `--top-ports` option scans the **N most commonly used ports**, based on real-world data collected by Nmap.

Scan the **top 100 most common ports** in a subnet:

```bash
nmap --top-ports 100 192.168.1.1/24
```

Scan **top 100 ports** on a domain:

```bash
nmap --top-ports 100 example.com
```