Nmap online course

How to Specify Multiple Targets and IP Address Ranges in Nmap

Learn how to scan multiple Nmap targets, CIDR networks, and target-list files with -iL, plus interpret multi-host results and avoid scope mistakes.

Nmap can scan one host, several explicitly named hosts, an entire IP network, or a collection of targets stored in a text file. Choosing the right target format makes scans easier to repeat and helps prevent accidentally scanning systems outside the approved scope.

Only scan networks and systems that you own or are explicitly authorized to assess. Before running a broad scan, verify the addresses, network boundary, and purpose of the assessment.

What a Multi-Target Scan Does

A target is a host, hostname, IP address, network expression, or list entry supplied to Nmap. Nmap evaluates the supplied targets and normally produces a separate result for each host it determines to be reachable.

Scanning several hosts is useful when you need to:

• Check the same service or port on a group of known servers.
• Discover which hosts in an authorized subnet respond to probes.
• Repeat an assessment against an approved inventory of systems.

Target selection and port selection are separate parts of an Nmap command. The target tells Nmap which systems to examine. The -p option tells it which TCP or UDP ports to scan. For example, -p 135 selects TCP port 135 in the examples in this lesson; it does not select a network range.

For background on addresses and ports, see IP addresses, private IP addresses, and TCP and UDP ports.

Ways to Specify Nmap Targets

Supplying Multiple Individual Targets

An IPv4 address is a dotted-decimal address such as 192.168.5.11. A hostname is a DNS name, such as server.example.internal, that can be supplied instead of or alongside an address.

Place multiple IPv4 addresses, hostnames, or a mixture of both after the Nmap options. Separate each target with whitespace, usually spaces:

nmap target1 target2 target3

For example, this command scans TCP port 135 on two explicitly selected private IPv4 addresses:

nmap -p 135 192.168.5.102 192.168.5.11

Here, -p 135 selects one port, while the two space-separated addresses select the hosts. Nmap processes each target independently and groups the output into a report for each discovered host.

Hostnames can be included in the same way:

nmap -p 443 web-01.example.internal web-02.example.internal 192.168.5.20

DNS resolution may map a hostname to an address before or during scanning. Consequently, output can show a resolved hostname together with its IP address, and the displayed address may not be the one you expected if DNS records changed or return multiple addresses.

CIDR Network Notation

CIDR notation represents an IP network using the form address/prefix-length. The number after the slash is the prefix length: it identifies how many leading address bits describe the network and therefore determines the size of the address block.

For IPv4, a /24 network contains 256 addresses. For example, 192.168.5.0/24 represents addresses whose final octet spans 0 through 255:

192.168.5.0/24
192.168.5.1
192.168.5.11
...
192.168.5.255

The CIDR prefix defines the size of the network target, not a TCP or UDP port range. Port selection remains a separate option. This command scans TCP port 135 across an authorized private /24:

nmap -p 135 192.168.5.0/24

Nmap evaluates individual addresses within the specified network. It reports hosts according to its host-discovery behavior and the selected scan: an address may be omitted when Nmap determines that the host is not up, while a reachable host receives its own report. Routing, firewalls, and blocked discovery probes can affect which addresses appear.

Reading Multi-Host Output

Each discovered host receives its own scan section. A host may be identified by a resolved hostname followed by its IP address, or by its IP address alone. Within each report, Nmap lists the selected ports and their states.

A simplified multi-host result might look like this:

Nmap scan report for workstation.example.internal (192.168.5.11)
PORT    STATE  SERVICE
135/tcp open   msrpc

Nmap scan report for 192.168.5.102
PORT    STATE    SERVICE
135/tcp closed  msrpc

Nmap scan report for 192.168.5.120
PORT    STATE     SERVICE
135/tcp filtered  msrpc

Nmap done: 3 IP addresses (3 hosts up) scanned

In the final summary, the IP-address count describes the target addresses considered, while the hosts-up count describes how many hosts Nmap determined to be up. Those numbers can differ when a target list or CIDR block includes addresses that do not respond.

To learn more about interpreting states, see Nmap port states and interpreting scan results.

Loading Targets from a File with -iL

The -iL option tells Nmap to read targets from an input list file. The file can contain target formats that Nmap accepts on the command line, including individual addresses, hostnames, and CIDR ranges.

Entries can be separated by whitespace. Newlines, spaces, and tabs are all suitable separators. A practical file named targets.txt might contain:

192.168.5.11
192.168.5.102
server.example.internal
192.168.6.0/24

Scan the targets in that file for TCP port 135 with:

nmap -p 135 -iL targets.txt

This approach is useful for longer target lists and repeatable scans. An approved inventory can be reviewed, versioned, and reused rather than rebuilt manually each time. Because a file can contain a CIDR range as well as individual targets, inspect its contents carefully before starting the scan.

Target-list Practices

• Use a clear filename and confirm that the command points to the intended file.
• Review every address, hostname, and CIDR expression for authorization and scope.
• Remove unintended network ranges and duplicate entries when maintaining the inventory.
• Check that the user running Nmap can read the file.

Choosing the Right Target Form

Explicit individual targets, a CIDR block, and a target-list file serve different purposes:

• Individual targets: the narrowest and clearest choice when you know exactly which hosts to assess.
• CIDR block: appropriate when the authorization covers an entire defined network and you need to evaluate its addresses.
• Target-list file: useful for a maintained inventory containing many selected systems or multiple approved network expressions.

Verify the intended address scope before launching a broad scan. Pay particular attention to CIDR prefix lengths and to list files that may have been edited since the last assessment.

DNS resolution also affects targeting. A hostname can resolve to an unexpected address or to multiple addresses, so confirm name resolution when the result does not match the inventory. Reachability detection and packet filtering can likewise affect which hosts appear and which port states Nmap reports.

Troubleshooting Multi-Target Scans

Expected hosts do not appear

The hosts may be offline or unreachable, host-discovery probes may be blocked, the CIDR block may not include the intended addresses, or routing and firewall rules may prevent communication. First verify target scope, connectivity, authorization boundaries, and the assumptions behind host discovery before changing scan behavior.

A port is reported as filtered

A firewall or access-control device may be dropping probes or replies. Filtered means Nmap cannot determine whether the port is open or closed; it is not proof that no service exists.

A hostname resolves to an unexpected address

DNS records may have changed, or the name may return multiple addresses. Confirm the DNS result and use the intended IP address as an explicit target when necessary.

The scan covers more hosts than intended

An overly broad CIDR prefix or an unintended network range in the input file is a common cause. Review the prefix length and inspect the complete contents of targets.txt before scanning again.

Nmap cannot read the target list

Check that the filename and path are correct, that the current user has permission to read the file, and that each entry uses a valid Nmap target format. A malformed entry can also prevent the intended list from being processed correctly.

Exam-Relevant Notes

• Targets are positional arguments separated by spaces.
• CIDR uses address/prefix-length; a /24 contains 256 IPv4 addresses.
• -p selects ports; it does not define the target network.
• -iL reads targets from a whitespace-separated file.
• Each discovered host receives a separate report.
• open, closed, and filtered describe port states, not different kinds of IP addresses.
• The final summary counts target addresses considered and hosts determined to be up.

For related Nmap techniques, see specifying port ranges, discovering whether a host is online, and saving Nmap output.