Nmap online course

Specify Port Ranges in Nmap

Learn how to scan individual Nmap ports, inclusive ranges, excluded ports, and reduced fast-scan lists while interpreting open, closed, and filtered results.

Nmap is a network discovery and security-auditing tool that can probe hosts and their network services. This lesson explains how to control which ports Nmap tests, from one known port to a contiguous range or a reduced predefined list.

How Ports Identify Network Services

A port is a numbered endpoint used with a transport protocol to identify a network service. For example, an SSH server commonly accepts TCP connections on port 22, while DNS is commonly associated with port 53. A port number alone does not prove which application is actually running there.

The valid port-number space is 1 through 65535. An operator may target one known service port, a narrow range while troubleshooting, or higher-numbered ports where an application is known or suspected to listen.

These examples use TCP, which is the usual protocol scanned when no alternate protocol selection is specified. UDP scanning is a separate operation and may require different commands and interpretation; see UDP Scan.

Default Nmap Port Selection

A standard Nmap scan does not test every valid TCP port by default. It focuses on a predefined collection of commonly used ports. This default provides useful initial visibility without the time and traffic cost of probing all 65,535 ports.

The default selection is therefore different from the full port-number space. A service listening on an uncommon or high-numbered port may not appear in a normal scan. When the service port is known, or when coverage of a particular range matters, use explicit port selection with -p.

Select Ports with -p

The -p option tells Nmap exactly which ports to test:

nmap -p PORT TARGET

Replace PORT with a port number or an inclusive hyphenated range, and replace TARGET with an authorized hostname or IP address. Explicit selection changes the ports tested; it does not cause Nmap to discover every port automatically.

Scan One Port

To check whether TCP port 22 is reachable on an authorized host:

nmap -p 22 192.168.5.102

A typical result may look like this:

PORT   STATE    SERVICE
22/tcp filtered ssh

Read the output as follows:

  • PORT identifies the port number and protocol, such as 22/tcp.
  • STATE describes what Nmap could determine about the port.
  • SERVICE is a service label associated with the port, such as ssh.

Filtered means that a firewall, access-control list, packet filter, or missing response prevented Nmap from determining whether the port is open. It is not proof that no SSH service exists. The label ssh is based on the conventional association for TCP port 22 unless additional service or version detection is performed.

Scan a Contiguous Port Range

Write an inclusive port range with a hyphen. The following command tests ports 50 through 60, including both endpoints:

nmap -p 50-60 192.168.5.102

One scan can contain different states:

PORT   STATE  SERVICE
50/tcp closed unknown
53/tcp open   domain
60/tcp closed unknown

An open port has a responsive service endpoint. A closed port is reachable, but no application is listening on it. The domain label for port 53 indicates a conventional DNS association; it is not definitive identification of the application. A range can also contain filtered ports, and not every port necessarily has a useful service label.

Exclude Ports from a Scan

Use --exclude-ports to omit specified ports or ranges from the scan's applicable selection:

nmap --exclude-ports 1-100 192.168.5.102

This example excludes ports 1 through 100. The results therefore do not represent those excluded ports. The option avoids a defined port set while retaining the rest of the selection Nmap would otherwise apply; it does not automatically mean that every port from 101 through 65535 is scanned.

Document exclusions in assessment notes. An exclusion can explain why an expected service is absent from the report and can materially affect coverage.

Fast Scan Mode

The -F option performs a fast scan using a smaller predefined list of commonly used ports than the normal default selection:

nmap -F 192.168.5.102

Fast mode is useful for quick initial visibility, but it can miss services running outside its reduced list. The distinction is important:

  • -F chooses a predefined, smaller list for speed.
  • -p gives the operator explicit control over the ports or ranges tested.

If a service is known to use port 8443, for example, target that port explicitly rather than assuming it is included in a fast scan.

Nmap Port-Selection Options

Option | Purpose | Example | Coverage Consideration

-p 22 | Select one port | nmap -p 22 192.168.5.102 | Tests only the explicitly selected port.

-p 50-60 | Select an inclusive contiguous range | nmap -p 50-60 192.168.5.102 | Tests ports 50 through 60, including both endpoints.

--exclude-ports 1-100 | Omit a port range | nmap --exclude-ports 1-100 192.168.5.102 | Removes the range from the otherwise applicable scan selection.

-F | Use a reduced predefined common-port list | nmap -F 192.168.5.102 | Faster, but services outside the reduced list can be missed.

Reading Common Port States

State | Meaning | Typical Interpretation | Next Step

open | An application is accepting connections or responding as available. | A service endpoint is reachable on that port. | Confirm the expected service and continue authorized identification if required.

closed | The host is reachable, but no service is listening on the port. | Network reachability exists, but the port has no listening application at the time of the scan. | Check the service configuration if the port was expected to be open.

filtered | Filtering or absent responses prevent a definitive result. | A firewall, ACL, or packet-filtering device may be blocking or dropping probes. | Review the approved scan path and firewall policy; treat the result as inconclusive.

Service labels are generally based on known port associations. A label such as domain or ssh is a useful clue, not final application identification. For authorized follow-up testing, see Determine Service Version.

Troubleshooting Port-Selection Problems

The Expected Port Is Missing

  • The port may not have been selected with -p.
  • It may fall outside the normal default list or the reduced -F list.
  • It may be inside a range specified with --exclude-ports.

Run an authorized targeted scan using the exact port, review exclusions, and use a suitably broader explicit range when investigating a group of ports.

The Port Is Filtered

A host firewall, network firewall, ACL, or other filter may be dropping probes. Confirm the target address and routing from the approved testing location, and review applicable firewall policy. Do not interpret filtered as proof that the service is absent.

A Fast Scan Misses a Known Service

The service may use a port outside the reduced fast-scan list. Scan its known port explicitly with -p, or use an appropriate explicit range for the approved investigation.

The Service Label Seems Wrong

The displayed name may reflect a conventional port assignment rather than the application actually running. An application can use a nonstandard port, or a different service can occupy a familiar port. Treat the label as a hint and use authorized service/version identification procedures when confirmation is needed.

Safe and Documented Use

  1. Confirm ownership or written authorization for every target.
  2. Record the target, selected ports, exclusions, scan date, and testing location.
  3. Use a narrow -p selection for focused troubleshooting when possible.
  4. Use broader ranges only when the assessment scope requires them.
  5. Expect high-numbered or broad scans to take longer and potentially trigger monitoring alerts.

For related fundamentals, review Port States, Interpret Scan Results, and Timing Options. To continue with Nmap basics, see Nmap.