VMware ESXi and vSphere Cluster Management

Specify IP Address Ranges and Target Lists in Nmap

Learn how to scan multiple Nmap targets using individual IP addresses, hostnames, CIDR network ranges, and reusable input files.

Why target specification matters

Nmap is a network discovery and security scanning tool that accepts hosts, networks, and target files as scan input. A target is a host, hostname, address range, or network that Nmap scans.

Scanning more than one host is useful when checking a server group, validating a network inventory, looking for a service across a subnet, or repeating an authorized assessment. Targets must be systems and networks that you own or are explicitly authorized to assess.

Nmap options normally appear before the targets. For example, -p 135 selects TCP port 135, while the values after it identify which systems receive that scan.

Multiple individual targets

An IPv4 address is a 32-bit network address normally written as four decimal octets, such as 192.168.5.102. Supply multiple IPv4 addresses as separate, space-separated command-line arguments:

nmap -p 135 192.168.5.102 192.168.5.11

Each space-separated target is treated as an independent scan target. Nmap applies the selected port option to both addresses and produces a separate host report for each reachable target.

Hostnames may also be supplied when name resolution is available. A hostname is a human-readable system name that can be resolved to an IP address.

nmap -p 135 server-a.example.internal 192.168.5.102

In this example, the hostname and the IPv4 address are separate targets. If a hostname cannot be resolved, it may not scan as expected, so verify local DNS or other name-resolution services when using names.

Nmap target specification methods

Method: Multiple explicit IP addresses
Syntax: nmap [options] IP1 IP2 IP3
Best use case: A small, clearly approved group of hosts
Example: nmap -p 135 192.168.5.11 192.168.5.102

Method: Multiple hostnames
Syntax: nmap [options] host1 host2
Best use case: Systems maintained in a working DNS or host inventory
Example: nmap -p 135 server-a.example.internal server-b.example.internal

Method: CIDR network range
Syntax: nmap [options] network/prefix
Best use case: An authorized contiguous subnet
Example: nmap -p 135 192.168.5.0/24

Method: Input file using -iL
Syntax: nmap [options] -iL filename
Best use case: Repeatable scans and large or changing inventories
Example: nmap -p 135 -iL targets.txt

CIDR notation for IPv4 ranges

CIDR notation describes a network as an address followed by a slash and a prefix length, such as 192.168.5.0/24. The prefix length is the number of leading bits that identify the network portion of the address. The remaining bits identify addresses within that network.

A prefix of /24 leaves 8 host bits. There are 28, or 256, possible IPv4 addresses in the block. Therefore, 192.168.5.0/24 covers addresses from 192.168.5.0 through 192.168.5.255.

A CIDR target represents the entire address block, not only the conventional usable-host range. That means the range can include the network address, broadcast address, infrastructure devices, inactive addresses, and hosts that do not respond.

nmap -p 135 192.168.5.0/24

This command applies the TCP port 135 scan to every address in the specified /24 block. Port 135 is commonly associated with Microsoft RPC.

Prefix size and address count

CIDR prefix: /32
Total IPv4 addresses: 1
Example scope: 192.168.5.102/32
Operational consideration: A single address; useful when an explicit host scope is required.

CIDR prefix: /30
Total IPv4 addresses: 4
Example scope: 192.168.5.0/30
Operational consideration: A small block, often useful for controlled testing; confirm the exact approved addresses.

CIDR prefix: /24
Total IPv4 addresses: 256
Example scope: 192.168.5.0/24
Operational consideration: A common subnet-sized scan, but it can include many inactive or unrelated addresses.

CIDR prefix: /16
Total IPv4 addresses: 65,536
Example scope: 192.168.0.0/16
Operational consideration: A large scan that can take considerably longer and generate much more traffic.

Larger networks increase scan duration and traffic volume. They also increase the chance of unintended scope. Confirm the network address and prefix length before using a broad CIDR target.

Reading targets from a file with -iL

The -iL option tells Nmap to read targets from a specified input list file. The file can contain target forms accepted on the Nmap command line, including IPv4 addresses, hostnames, and CIDR networks.

192.168.5.11
192.168.5.102
192.168.6.0/24
server.example.internal

Save the entries as targets.txt, then run:

nmap -p 135 -iL targets.txt

Entries can be separated by whitespace, including lines, spaces, or tabs. One target per line is usually easiest for people to review, but Nmap can read whitespace-separated entries in other layouts as well.

Target files separate scan scope from command options. This makes scans easier to repeat, supports large inventories, and allows an approved target list to be reviewed before the command runs.

Reviewing a target file

  • Remove duplicate entries when they add no value.
  • Remove stale addresses and names that no longer belong to the approved inventory.
  • Check every CIDR range for correct network boundaries and prefix length.
  • Confirm that no entry is outside the authorized scope.
  • Check hostnames for spelling and expected name resolution.

Combining target selection with port selection

The target expression determines which hosts Nmap scans. The -p option determines which ports Nmap tests. These are separate decisions.

nmap -p 135 192.168.5.102 192.168.5.11

Here, Nmap tests TCP port 135 on both individual targets. The same port selection can be applied to a CIDR range:

nmap -p 135 192.168.5.0/24

It can also be applied to every target in a file:

nmap -p 135 -iL targets.txt

Understanding basic results

Nmap generally presents a host report for each target it processes. A common availability message is Host is up, which means Nmap received a response indicating that the host is reachable according to the discovery and scan methods used.

Host reachability and port availability are separate results. A host can be reachable even when the selected port is closed or filtered.

State: open
Meaning: An application is accepting connections or packets on the port.
What it indicates about the host or network: The host responded in a way that indicates a service is listening on the tested port.

State: closed
Meaning: The host is reachable, but no service is listening on the tested port.
What it indicates about the host or network: The address is responsive even though the selected service port is unavailable.

State: filtered
Meaning: Packet filtering or another network condition prevents Nmap from determining whether the port is open.
What it indicates about the host or network: A firewall, access-control list, or filtering device may be blocking or dropping probe traffic.

A range scan may include infrastructure devices, inactive addresses, and hosts that do not respond. Different hosts in the same subnet can therefore produce different results.

Scope and operational safety

  1. Confirm the approved target scope before expanding from individual addresses to a subnet.
  2. Start with a small authorized target set and verify that the command and output match expectations.
  3. Check the CIDR prefix carefully; a shorter prefix such as /16 includes far more addresses than /24.
  4. Review target-list files for duplicate, stale, malformed, or out-of-scope entries.
  5. Plan scan timing and traffic volume according to the number of addresses and the network environment.

Troubleshooting target and result issues

The scan includes more addresses than intended

The CIDR prefix may be broader than the approved network scope. Verify the network address and prefix length, then test the command against a small approved range first.

A host is up, but the scanned port is closed

The target responds on the network, but no service is listening on the selected port. Treat host reachability and port availability as separate results, and confirm that port 135 or another selected port is the intended service check.

A port is reported as filtered

A firewall, ACL, or other filtering device may be blocking or dropping probe traffic. Do not interpret filtered as open; review authorized network controls and scan scope.

Targets from an input file do not scan as expected

The file may contain malformed entries, unresolvable hostnames, accidental content, or unintended whitespace. Ensure every entry is a valid Nmap target expression and inspect the complete file for out-of-scope targets.

The scan takes much longer after changing to a network target

The CIDR block contains substantially more addresses, including nonresponsive hosts. Reduce the range to the approved minimum and schedule the scan according to the number of addresses and expected response times.

Key points

  • Place Nmap targets after scan options.
  • Use separate space-separated arguments for multiple IP addresses or hostnames.
  • Use CIDR notation to represent a contiguous IPv4 address block.
  • A /24 contains 256 addresses, from .0 through .255.
  • Use -iL to read reusable target lists containing IP addresses, hostnames, and CIDR networks.
  • Use -p to choose the port or ports tested on every selected target.
  • Review scope carefully before scanning a larger network.

For a concise reference to this topic, see Specify IP Address Range.