VMware ESXi and vSphere Cluster Management

Specify Port Ranges for Nmap Scans

Learn how to scan individual Nmap ports, inclusive ranges, excluded ports, and reduced fast-scan lists while interpreting open, closed, and filtered results.

Why Port Selection Matters

A port is a numbered logical endpoint that transport protocols use to direct traffic to a service. TCP and UDP each use port numbers from 1 through 65535. For example, SSH commonly uses TCP port 22, while DNS commonly uses port 53 and can use both TCP and UDP.

Nmap is a network exploration and security auditing tool that can probe hosts and ports. When you run Nmap without an explicit port option, its default port scan checks a commonly used subset of ports rather than every port from 1 through 65535.

Explicit port selection is useful when you need to:

• Verify a known service, such as SSH on port 22.
• Check an uncommon high-numbered port where an application is expected to listen.
• Inspect a narrow contiguous range during troubleshooting or an authorized assessment.
• Reduce scan duration and network traffic by avoiding ports outside the approved scope.

Broader coverage can reveal more services, but it generally takes longer and may create more traffic. Narrow scans are faster and easier to control, but they can miss services on ports that were not selected.

The Nmap -p Option

Use -p to explicitly choose the ports Nmap scans. The general form is:

nmap -p <port-specification> <target>

The target can be an authorized IP address, hostname, or another valid Nmap target expression. Once -p is supplied, the explicitly selected ports replace Nmap's normal default selected-port set.

Port specifications can contain a single port, a contiguous range, or a list of selections. This lesson focuses on single ports and contiguous ranges. A command such as nmap -p 53 -sU target selects UDP port 53; without a UDP scan option, the ordinary port scan behavior is TCP-focused.

Scanning One Port

Place one port number after -p to scan only that port:

nmap -p 22 192.168.5.102

This command checks TCP port 22 on the authorized target. A typical result includes a row similar to:

PORT   STATE    SERVICE
22/tcp open     ssh

The columns have these meanings:

• Port/protocol: 22/tcp identifies port 22 and TCP.
• State: open, closed, or filtered describes what Nmap could determine.
• Service: ssh is Nmap's port-to-service association or detection result. It is not, by itself, proof that the application actually running is SSH.

Scanning a Contiguous Port Range

A port range is an inclusive sequence of port numbers written with a hyphen. Use the pattern -p <start>-<end>:

nmap -p 50-60 192.168.5.102

This scans every TCP port from 50 through 60. Both boundary ports are included: 50, 51, 52, and so on through 60. The range contains 11 ports, not 10.

A range is useful when you know an application is somewhere within a small block or when you need to check nearby ports without scanning a much larger set.

Excluding Ports

--exclude-ports omits specified ports from an otherwise applicable scan selection. For example:

nmap --exclude-ports 1-100 192.168.5.102

This excludes ports 1 through 100, inclusive, from the scan's applicable port set. Exclusions can help when a range is out of scope, potentially disruptive, or already assessed.

The two options have different roles:

• -p defines which ports to select explicitly.
• --exclude-ports removes ports from the applicable selection.

For example, nmap -p 1-1000 --exclude-ports 1-100 192.168.5.102 explicitly selects 1 through 1000 and then omits 1 through 100, leaving ports 101 through 1000 to be scanned.

Fast Scan Mode

The -F option requests a fast scan using a smaller list of commonly used ports than Nmap's standard default list:

nmap -F 192.168.5.102

Fast mode prioritizes speed over broad coverage. It can be useful for a quick initial review, but it may miss a service listening on a port outside its reduced list.

Use -F when a reduced common-port check is appropriate. Use explicit -p selections when you know the service port or need predictable coverage of a particular port or range.

Nmap Port Selection Options

Reading Basic Scan Results

Nmap reports a state for each scanned port. The state describes what Nmap could determine from its probes; it does not always identify the exact application.

The service label is an Nmap port-to-service association or detection result. A label such as ssh is a useful indication, but the label alone does not prove which application is running.

Port Selection Approaches Compared

Practical Examples

Verify SSH on a Known Host

nmap -p 22 192.168.5.102

The result reports the state of TCP port 22 and an associated SSH service label. An open result suggests that something is accepting probes; a filtered result means filtering prevents a definitive conclusion.

Check Ports 50 Through 60

nmap -p 50-60 192.168.5.102

Nmap checks every port in the inclusive range. This includes port 53 only if the selected range contains it; the example range does not, so a DNS check would require a selection such as -p 53 or a range that includes 53.

Omit Ports 1 Through 100

nmap --exclude-ports 1-100 192.168.5.102

Ports 1 through 100 are excluded from the applicable scan selection. Use this only when the resulting scope is authorized and appropriate for the assessment.

Run a Quick Common-Port Review

nmap -F 192.168.5.102

This uses Nmap's reduced fast-scan list. Treat it as a quick, less comprehensive check rather than evidence that all services on the host have been found.

Troubleshooting Port Selection

A Desired Service Port Does Not Appear

The port may not be included in Nmap's default commonly used port list. Run an authorized targeted scan with -p and the specific port or a narrow range containing it.

A Targeted Port Is Filtered

A firewall, access-control device, or packet-filtering rule may be suppressing or blocking probe responses. Confirm authorization, then review relevant firewall rules, routing, and host exposure rather than assuming the service is available.

Fast Scan Misses a Known Service

The service may listen on a port outside the reduced fast-scan list. Use -p for the known port or select a suitable explicit range.

Many Ports Are Closed but the Host Is Up

This usually means the host is reachable but no service is listening on those scanned ports. Check the intended port and, on systems you own, verify the local service configuration. A closed port is not a host-reachability failure.

The Scan Takes Longer Than Expected

A large selected port set, filtered ports, network latency, and retransmissions can increase scan time. Narrow the authorized range, target the known service port, or use -F when a reduced initial check is suitable.

Exam-Relevant Notes

• -p explicitly specifies the ports to scan and replaces the normal default selected-port set.
• A notation such as 50-60 is inclusive, so both 50 and 60 are scanned.
• --exclude-ports removes ports from the applicable scan selection; it is not the same as explicitly selecting ports with -p.
• -F uses a reduced common-port list, so it is faster but less comprehensive.
• Open means a service appears to accept probes, closed means the host is reachable with no listener, and filtered means filtering prevents a definitive result.
• Always validate authorization and scope before scanning.