9.1.2 TCP Scanning
← Reference index · Previous: Path and discovery · Next: Service identification | Strategy map | Study methods: Discover attack surfaces
Purpose: Get quick leads, complete TCP coverage, and adapt scan type, discovery handling, timing and output to the access path.
9.1.2.1 Get initial TCP results
sudo nmap -sS -n -oA scans/tcp-initial TARGET
Coverage: 1,000 common TCP ports. Review
scans/tcp-initial.nmapin a text editor.
9.1.2.1.1 Variants — host list, connect scan or selected ports
9.1.2.1.2 Find common TCP listeners for an initial service map Initial view: 1,000 common ports
Assigned host list, SYN scan:
sudo nmap -sS -n -iL targets.txt -oA scans/tcp-initial-list
One host, connect scan without raw-packet privileges:
nmap -sT -n -oA scans/tcp-connect TARGET
Default coverage is the common-port selection, not ports 1-1000.
9.1.2.1.3 Selected ports or a range
One host: replace PORTS with, for example, 25,43 or 1-1024.
sudo nmap -sS -n -p PORTS -oA scans/tcp-selected TARGET
Find relevant services across assigned hosts:
sudo nmap -sS -n -p PORTS -iL targets.txt -oA scans/tcp-service-sweep
A focused service sweep is not a full port map.
9.1.2.2 Discover listeners across the full TCP port range Complete TCP coverage
sudo nmap -sS -n -p- -oA scans/tcp-all TARGET
Coverage: TCP 1-65535. Investigate useful initial results while this runs.
9.1.2.2.1 Variants — connect scan, blocked discovery, timing and progress
9.1.2.2.2 Discover listeners across the full TCP port range All TCP ports: 1-65535
Connect scan:
nmap -sT -n -p- -oA scans/tcp-all-connect TARGET
Inspect additional endpoints before narrowing the investigation. TCP coverage says nothing about UDP.
9.1.2.2.3 Discovery skips a running target
Recheck relevant ports with response reasons:
sudo nmap -sS -n -Pn --reason -p PORTS -oA scans/tcp-recheck TARGET
Proceed with full TCP coverage despite failed discovery:
sudo nmap -sS -n -Pn -p- -oA scans/tcp-all-no-discovery TARGET
-Pn assumes online status; inspect actual responses. It does not fix routing. Use -sT without sudo if ordinary TCP connections are needed.
9.1.2.2.4 Timing and progress
Full TCP with normal timing and periodic progress:
sudo nmap -sS -n -p- -T3 --stats-every 30s -oA scans/tcp-normal TARGET
Faster timing on a stable path:
sudo nmap -sS -n -p- -T4 --stats-every 30s -oA scans/tcp-faster TARGET
-T3 is normal timing; -T4 is more aggressive. Periodic progress changes display, not coverage. Recheck decisive results if loss or filtering makes observations uncertain.
9.1.2.2.5 Discover TCP services through an established SOCKS route TCP-only access through a SOCKS proxy
Use ordinary connect calls when a previously established proxy is the only route. This is a bounded first view, not complete TCP coverage:
proxychains nmap -sT -Pn -n --top-ports 100 -oA scans/tcp-proxy-top100 TARGET
proxychains cannot turn SYN probes or UDP into proxied TCP connections. -Pn avoids discovery probes that may not traverse the proxy. Confirm the proxy route first, preserve the 100-port limit, and expand with another connect scan only when scope and path permit it.