Discover TCP ports with SYN or connect scans
Needs: SYN scanning needs raw-packet privileges; connect scanning needs OS TCP connections; specify selected versus full port coverage
2. Get initial TCP results
# 2. Get initial TCP results
sudo nmap -sS -n -oA scans/tcp-initial TARGET
# Assigned host list, SYN scan
sudo nmap -sS -n -iL targets.txt -oA scans/tcp-initial-list
# One host, connect scan without raw-packet privileges
nmap -sT -n -oA scans/tcp-connect TARGET
# Selected ports or a range
sudo nmap -sS -n -p PORTS -oA scans/tcp-selected TARGET
# Find relevant services across assigned hosts
sudo nmap -sS -n -p PORTS -iL targets.txt -oA scans/tcp-service-sweep
# 3. Complete TCP coverage
sudo nmap -sS -n -p- -oA scans/tcp-all TARGET
# Connect scan
nmap -sT -n -p- -oA scans/tcp-all-connect TARGET
# Recheck relevant ports with response reasons
sudo nmap -sS -n -Pn --reason -p PORTS -oA scans/tcp-recheck TARGET
# Proceed with full TCP coverage despite failed discovery
sudo nmap -sS -n -Pn -p- -oA scans/tcp-all-no-discovery TARGET
# Full TCP with normal timing and periodic progress
sudo nmap -sS -n -p- -T3 --stats-every 30s -oA scans/tcp-normal TARGET
# Faster timing on a stable path
sudo nmap -sS -n -p- -T4 --stats-every 30s -oA scans/tcp-faster TARGET
Inspect additional endpoints before narrowing the investigation. TCP coverage says nothing about UDP.
This is a bounded first view, not complete TCP coverage
Use ordinary connect calls when a previously established proxy is the only route. This is a bounded first view, not complete TCP coverage:
# This is a bounded first view, not complete TCP coverage
proxychains nmap -sT -Pn -n --top-ports 100 -oA scans/tcp-proxy-top100 TARGET
proxychainscannot turn SYN probes or UDP into proxied TCP connections.-Pnavoids discovery probes that may not traverse the proxy. Confirm the proxy route first, preserve the 100-port limit, and expand with another connect scan only when scope and path permit it.
Verify → Retain the selected port set, source context, completion/errors and raw output; follow open ports with focused application evidence.
If it fails → Filtered is not closed. Through SOCKS use supported TCP-connect behavior and skip unsupported raw discovery/UDP; if results conflict, compare from the actual source. More detail ↓
Explanation & examples
Discover TCP ports with SYN or connect scans
- USE WHEN
- An assigned host needs an initial service queue or full TCP coverage
- STARTING ACCESS
- An explicitly assigned address or host list and a known source position
- RESULT
- A saved TCP port-state inventory with explicit coverage
Recognize the clue
After path validation, compare a first TCP pass with explicit full-port coverage; record skipped discovery or privilege limitations.
nmap -Pn -sT --top-ports 1000 TARGET -oA tcp-initial
nmap -Pn -sT -p- TARGET -oA tcp-full
Initial selection: 22/tcp open ssh; 80/tcp open http
Full selection also: 18080/tcp open unknownMeans: The high listener exists outside the first selection; its application label remains provisional.
Confirm: Confirm scan completion, source, errors and application behavior on each interesting port.
- After validation
- A focused connection and application response confirm the listener: queue its service.
- Ruled out in this context
- The earlier result cannot be reproduced after a completed focused check: retire that stale listener hypothesis.
- Still inconclusive
- Filtered ports or interrupted scans leave coverage/reachability unresolved; save the limit and choose a focused check.
Troubleshooting: Filtered is not closed. Through SOCKS use supported TCP-connect behavior and skip unsupported raw discovery/UDP; if results conflict, compare from the actual source.
Purpose: Get quick leads, complete TCP coverage, and adapt scan type, discovery handling, timing and output to the access path.
2. Get initial TCP results
Coverage: 1,000 common TCP ports. Review
scans/tcp-initial.nmapin a text editor.
Variants — host list, connect scan or selected ports
Initial view: 1,000 common ports
Assigned host list, SYN scan:
One host, connect scan without raw-packet privileges:
Default coverage is the common-port selection, not ports 1-1000.
Selected ports or a range
One host: replace PORTS with, for example, 25,43 or 1-1024.
Find relevant services across assigned hosts:
A focused service sweep is not a full port map.
3. Complete TCP coverage
Coverage: TCP 1-65535. Investigate useful initial results while this runs.
Variants — connect scan, blocked discovery, timing and progress
All TCP ports: 1-65535
Connect scan:
Inspect additional endpoints before narrowing the investigation. TCP coverage says nothing about UDP.
Discovery skips a running target
Recheck relevant ports with response reasons:
Proceed with full TCP coverage despite failed discovery:
-Pn assumes online status; inspect actual responses. It does not fix routing. Use -sT without sudo if ordinary TCP connections are needed.
Timing and progress
Full TCP with normal timing and periodic progress:
Faster timing on a stable path:
-T3 is normal timing; -T4 is more aggressive. Periodic progress changes display, not coverage. Recheck decisive results if loss or filtering makes observations uncertain.
TCP-only access through a SOCKS proxy
Use ordinary connect calls when a previously established proxy is the only route. This is a bounded first view, not complete TCP coverage:
proxychains cannot turn SYN probes or UDP into proxied TCP connections. -Pn avoids discovery probes that may not traverse the proxy. Confirm the proxy route first, preserve the 100-port limit, and expand with another connect scan only when scope and path permit it.
Why it works
SYN and connect scans infer reachability differently but both cover only their selected ports. A common-port scan is a prioritization pass, not full TCP coverage.
Worked example · hypothetical
Observation: the initial scan exposes SSH and HTTP. Test: finish full TCP selection. Illustrative output: an additional management service appears on a high port. Interpretation: add it to the queue before committing to a web-only path.
New identity, privilege, host or route? Re-enumerate → All topic tasks →