Everyone has a favorite nmap invocation. Here’s mine, and why each piece is there.

The standard sweep

$ nmap -sC -sV -p- -T4 <target>

• -sC default scripts (safe + valuable), -sV version detection
• -p- all 65535 ports — half the battle is finding the unusual port
• -T4 aggressive timing for lab/CTF targets (use -T2 on real scopes)

Faster discovery phase

$ nmap -sn -T4 10.10.10.0/24        # ping sweep, no port scan
$ nmap -sU --top-ports 20 <target>  # top 20 UDP (DNS, SNMP, NTP...)

When scripts are too loud

$ nmap -p 80 --script http-enum <target>
$ nmap -p 445 --script smb-enum-shares <target>

Targeted script groups by service, instead of -sC on everything.

Output habits

$ nmap -oN scan.txt -oX scan.xml <target>   # keep both, forever

Keep every scan in a folder per target — your future writeup self will thank you, and the report discipline carries over to real assessments.

The meta-rule

Version detection (-sV) output is worth more than the port list itself. A service + version is a search query; a port number is trivia.