Master Guides

Search Commands

Global

Find a command

Ubuntu Administration Cheatsheet

Ubuntu

Essential maintenance and troubleshooting commands for Ubuntu servers. Each entry includes a quick explanation so operators understand the effect before running it - use the Copy button to move the command to your clipboard instantly.

sudo apt update && sudo apt upgrade -y
Refresh package indexes and apply all available upgrades unattended to keep the system patched.
sudo apt autoremove --purge
Remove orphaned packages and their configuration files to reclaim disk space after upgrades.
sudo systemctl status ssh
Check the current state, recent logs, and unit metadata for the OpenSSH service.
sudo systemctl restart nginx
Gracefully restart NGINX to load updated configuration without rebooting the host.
sudo journalctl -u nginx --since "-30m"
Tail the last 30 minutes of NGINX unit logs for quick incident triage.
df -h
Display disk usage across mounted filesystems using human-readable units.
sudo ufw status verbose
Show firewall mode, defaults, and active allow/deny rules.
sudo adduser analyst
Create the analyst account interactively, prompting for password and profile data.
sudo usermod -aG sudo analyst
Add the analyst user to the sudo group to grant administrative privileges.
sudo tail -f /var/log/syslog
Stream system log entries in real time to monitor warnings and errors as they happen.
sudo ss -tulnp
List active TCP/UDP listeners and their owning processes to spot unexpected services.
sudo du -sh /var/* | sort -h
Summarize directory sizes under /var and sort ascending to find heavy usage.
sudo systemctl list-timers --all
Review every systemd timer with its next trigger time and linked service.
crontab -l
Show the current userÃƒÂ¢Ã¢â€šÂ¬Ã¢â€žÂ¢s cron jobs for quick schedule verification.
sudo systemctl list-units --failed
List services stuck in a failed state after the most recent boot.
sudo journalctl -p err..alert -b
Review high-severity journal entries from the current boot.
sudo ss -tulpen
Show listening TCP/UDP sockets along with owning processes.
sudo du -sh /var/log/* | sort -h
Find the heaviest log directories and sort them from smallest to largest.
sudo apt-mark showhold
List packages pinned on hold to avoid unintended upgrades.
sudo do-release-upgrade -c
Check whether a new Ubuntu release is available without upgrading.
hostnamectl
Display the current hostname, chassis details, kernel, and virtualization state in one summary.
free -h
Show RAM and swap usage with human-readable units for quick memory checks.
lsblk -f
List block devices, filesystems, labels, and mount points to verify storage layout.
ip -br addr
Print interface names, states, and assigned IP addresses in a compact network summary.
sudo timedatectl status
Verify local time, UTC, NTP sync state, and the active timezone configuration.
sudo journalctl --disk-usage
Report how much disk space the systemd journal is consuming before cleanup.
sudo systemd-analyze blame
Rank slow boot services so you can spot units delaying startup.
sudo netplan get
Dump the effective Netplan configuration to review interfaces, routes, and DNS settings.
sudo systemctl list-units --type=service --state=running
List only running services to confirm what is actively loaded on the host.
sudo apt list --upgradable
Show packages with pending upgrades before you schedule maintenance.
uname -a
Print the running kernel version and machine details when you need a fast system fingerprint.
uptime
Show system uptime together with current load averages to judge how busy the host is.
lscpu
Display CPU model, core counts, architecture, and virtualization capabilities.
ps aux --sort=-%mem | head
List the top memory-consuming processes so you can find runaway applications quickly.
ps aux --sort=-%cpu | head
List the top CPU-consuming processes to spot hot loops or overloaded services.
sudo apt-cache policy nginx
Show the installed and candidate package versions plus the apt source priorities.
apt search redis
Search the apt repositories when you know the software name but not the exact package.
sudo snap list
List installed snap packages and their channels to audit non-apt software quickly.
sudo systemctl reload nginx
Reload NGINX configuration without dropping active connections when only the config changed.
sudo nginx -t
Validate NGINX syntax before a reload or restart so you do not ship a broken config.
sudo systemctl enable --now ufw
Enable UFW immediately and make sure it also starts automatically on future boots.
sudo ufw allow OpenSSH
Allow SSH through the firewall using Ubuntu's built-in application profile name.
ip route
Print the routing table so you can verify default gateways and subnet paths.
ping -c 4 1.1.1.1
Send four ICMP probes to confirm basic network reachability and latency.
dig +short example.com
Resolve a hostname quickly and return only the answer records without verbose DNS output.
sudo resolvectl status
Inspect active DNS servers, search domains, and resolver state per interface.
curl -I https://example.com
Fetch only HTTP response headers when checking status codes, redirects, or TLS termination.
sudo tar -czf backup-etc-$(date +%F).tar.gz /etc
Create a dated compressed backup of /etc before major configuration changes.
sudo rsync -a --delete /srv/data/ /backup/data/
Mirror one directory into another while preserving metadata and deleting stale backup files.
sudo fail2ban-client status
Check Fail2ban jail status and confirm whether abusive clients are being blocked.
sudo passwd -l analyst
Lock a local account password to prevent interactive logins without deleting the user.
sudo docker ps --format "table {{.Names}}\t{{.Status}}\t{{.Ports}}"
List running Docker containers with names, status, and published ports in a readable table.
journalctl --since today
Filter journal logs to only entries from today when reviewing the current day's activity.
who
Show who is currently logged in so you can see active interactive sessions.
last -n 10
Review the most recent successful logins to audit who accessed the machine.
sudo lastb | head
Review failed login attempts from the btmp database to spot brute-force activity.
id analyst
Display a user's UID, primary group, and supplementary groups in one line.
groups analyst
List the group memberships for a specific account.
sudo chage -l analyst
Inspect password aging, expiry, and account validity settings for a user.
findmnt
Display mounted filesystems in a cleaner tree view than the classic mount output.
vmstat 1 5
Sample CPU, memory, swap, and IO counters repeatedly for quick performance triage.
iostat -xz 1 3
Show extended disk utilization metrics so you can identify saturated storage devices.
sudo lsof -i -P -n | head
List open network sockets with process names while skipping slow DNS lookups.
sudo lsof /var/log/syslog
Show which process currently has a specific file open before rotating or deleting it.
sudo tcpdump -ni any port 53
Capture DNS packets on every interface when debugging resolver or forwarding issues.
traceroute 1.1.1.1
Trace the network path to a remote host and identify where latency or drops begin.
sudo iptables -S
Print the raw iptables ruleset when you need to inspect lower-level firewall policy.
ss -s
Show a protocol-level socket summary to gauge connection counts at a glance.
du -sh ~/* | sort -h
Summarize disk usage under the current home directory and sort it from small to large.
sudo find / -xdev -type f -size +1G
Find files larger than 1 GB on the local filesystem when chasing disk pressure.
sudo apt clean
Clear downloaded apt package archives to reclaim space in the package cache.
sudo apt-mark showmanual
List manually installed packages to separate your intent from dependencies.
dpkg -l | grep nginx
Search the installed package database for matching package names.
systemctl is-enabled nginx
Check whether a service is enabled to start automatically at boot.
journalctl -u ssh -n 50 --no-pager
Show the latest SSH service log lines without opening a pager.
sudo systemctl daemon-reload
Reload systemd unit files after editing service definitions or drop-ins.
sudo loginctl list-sessions
List current user sessions known to systemd-logind.
sudo localectl status
Show the configured locale and keyboard layout for the host.

Guide: Centralized Updates with Ansible

Automation

1. Install Ansible

On your admin machine run:

sudo apt update && sudo apt install ansible -y

2. Create Inventory (hosts.ini)

Create hosts.ini with your server connection details:

[my_servers]
SERVER_IP_1 ansible_user=USERNAME ansible_ssh_pass='PASSWORD' ansible_become_pass='PASSWORD'
SERVER_IP_2 ansible_user=USERNAME ansible_ssh_pass='PASSWORD' ansible_become_pass='PASSWORD'
SERVER_IP_3 ansible_user=USERNAME ansible_ssh_pass='PASSWORD' ansible_become_pass='PASSWORD'

Repeat entries for each server, replacing SERVER_IP_X, USERNAME, and PASSWORD.

3. Test Connectivity

ansible my_servers -i hosts.ini -m ping

Successful output shows "ping": "pong" for every host.

4. Create Playbook (update.yml)

Save the following playbook as update.yml:

- name: Update and maintain all servers
  hosts: my_servers
  become: yes
  tasks:

    - name: Ensure linux-tools-common is installed (only if available)
      apt:
        name: linux-tools-common
        state: present
      ignore_errors: yes

    - name: Fix broken packages if any
      command: apt --fix-broken install -y

    - name: Update and upgrade packages
      apt:
        update_cache: yes
        upgrade: dist
        autoremove: yes
        autoclean: yes
        cache_valid_time: 3600

    - name: Check if reboot is required
      stat:
        path: /var/run/reboot-required
      register: reboot_required

    - name: Reboot if needed
      reboot:
      when: reboot_required.stat.exists

    - name: Show kernel version
      command: uname -r
      register: kernel
    - debug:
        msg: "Server {{ inventory_hostname }} is running kernel {{ kernel.stdout }}"

    - name: Check disk space on root
      command: df -h /
      register: disk_space
      changed_when: false
    - debug:
        msg: "Server {{ inventory_hostname }} has root usage: {{ disk_space.stdout_lines[1] }}"

5. Run the Playbook

ansible-playbook -i hosts.ini update.yml -vv

6. Verify Results

Kernel versions and disk usage print as part of the playbook output.
Reboots occur automatically when /var/run/reboot-required exists.

7. Optional: Save Logs

ansible-playbook -i hosts.ini update.yml | tee /var/log/ansible-update.log

8. Change Hostname (admin machine)

hostnamectl set-hostname NEWNAME

9. Quick One-Liner

Run a one-off upgrade without using the playbook:

ansible my_servers -i hosts.ini -m apt -a "update_cache=yes upgrade=dist autoremove=yes autoclean=yes" --become

Windows Command Prompt Reference

CMD

Practical Windows Command Prompt commands for troubleshooting, networking, file work, account administration, and system repair. Every entry is ready to copy so users can paste instead of retyping long commands.

Troubleshooting

Start here for the fastest Windows diagnostics, repair, network triage, and health checks when a system is behaving badly.

ipconfig /all
Show every adapter, IP address, DNS server, gateway, and DHCP detail in one full network summary.
ipconfig /flushdns
Clear the local DNS resolver cache when name lookups are stale or poisoned.
ipconfig /release && ipconfig /renew
Drop and renew the DHCP lease to recover from common client-side addressing issues.
ping -n 4 8.8.8.8
Send four ICMP echo requests to confirm basic network reachability and latency.
tracert 8.8.8.8
Trace the hop-by-hop path to a remote address and locate where delay or loss begins.
nslookup example.com
Query DNS for a hostname and verify which resolver returns the answer.
netstat -ano
List listening ports and active connections together with the owning process ID.
arp -a
Show the ARP cache to map local IP addresses to MAC addresses.
route print
Dump the IPv4 and IPv6 routing tables to inspect gateways and interface metrics.
tasklist
List running processes with image names, session IDs, and memory usage.
taskkill /PID 1234 /F
Force-terminate a process by PID when it refuses to close normally.
systeminfo
Print OS version, boot time, hotfixes, memory totals, and domain/workgroup details.
driverquery /v
Enumerate installed drivers with module paths, types, and start modes.
whoami /all
Show the current identity, privileges, integrity level, and group memberships.
hostname
Print the local computer name exactly as the OS currently knows it.
ver
Return the Windows version banner from the command interpreter.
sfc /scannow
Scan protected system files and repair integrity violations when possible.
DISM /Online /Cleanup-Image /RestoreHealth
Repair the Windows component store when SFC alone cannot fix broken system files.
chkdsk C: /scan
Run an online scan of the C: volume to detect file system issues without rebooting.

General Commands

Everything else for file work, user management, services, registry edits, networking tasks, and routine administration.

dir /a
List all files including hidden and system items in the current directory.
tree /f
Render the current directory tree and include file names for a quick structure view.
cd /d D:\Logs
Change drive and directory in one step when navigating to another volume.
mkdir C:\Temp\Reports
Create a directory path for staging files, logs, or exports.
del /q C:\Temp\*.log
Delete matching files quietly without prompting for confirmation.
robocopy C:\Source D:\Backup /MIR /R:1 /W:1
Mirror one directory to another while limiting retries and wait times on failures.
findstr /spin "error" *.log
Search recursively through logs for matching text such as errors or hostnames.
shutdown /r /t 0
Restart the system immediately with no countdown when maintenance is complete.
powercfg /batteryreport
Generate a battery health report on supported laptops for charge-capacity analysis.
net user
List local user accounts available on the machine.
net user analyst NewP@ssw0rd! /add
Create a local account directly from Command Prompt with a starting password.
net localgroup administrators analyst /add
Add a user to the local Administrators group.
schtasks /query /fo LIST /v
List scheduled tasks with verbose details for auditing automation on the host.
net use
Show mapped network drives and active SMB connections.
wmic logicaldisk get caption,freespace,size,volumename
Print disk letters, free space, total size, and volume names in a compact table.
assoc
List or inspect file extension associations to see which file types map to which handlers.
ftype
Show the command string Windows uses when opening a registered file type.
where notepad
Locate an executable or file by searching the current directory and PATH.
set
Dump current environment variables from the active Command Prompt session.
path
Print the executable search path that CMD will use to locate commands.
setx JAVA_HOME "C:\Program Files\Java\jdk-21"
Persist an environment variable for future sessions instead of only the current shell.
attrib
Show or change hidden, read-only, system, and archive file attributes.
type C:\Windows\System32\drivers\etc\hosts
Print the contents of a text file directly to the console.
more C:\Windows\WindowsUpdate.log
Page through a text file one screen at a time in Command Prompt.
fc /n file1.txt file2.txt
Compare two text files line by line and report differences.
type report.txt | clip
Send command output or file contents directly into the Windows clipboard.
copy C:\Temp\report.txt D:\Archive\report.txt
Copy one file to another path using the built-in CMD file operation.
move C:\Temp\*.csv D:\Archive\
Move files into a new directory or rename them in one step.
ren oldname.log newname.log
Rename a file or folder without moving it to another directory.
xcopy C:\Deploy D:\Deploy /E /I /Y
Recursively copy directories and preserve structure with classic CMD tooling.
mklink /D C:\LogsLink D:\CentralLogs
Create a directory symbolic link or junction from Command Prompt.
compact /c /s:C:\Logs
Compress files or folders on NTFS to save space without moving them elsewhere.
cipher /w:C:\Temp
Securely overwrite deleted data in free space on a volume.
fsutil fsinfo drives
List local drive letters recognized by the operating system.
fsutil volume diskfree C:
Show free and total bytes on a volume for quick capacity checks.
openfiles /query
List files opened remotely through SMB when the feature is enabled.
reg query HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion
Read registry values from a key without opening Registry Editor.
reg add HKCU\Environment /v TEST_VALUE /t REG_SZ /d demo /f
Create or update a registry value directly from Command Prompt.
sc query spooler
Query the current state of a Windows service.
sc qc spooler
Show service configuration details such as binary path and startup type.
net start
List running services or start a named service from the command line.
net stop spooler
Stop a running service cleanly from Command Prompt.
gpupdate /force
Force an immediate refresh of computer and user Group Policy.
gpresult /r
Display the Resultant Set of Policy applied to the current user and computer.
wevtutil qe System /c:20 /f:text
Query recent Windows event log entries from the System log in plain text.
quser
Show who is logged on through console or Remote Desktop sessions.
query session
List terminal sessions on the machine with their IDs and states.
net share
List local file shares currently published by the system.
net view \\fileserver
Enumerate shares exported by another Windows host over SMB.
netsh advfirewall show allprofiles
Display Windows Defender Firewall profile settings for domain, private, and public networks.
netsh wlan show profiles
List saved wireless profiles known to the machine.
netsh interface ip show config
Show IPv4 interface configuration through netsh output.
netsh winsock reset
Reset the Winsock catalog to recover from broken network stack state.
netsh int ip reset resetlog.txt
Reset the TCP/IP stack and write a log file describing the changes.
wmic bios get serialnumber
Print the BIOS serial number for inventory or asset tracking.
wmic os get lastbootuptime
Return the last boot timestamp from WMI for uptime analysis.

Wireshark Capture Recipes

Wireshark

Handy display filters for Wireshark. Copy a filter, drop it into the display bar, and fine-tune live captures faster.

ip.addr == 192.168.1.42
Show all packets where either source or destination IP matches 192.168.1.42.
tcp.port == 443
Display only TLS traffic by filtering for packets on TCP port 443.
http.request
Audit HTTP client activity by listing every HTTP request frame.
dns && udp.port == 53
Focus on DNS queries and responses travelling over standard UDP 53.
tls.handshake.extensions_server_name
Extract TLS ClientHello packets to review SNI hostnames offered by clients.
tcp.analysis.retransmission
Surface TCP retransmissions to hunt for congestion or packet loss.
tcp.flags.syn == 1 && tcp.flags.ack == 0
Watch for connection attempts by isolating SYN packets without ACK.
eth.src == 00:11:22:33:44:55
Track traffic from a specific device by matching its source MAC address.
wlan.fc.type_subtype == 0x08
Filter Wi-Fi beacon frames while surveying wireless AP broadcasts.
frame.time >= "2025-10-03 15:00:00" && frame.time <= "2025-10-03 15:15:00"
Narrow a capture to a fifteen-minute incident window using frame timestamps.
icmp
Highlight all ICMP traffic, including ping and error messages.
icmp.type == 8
Show only ICMP echo requests to spot ping probes.
arp
List ARP requests and replies to study local network discovery.
tcp.flags.reset == 1
Spot abrupt TCP resets that may indicate dropped sessions.
tcp.flags.fin == 1 && tcp.len == 0
Watch graceful TCP closes where FIN packets carry no payload.
tcp.analysis.zero_window
Identify endpoints advertising a zero receive window.
tcp.window_size_value < 1024
Find sessions with very small TCP receive windows.
tcp.len == 0 && tcp.flags.ack == 1
Catch TCP keepalive ACKs that keep idle sessions open.
tcp.analysis.fast_retransmission
Surface fast retransmissions triggered by duplicate ACKs.
tcp.analysis.spurious_retransmission
Reveal spurious retransmissions caused by out-of-order packets.
tcp.segment.lost
Highlight segments flagged as lost by TCP analysis.
tcp.stream == 7
Jump directly to stream number 7 for deep inspection.
udp.port == 67 || udp.port == 68
Inspect DHCP client/server exchanges on UDP 67 and 68.
bootp.option.type == 53 && bootp.option.value == 3
Filter DHCP request messages from clients.
radius
Collect RADIUS authentication and accounting packets.
ntp
List Network Time Protocol traffic for time-sync troubleshooting.
dhcpv6
Monitor DHCPv6 address assignment conversations.
icmpv6
Inspect ICMPv6 control messages on IPv6 networks.
ipv6
Show only IPv6 traffic across the capture.
ipv6.addr == fe80::1
Watch IPv6 packets involving the link-local address fe80::1.
tcp.port == 22
Filter SSH control and data sessions.
tcp.port == 25 || tcp.port == 587
Focus on SMTP traffic across submission and relay ports.
smtp
Display full SMTP conversations, including headers and commands.
imap
List IMAP traffic for mailbox synchronization issues.
pop
Inspect POP3 sessions downloading mail.
ftp || ftp-data
Capture FTP control and data channels together.
ssh
Find SSH tunnels and interactive sessions.
rdp
Monitor Remote Desktop Protocol connections.
http.request.method == "POST"
Isolate HTTP POST requests that carry form submissions or uploads.
http.response.code >= 400
Show HTTP responses that return client or server errors.
http.user_agent contains "curl"
Spot automation scripts or curl-based clients.
http.host contains "login"
Locate HTTP requests targeting login-related hostnames.
http.cookie
Extract HTTP packets carrying cookies for session analysis.
http.authorization
Review HTTP requests that include Authorization headers.
http2
Filter modern HTTP/2 traffic over TLS or cleartext.
quic
Inspect QUIC streams for HTTP/3 troubleshooting.
tls.record.content_type == 23
Focus on TLS application data records.
tls.record.version == 0x0304
Highlight TLS 1.3 encrypted sessions.
tls.alert_message.level == 2
Find fatal TLS alerts that tear down sessions.
dns.qry.name contains "example.com"
Show DNS lookups referencing example.com or its subdomains.
dns.flags.response == 0
Collect outbound DNS queries waiting on answers.
dns.a && dns.qry.name == "internal.local"
Zero in on A-record answers for internal.local hosts.
sip
Surface SIP signaling when troubleshooting VoIP registrations and calls.
rtp
List RTP media streams to analyze audio or video quality.
rtcp
Inspect RTP control traffic conveying QoS statistics.
mgcp
Capture Media Gateway Control Protocol messages.
smb2
Focus on modern SMB2/SMB3 file sharing traffic.
smb2.command == 5
Highlight SMB2 CREATE requests to monitor file access.
kerberos
Collect Kerberos authentication exchanges.
kerberos.msg_type == 10
Spot Kerberos AS-REQ messages during initial authentication.
ldap
Inspect LDAP directory queries and responses.
mysql
Show MySQL client/server conversations.
pgsql
Display PostgreSQL wire protocol traffic.
mqtt
Monitor MQTT publish/subscribe messages for IoT systems.
coap
Filter CoAP traffic common in constrained IoT deployments.
modbus
Capture Modbus/TCP commands to industrial controllers.
icmpv6.type == 135
Track IPv6 Neighbor Solicitation messages.
icmpv6.type == 136
Track IPv6 Neighbor Advertisement messages.
ospf
Inspect OSPF link-state advertisements across routers.
bgp
Monitor BGP updates between peers.
stp
Review Spanning Tree Protocol BPDUs in switched networks.
ip.proto == 47
Show GRE encapsulated tunnels by protocol number 47.
vxlan
Flag VXLAN overlay packets for data center fabrics.
ip.ttl <= 1
Catch packets that arrived with TTL of 1 or less—possible routing loop evidence.
tcp.analysis.flags
Expose any TCP segments flagged as noteworthy by Wireshark analysis.
tcp.port == 3389
Focus on RDP sessions specifically on TCP 3389.
tls.handshake.extensions_supported_groups
Review supported groups (elliptic curves) advertised in TLS handshakes.
tls.handshake.extensions_alpn
Inspect ALPN negotiation inside TLS ClientHello messages.
tls.handshake.ciphersuite
List the cipher suites offered during TLS handshakes.
icmp.type == 3 && icmp.code == 3
Detect ICMP Destination Unreachable / Port Unreachable messages.
dns.qry.type == 28
Filter IPv6 AAAA DNS queries.
dns.mx
Identify DNS MX record lookups for mail routing.
ftp.command == "STOR"
Spot FTP uploads by filtering STOR commands.
mqtt.topic contains "alerts"
Watch MQTT messages published to topics containing 'alerts'.
sctp
Capture SCTP traffic used by SIGTRAN or WebRTC data channels.
diameter
Inspect Diameter signaling in LTE/5G core networks.
gsmtap
Analyze GSM TAP captures over IP.
radius.code == 2
Isolate Access-Accept responses in RADIUS flows.
lldp
Display Link Layer Discovery Protocol frames.
cdp
Find Cisco Discovery Protocol advertisements.
mdns
Capture multicast DNS traffic used by Bonjour services.
nbns
Look at NetBIOS Name Service broadcasts.
ip.dsfield.dscp == 46
Hunt for Expedited Forwarding (EF) DSCP-marked packets.
ip.fragment == 1
Show IP fragments to diagnose MTU or fragmentation issues.
tcp.options.mss < 1200
List TCP sessions advertising very small MSS values.
tcp.options.sack_perm == 1
Verify endpoints that negotiated selective acknowledgements.
tcp.analysis.out_of_order
Highlight out-of-order TCP segments.
tcp.analysis.duplicate_ack
Show duplicate ACKs that often precede retransmissions.
tcp.analysis.ack_lost_segment
Identify ACKs for segments that Wireshark believes were lost.
tcp.analysis.window_full
Find packets where the receiver reported a full TCP window.
tcp.analysis.bytes_in_flight > 200000
Flag bursts with very large TCP bytes in flight.
tcp.analysis.keep_alive
List TCP keepalive probes.
tcp.analysis.keep_alive_ack
List TCP keepalive acknowledgements.
tcp.analysis.expert_message
Collect expert info messages generated by the TCP dissector.
ip.checksum_bad == 1
Surface IP packets that failed checksum validation.
ip.flags.mf == 1
Show IP packets with the More Fragments flag set.
ip.frag_offset > 0
Inspect non-initial IP fragments (offset greater than zero).
frame.len > 1500
Find jumbo frames exceeding the standard Ethernet MTU.
frame.len == 64
Check for minimum-sized Ethernet frames, often keepalives.
frame.number >= 100 && frame.number <= 200
Limit view to frames 100 through 200 for quick review.
tcp.options.timestamp
Confirm TCP conversations that negotiated timestamps.
ip.geoip.country == "CN"
List packets geolocated to China (requires GeoIP database).
http.request.uri contains "/login"
Target HTTP requests that reference a login URI.
http.file_data
Locate HTTP packets carrying downloadable file data.
http.content_type contains "json"
Highlight HTTP responses returning JSON payloads.
http.response.code >= 500
Spot HTTP server errors (status 5xx).
http.request.full_uri contains ".php"
Inspect requests hitting PHP resources.
tls.handshake.type == 1
Show TLS ClientHello packets to review offered ciphers, SNI names, and extensions.
tls.handshake.type == 2
Show TLS ServerHello packets to verify the version and parameters the server selected.
tls.handshake.session_id_length == 0
Find TLS sessions using session resumption tickets (no session ID).
ssl.record.version < 0x0303
Spot legacy SSLv3/TLS1.0 records.
dns.resp.name contains "internal"
Show DNS responses that resolve hosts under 'internal'.
dns.qry.class == 3
Filter DNS CHAOS class queries (e.g., version.bind).
mqtt.msgtype == 3
Show MQTT publish messages only.
coap.code.class == 0
Display CoAP request messages.
smb2.nt_status != 0
Catch SMB2 responses returning an error status.
kerberos.msg_type == 30
Locate Kerberos TGS-REQ messages.
ldap.request.messageid == 5
Drill into LDAP requests with message ID 5 (example conversation tracking).
tcp.flags.push == 1
List packets where the TCP PSH flag is asserted.
tcp.flags == 0x012
Display SYN-ACK handshake packets.
rtsp
Inspect Real Time Streaming Protocol negotiations.
rtsp.method == "SETUP"
Filter RTSP SETUP requests when bringing media streams online.
rtcp.packet_type == 203
Monitor RTCP BYE messages terminating sessions.
dns.ptr
Investigate PTR (reverse lookup) DNS responses.
ssdp
Capture UPnP SSDP discovery broadcasts.
icmp.type == 11
Find ICMP Time Exceeded messages signalling TTL expiry.
icmp.type == 12
Detect ICMP Parameter Problem notifications.
mpls
Show MPLS-labeled traffic in provider networks.
mpls.label == 16000
Focus on packets using MPLS label 16000.
erspan
List ERSPAN mirrored traffic sessions.
gre
Display Generic Routing Encapsulation tunnels.
ip.proto == 112
Identify VRRP packets on redundant gateways.
ether.dst == ff:ff:ff:ff:ff:ff
Watch broadcast frames hitting every device on the segment.
ether.src == ff:ff:ff:ff:ff:ff
Spot malformed frames claiming a broadcast source.
vlan
List VLAN-tagged frames (802.1Q).
vlan.id == 10
Inspect traffic assigned to VLAN 10.
dns.srv
Review DNS SRV records for service discovery.
dns.ns
List DNS NS responses showing authoritative servers.
imap.request.tag == "A142"
Follow a specific IMAP request tag within a mail session.
smtp.req.parameter == "AUTH"
Find SMTP AUTH commands negotiating logins.
dhcp.option.type == 61
Highlight DHCP client identifier options.
dhcpv6.option.clientid
Show DHCPv6 messages carrying client identifiers.
radius.User-Name
Inspect RADIUS attributes carrying usernames.
ssl.handshake
Collect all SSL/TLS handshake packets regardless of type.
ssl.record
Capture every SSL/TLS record, encrypted or not.
ssl.alert_message
Inspect TLS alert frames for shutdown or error details.
ssl.handshake.extensions_alpn
List TLS handshakes offering ALPN protocols.
ssl.app_data
Filter encrypted application data once handshakes complete.
tcp.analysis.ack_rtt
Measure ACK round-trip time values calculated by Wireshark.
tcp.analysis.slow_start
Show TCP segments Wireshark flags as part of slow start.
tcp.seq == 0
Spot TCP packets that use sequence number zero (initial SYNs or resets).
tcp.len > 1460
Detect TCP segments exceeding a standard Ethernet MTU payload.
udp.length > 1200
Find oversized UDP datagrams that may fragment in transit.
udp.port == 1900
Capture SSDP discovery broadcasts on UDP port 1900.
icmp.type == 5
Catch ICMP Redirect messages that modify host routing tables.
icmp.type == 3 && icmp.code == 4
Locate ICMP 'Fragmentation Needed' errors to troubleshoot PMTU.
dns.qry.name matches "(?i)\.cn$"
Flag DNS lookups that end with the .cn TLD (case-insensitive).
dns.qry.type == 16
Display DNS TXT record queries and responses.
dns.opt
List DNS messages that include EDNS0 option records.
bootp.option.hostname
Inspect DHCP client hostnames provided in option 12.
bootp.option.vendor_class_id
Review DHCP vendor class identifiers (option 60).
dhcpv6.option.preference
Check DHCPv6 preference values returned by servers.
icmpv6.nd.ra.flag.managed == 1
Identify IPv6 router advertisements enabling managed address configuration.
ipv6.nxt == 58
Filter IPv6 packets whose next header is ICMPv6 (58).
ipv6.flowlabel != 0
Highlight IPv6 packets that populate the flow label field.
wlan.fc.type_subtype == 0x08 && wlan.ssid
Display Wi-Fi beacons that advertise an SSID.
wlan.fc.type_subtype == 0x05
Capture Wi-Fi probe responses sent by access points.
wlan.fc.type_subtype == 0x04
Monitor Wi-Fi probe requests from roaming clients.
wlan.fc.type_subtype == 0x0b
Inspect Wi-Fi authentication frames during association.
btatt
Show Bluetooth ATT protocol traffic for BLE gadgets.
btle
Filter Bluetooth Low Energy packets in captures.
usb
Review USB protocol captures collected from USB PCAPs.
smb2.command == 8
Track SMB2 GET_INFO requests and responses.
smb2.share.name contains "SYSVOL"
Watch SMB access to the Active Directory SYSVOL share.
smb.signing_required == 1
Find SMB sessions that require message signing.
kerberos.msg_type == 12
List Kerberos TGS-REP messages issued by the KDC.
ldap.request.attribute == "memberOf"
Inspect LDAP requests pulling memberOf attributes.
pgsql.query
Review SQL statements executed over PostgreSQL connections.
mysql.query
Display MySQL queries exchanged via the text protocol.
mqtt.msgtype == 8
Show MQTT SUBSCRIBE requests from clients.
mqtt.msgtype == 9
Show MQTT SUBACK acknowledgements returning from brokers.
mqtt.msgtype == 12
Inspect MQTT PINGREQ keepalive probes.
mqtt.msgtype == 13
Inspect MQTT PINGRESP replies from brokers.
modbus.func_code == 3
Filter Modbus read holding registers operations.
coap.code == 5
Identify CoAP responses returning success content (2.05).
rtsp.method == "PLAY"
Show RTSP commands that start media playback.
rtsp.method == "TEARDOWN"
Highlight RTSP teardown requests ending sessions.
rtcp.packet_type == 200
List RTCP sender reports providing QoS feedback.
sip.Request-Line contains "INVITE"
Collect SIP INVITE requests that initiate calls.
sip.Status-Code >= 400
Watch SIP responses that report errors (4xx and above).
tls.handshake.extensions.supported_versions
Review TLS ClientHello supported versions extension.
tls.handshake.extensions.status_request
Spot TLS handshakes that request OCSP stapling.
ip.geoip.country == "US"
Show packets geolocated to the United States (GeoIP database required).
tls.handshake.extensions.session_ticket
Detect ClientHello messages offering session ticket resumption.
tcp.options.wscale
Confirm TCP peers that negotiated window scaling.
tcp.options.timestamp
Find TCP conversations that include timestamps.
tcp.analysis.keep_alive
List TCP keepalive probes maintaining idle sessions.
tcp.analysis.keep_alive_ack
List TCP keepalive acknowledgements.
tcp.analysis.reused_ports
Detect new TCP connections that reuse existing 4-tuples.
tcp.analysis.rto
Reveal retransmissions triggered by TCP retransmission timeout.
ip.dsfield.ecn == 1
Locate packets marking ECN Congestion Experienced.
ip.dsfield.ecn == 2
Locate packets marked ECN Capable Transport (ECT(0)).
ip.dsfield.ecn == 3
Locate packets marked ECN Capable Transport (ECT(1)).
wlan.fc.retry == 1
Monitor Wi-Fi frames flagged as retransmissions.
wlan.fc.pwrmgt == 1
Show Wi-Fi frames indicating power management mode.
mpls.label == 16
Identify MPLS packets carrying the implicit NULL label 16.
mpls.bos == 1
Show MPLS packets at the bottom of the label stack.
vxlan.vni == 5000
Concentrate on VXLAN overlay network identifier 5000.
icmp.type == 11
See ICMP Time Exceeded messages (traceroute hops).
icmp.type == 12
Display ICMP Parameter Problem notifications.
lldp.tlv.type == 4
Extract LLDP port description TLVs from neighbors.
btle.advertising_header.pdu_type == 0x0f
Filter BLE scan response PDUs.
http.response.code == 302
Capture HTTP redirects returning 302 Found.
http.response.code == 401
Spot HTTP authentication challenges (401 Unauthorized).
http.response.code == 403
Find HTTP requests denied with 403 Forbidden.
http.response.code == 404
Highlight missing resources returning 404 Not Found.
http.response.code == 500
Expose HTTP 500 internal server errors.
http.request.method == "PUT"
Watch REST endpoints receiving PUT requests.
http.request.method == "DELETE"
Monitor DELETE operations modifying remote data.
http.request.method == "PATCH"
Track partial updates made with PATCH requests.
http.request.uri contains ".zip"
Detect ZIP archive downloads over HTTP.
http.request.uri contains ".exe"
Find executable downloads requested through HTTP.
http.request.uri contains ".tar.gz"
Spot compressed tarball transfers.
http.file_data contains "BEGIN RSA PRIVATE KEY"
Raise an alert if private keys traverse HTTP payloads.
http.user_agent contains "PowerShell"
Flag automation leveraging PowerShell web cmdlets.
http.user_agent contains "Mozilla/4.0"
Identify legacy or scripted HTTP clients.
http.host contains "cdn"
Focus on requests routed to CDN hostnames.
http.referer contains "login"
See traffic originating from login forms.
http.cookie contains "session"
Search cookies carrying a session identifier.
http.authorization contains "Bearer"
Monitor HTTP bearer token usage.
http.authorization contains "Basic"
Review HTTP Basic authentication requests.
http.accept_language contains "fr"
Spot clients requesting French-localized content.
http.response.time > 1
Identify HTTP transactions taking longer than one second.
http2.flags.end_stream == 1
List HTTP/2 frames that terminate streams.
http2.header.path contains "/api"
Filter HTTP/2 requests hitting API endpoints.
http2.header.method == "POST"
Show HTTP/2 POST submissions.
quic.cnid
Display QUIC connection IDs in use.
quic.tag.name == "SNI "
Inspect QUIC handshake tags carrying SNI.
tls.handshake.certificate
Collect TLS handshake packets that transmit certificates.
tls.handshake.extensions_server_name contains ".corp"
Spot TLS sessions targeting *.corp hostnames.
tls.handshake.extensions_alpn_str == "h2"
Highlight TLS negotiations preferring HTTP/2.
tls.handshake.extensions_alpn_str == "http/1.1"
Highlight TLS negotiations that fall back to HTTP/1.1.
tls.alert_message.desc == 0
Observe TLS close_notify alerts.
tls.handshake.extensions.supported_groups_named_group == x25519
Verify TLS clients offering the X25519 curve.
tls.handshake.certificates_len > 6000
Find TLS handshakes delivering very large certificate chains.
dns.flags.rcode > 0
List DNS responses returning error codes.
dns.qry.name.len > 60
Flag unusually long DNS query names.
dns.qry.name contains "_tcp"
Review DNS SRV lookups (_tcp services).
dns.qry.name matches "(?i)\.(exe|dll)\$"
Catch DNS beacons querying suspicious executable names.
dns.flags.tc == 1
Show truncated DNS answers requiring TCP retry.
dns.resp.ttl == 0
Identify DNS records expiring immediately (TTL zero).
dns.qry.type == 1
Filter DNS A-record queries.
tcp.port == 1433
Focus on Microsoft SQL Server traffic.
tcp.port == 1521
Inspect Oracle database sessions.
tcp.port == 5986
Monitor WinRM HTTPS management connections.
udp.port == 514
Capture Syslog datagrams.
syslog
Display Syslog messages decoded by Wireshark.
snmp
Show SNMP management traffic.
snmp.version == 3
Isolate secure SNMPv3 conversations.
snmp.community == "public"
Detect SNMP requests using the default 'public' community string.
tftp
Capture Trivial FTP read/write exchanges.
dnp3
Monitor Distributed Network Protocol 3.0 traffic (ICS).
opcua
Inspect OPC UA industrial automation sessions.
bacnet
Highlight BACnet building automation packets.
s7commplus
Review Siemens S7 PLC control messages.
iec60870_5_104
Trace IEC 60870-5-104 SCADA communications.
ip.proto == 89
Filter OSPF packets by protocol number.
ip.proto == 50
Locate IPsec ESP encrypted payloads.
ip.proto == 51
Locate IPsec AH authentication headers.
frame.protocols contains "http"
Filter frames whose dissector stack includes HTTP.
frame.protocols contains "tls"
List frames containing TLS within the protocol stack.
frame.protocols contains "dns"
Highlight frames that include DNS.
frame.len > 9000
Spot jumbo Ethernet frames over 9000 bytes.
frame.len < 64
Detect runt frames smaller than the Ethernet minimum.
frame.number >= 1000 && frame.number <= 1100
Focus analysis on frames 1000 through 1100.
frame.time_delta_displayed > 1
Reveal packets that arrive after more than one second gap.
tcp.time_delta_displayed > 1
Spot TCP frames separated by more than one second.
tcp.analysis.small_segment
Find TCP segments that are unusually small.
tcp.analysis.window_update
List packets that only advertise a revised TCP window size.
tcp.analysis.bytes_in_flight == 0
Check for packets where bytes-in-flight drops to zero.
tcp.analysis.window_full && tcp.len > 0
Catch payload packets sent while the window is full.
tcp.analysis.duplicate_ack_num >= 3
Highlight duplicate ACK bursts that precede fast retransmissions.
mqtt.msgtype == 1
Show MQTT CONNECT packets from clients.
mqtt.msgtype == 2
Show MQTT CONNACK replies from brokers.
mqtt.msgtype == 11
Capture MQTT DISCONNECT packets.
mqtt.msgtype == 14
Capture MQTT AUTH packets (MQTT v5).
kerberos.CNameString contains "$"
Find Kerberos requests made by service accounts ending with $.
ldap.response.resultCode != success
Spot LDAP responses that completed with errors.
smb2.credit_charge > 1
Identify SMB2 requests consuming multiple credits.
radius.code == 4
Expose RADIUS Accounting-Request messages.
http.header.user-agent
Ensure HTTP packets include the User-Agent header.
tls.record.length > 5000
Target TLS records carrying large payloads.
tls.handshake.extensions.supported_versions == 0x0304
Verify TLS clients explicitly negotiating TLS 1.3.
dns.qry.name contains ".localdomain"
Detect lookups against .localdomain names.
dns.qry.name contains ".lan"
Capture DNS queries for .lan zones.
ip.addr == 10.0.0.0/24
Limit captures to the 10.0.0.0/24 subnet.
ip.addr == 172.16.5.10
Filter to packets involving host 172.16.5.10.
ipv6.addr == 2001:db8::1
Filter traffic involving IPv6 address 2001:db8::1.
eth.dst == ff:ff:ff:ff:ff:ff
Highlight Ethernet broadcasts hitting all hosts.
eth.src == ff:ff:ff:ff:ff:ff
Locate frames with broadcast source addresses (malformed).
ip.ttl == 1
Detect packets arriving with TTL equal to 1.
ip.ttl == 255
Spot packets sent with TTL 255 (often routing protocols).
geneve
Inspect GENEVE overlay encapsulation packets.
gtpv2.message_type == 16
Monitor GTPv2 Delete Session Requests in LTE cores.
gtpv1.message_type == 255
Catch GTPv1 Echo Responses.
sctp.payload == DATA
Filter SCTP DATA chunks.
sctp.payload == SACK
Filter SCTP SACK acknowledgement chunks.
coap.mid == 0x1234
Trace a specific CoAP message ID.
rtp.ssrc != 0
List RTP streams that specify an SSRC value.
rtp.marker == 0
Review RTP packets without marker bit to inspect intra-frame data.
dns.qry.name contains "ipv6.google.com"
Track requests to ipv6.google.com.
dns.qry.name contains "windowsupdate"
Follow DNS lookups for Windows Update endpoints.
http.user_agent contains "curl/7"
Spot curl clients by major version 7 user agents.
http.request.uri contains "/wp-login.php"
Monitor attempts against WordPress login pages.
http.user_agent contains "python-requests"
Detect scripts using python-requests HTTP client.
tcp.port == 24800
Capture VNC/Remote Frame Buffer traffic on TCP 24800.
udp.port == 33434
Show UDP traceroute probe packets.
icmp.type == 8 && ip.ttl == 1
Traceroute-style ICMP echo request for first hop.
ip.dsfield.dscp == 46 && tcp.port == 5060
See voice-signalling SIP marked as EF.
tcp.flags.cwr == 1
Detect TCP packets with the Congestion Window Reduced flag set.
tcp.flags.ecn == 1
List TCP packets where the ECN flag is asserted.
tcp.analysis.bytes_in_flight > 1000000
Find large TCP bursts with more than 1 MB outstanding.
tcp.analysis.bytes_in_flight < 500 && tcp.len > 0
Spot underutilized TCP segments with minimal outstanding data.
tcp.analysis.lost_segment
Surface segments Wireshark marks as lost in the TCP flow.
tcp.flags.push == 1 && tcp.len > 0
Highlight TCP packets that push payload immediately to the application.
tcp.options.mss > 1400
Check TCP handshakes advertising large MSS values.
tcp.options.mss < 800
Flag TCP connections negotiating unusually small MSS.
tcp.options.wscale > 8
Identify TCP peers that request high window scaling factors.
tcp.analysis.retransmission && tcp.time_delta_displayed > 2
Catch retransmissions separated by more than two seconds.
tcp.analysis.out_of_order && tcp.time_delta_displayed < 0.01
Find rapid out-of-order arrivals within 10 ms.
tcp.analysis.window_update && tcp.len == 0
List pure TCP window update packets.
tcp.analysis.bytes_in_flight == 0 && tcp.len == 0
See ACK-only packets with no outstanding data.
udp.port == 69
Capture TFTP transfers on UDP 69.
udp.port == 161
Review SNMP queries hitting UDP 161.
udp.port == 162
Monitor SNMP traps sent to UDP 162.
udp.port == 1812
Inspect RADIUS authentication over UDP 1812.
udp.port == 1813
Inspect RADIUS accounting over UDP 1813.
udp.port == 5060 && ip.proto == 17
Target SIP over UDP (port 5060).
udp.port == 4789
Filter VXLAN UDP encapsulated traffic.
udp.port == 6081
Inspect GENEVE UDP encapsulation packets.
icmp.type == 13
Display ICMP timestamp request messages.
icmp.type == 14
Display ICMP timestamp reply messages.
icmp.type == 17
Catch ICMP address mask requests.
icmp.type == 18
Catch ICMP address mask replies.
icmpv6.type == 1
Find ICMPv6 destination unreachable errors.
icmpv6.type == 2
Find ICMPv6 packet too big errors.
icmpv6.type == 3
Inspect ICMPv6 time exceeded messages.
icmpv6.type == 4
Inspect ICMPv6 parameter problem messages.
icmpv6.nd.ns.target_address == fe80::1
Track IPv6 neighbor solicitations for fe80::1.
icmpv6.nd.ra.router_lifetime == 0
See IPv6 router advertisements that withdraw default routes.
dns.qry.name contains "_sip._tls"
Spot DNS SRV lookups for SIP over TLS services.
dns.qry.name contains "_kerberos._tcp"
Find Kerberos service discovery requests.
dns.soa
Display DNS Start of Authority (SOA) responses.
dns.cname
List DNS CNAME alias records in responses.
dns.naptr
Capture DNS NAPTR records used by SIP and ENUM.
dns.time > 0.250
Highlight DNS transactions taking longer than 250 ms so latency stands out immediately.
dns.flags.rcode != 0
Show DNS replies returning an error code such as NXDOMAIN or SERVFAIL.
http.request.uri contains "api"
Filter HTTP requests hitting API-style paths for backend troubleshooting.
frame contains "Authorization"
Search packet contents for Authorization headers or tokens carried in clear text.
websocket
Display WebSocket upgrades and frames for browser-driven realtime applications.
smb2.nt_status != 0x00000000
Show SMB responses with non-zero NT status codes to isolate file share failures.
ntlmssp
Collect NTLMSSP authentication exchanges across SMB, HTTP, or other protocols.
kerberos.CNameString == "administrator"
Focus on Kerberos traffic for the administrator principal during authentication analysis.
tcp.analysis.rto
Surface retransmission timeout events that usually indicate meaningful packet loss or delay.
tls.alert_message.desc
List TLS alert descriptions so you can see handshake failures and teardown reasons fast.

Nmap Scan Profiles

Nmap Commands

Common reconnaissance profiles for Nmap. Each command lists its purpose so you can select the right scan for the situation. Copy buttons speed up pasting into your terminal or automation scripts.

nmap -sn 10.0.0.0/24
Ping sweep to discover live hosts on a local subnet without performing port scans.
nmap -sV -T4 target.com
Service/version detection against common ports with aggressive timing balanced for internet targets.
nmap -Pn -A --reason 192.168.56.12
Disable host discovery, enable OS plus script scans, and show reasoning for each finding.
nmap -p- --min-rate 2000 target.com
Full TCP port sweep with a minimum rate of 2k packets per second for faster coverage.
nmap --script vuln target.com
Run the built-in vulnerability NSE scripts to flag common misconfigurations quickly.
nmap -sU -sT -p 53,67,161 target.com
Dual UDP/TCP scan of DNS, DHCP, and SNMP to evaluate infrastructure exposure.
nmap -sC -sV -oA scans/target target.com
Run default scripts with version detection and save output in all formats under scans/.
nmap -sS -sC -sV -oN recon.txt target.com
Stealth SYN scan with default scripts and version detection, saving output to recon.txt.
nmap -sU --top-ports 50 target.com
Query the top 50 UDP ports to quickly identify the most common datagram services.
nmap --script http-enum -p 80,443 target.com
Run the http-enum NSE script on ports 80 and 443 to inventory exposed web paths.
nmap -O --osscan-guess target.com
Enable OS detection with osscan-guess to improve matches for ambiguous fingerprints.
nmap -sA -p 1-1024 target.com
Send ACK probes across ports 1-1024 to map firewall rules and spot filtered services.
nmap -sN -Pn target.com
Run a NULL scan without host discovery to test stealth firewall handling.
nmap -sV --script ssl-enum-ciphers -p 443 target.com
Audit TLS services on 443 with ssl-enum-ciphers to report supported protocols and ciphers.
nmap -sS -T2 --max-retries 1 target.com
Run a throttled SYN scan with minimal retries to stay under intrusion-detection thresholds.
nmap -sT --max-rate 100 target.com
Use a TCP connect scan with a conservative rate when raw sockets are unavailable.
nmap -sU -p 123,137,161,500 target.com
Check common infrastructure UDP services including NTP, NetBIOS, SNMP, and IKE.
nmap -sO target.com
Enumerate supported IP protocols with an IP protocol scan.
nmap -sI zombie.example.com target.com
Perform an idle scan using a zombie host to hide your source address.
nmap -sW target.com
Send TCP window probes to differentiate open and closed ports on certain stacks.
nmap -A --traceroute target.com
Run OS, version, script, and traceroute scans in one aggressive profile.
nmap -sV --script banner target.com
Grab service banners with the banner NSE script alongside version detection.
nmap -sV --script smb-enum-shares -p 445 target.com
Enumerate SMB shares on 445 with the smb-enum-shares NSE script.
nmap -sV --script ftp-anon -p 21 target.com
Test FTP services for anonymous login support using ftp-anon.
nmap -Pn --top-ports 100 target.com
Scan the 100 most common ports without host discovery for rapid assessments.
nmap -sV --script dns-brute target.com
Enumerate subdomains with the dns-brute NSE script.
nmap -sV --script http-title target.com
List HTTP titles across discovered web services with http-title.
nmap -sS -sV --script vuln target.com
Run a version scan with the vuln script batch to flag common CVEs.
nmap -Pn -p 1-1000 --max-retries 1 --min-rate 200 target.com
Fast stealth scan across the first 1000 TCP ports without host discovery.
nmap -sU --top-ports 25 --max-retries 2 target.com
Probe the top 25 UDP services with minimal retries.
nmap -sV --script banner,smb-os-discovery 10.0.0.0/24
Collect service banners and SMB OS details across a /24.
nmap -sS --script firewall-bypass --data-length 200 target.com
Attempt to dodge stateless filters by padding SYN probes.
nmap -sT --max-parallelism 10 --host-timeout 30m 192.168.100.0/24
TCP connect scan on a /24 with controlled parallelism and host timeout.
nmap -sA -p 20-1024 edge.firewall.local
Use ACK scans to map firewall rules across low TCP ports.
nmap -sN -p 80,443,8080 dmz.proxy.local
Send NULL scans against proxy ports to test filtering behavior.
nmap -sS -p 80 --script http-methods --script-args http-methods.url-path=/app target.com
Enumerate enabled HTTP verbs against /app.
nmap -sS --script http-title,http-server-header -iR 30
Grab page titles and server headers from 30 random hosts.
nmap -sS --script smb-enum-shares,smb-enum-users 10.10.10.0/27
Audit SMB shares and user accounts across a small subnet.
nmap -sS --script smb-enum-processes --script-args smbusername=admin,smbpassword=Password1! winfiles.local
List Windows processes over SMB using supplied credentials.
nmap -sU --script snmp-info,snmp-brute 10.20.0.0/24
Probe SNMP devices for info leaks and weak communities.
nmap -sV --script ssl-enum-ciphers --script-args ssl-enum-ciphers.check_reuse=1 secure.example.com
Audit TLS cipher suites and check for key reuse.
nmap -sV --script ssh-auth-methods 192.168.1.0/26
Enumerate SSH authentication methods across a /26.
nmap -sV --script ftp-anon,ftp-bounce ftp.gateway.local
Test FTP servers for anonymous access and bounce attacks.
nmap -sS --traceroute -T4 corp.gateway.local
Run a rapid TCP SYN scan with an in-line traceroute.
nmap -sV -p 161 --script snmp-processes,snmp-sysdescr routers.example.com
Gather SNMP process and system description information.
nmap -sS -p 1883,8883 --script mqtt-subscribe --script-args topic=sensors/# iot-broker.local
Check MQTT brokers for open topics and TLS endpoints.
nmap -sS --data-length 140 --badsum target.com
Send padded SYN packets with bad checksums to test inspection evasion.
nmap -sS -p 0-65535 --reason --min-rate 500 --max-retries 2 bigserver.local
Aggressive full TCP port scan showing reasons for states.
nmap -sS -p 22 --script ssh-hostkey --script-args ssh_hostkey=full 10.1.5.0/24
Collect SSH host keys for trust auditing across a subnet.
nmap -sS -p 161 --script snmp-brute --script-args snmp-brute.communities='public,private,secret' net-mgmt.local
Brute-force SNMP communities with a custom list.
nmap -sS --script http-headers,http-security-headers target.com
Review HTTP response headers and security directives.
nmap -sS --script http-robots.txt --script-args http.useragent='Mozilla/5.0' target.com
Check for hidden directories via robots.txt with a custom agent.
nmap -sS --script dns-brute --script-args dns-brute.domain=example.com resolver.example.com
Enumerate subdomains with the dns-brute NSE script.
nmap -sS -p 5900-5905 --script vnc-info,vnc-title 10.40.0.0/25
Enumerate VNC services and grab window titles across a /25.
nmap -sS -p 3306 --script mysql-info mysql.db.local
Query MySQL server information via NSE.
nmap -sS --script ms-sql-info,ms-sql-brute 10.50.10.0/27
Identify and brute-force Microsoft SQL servers.
nmap -sS --script smb-vuln-ms17-010 172.16.10.0/24
Test hosts for the EternalBlue SMB vulnerability.
nmap -sS --script smb-vuln-ms10-054,smb-vuln-ms10-061 172.16.20.0/24
Check SMB hosts for historic MS10 vulnerabilities.
nmap -sS --script http-enum --script-args http-enum.category=sensitive target.com
Scan for sensitive web resources using NSE.
nmap -sS -p 80,443 --script http-mobileversion-check target.com
Discover mobile variants of the website via User-Agent switching.
nmap -sS --script http-waf-detect target.com
Probe for the presence of common web application firewalls.
nmap -sS --script http-waf-detect --script-args http-waf-detect.aggro=1 target.com
Use aggressive checks to fingerprint WAF vendors.
nmap -sS --script smb-security-mode 10.60.0.0/25
Report SMB signing and security mode across Windows hosts.
nmap -sS --script smb-enum-domains 10.60.0.0/25
Enumerate Windows domains via SMB.
nmap -sS --script smb-enum-groups 10.60.0.0/25
Pull Windows domain groups from SMB servers.
nmap -sS --script smb-enum-sessions 10.60.0.0/25
List active SMB sessions on remote hosts.
nmap -sS --script smb-enum-services 10.60.0.0/25
Enumerate Windows services via SMB.
nmap -sS --script smb-brute --script-args userdb=users.txt,passdb=passes.txt 10.60.0.0/25
Run an SMB login brute-force with supplied dictionaries.
nmap -sS --script smtp-enum-users --script-args smtp-enum-users.methods=VRFY target.com
Enumerate SMTP users using VRFY commands.
nmap -sS --script smtp-open-relay target.com
Test mail servers for open relay vulnerabilities.
nmap -sS --script ajp-auth,ajp-brute -p 8009 webcluster.local
Audit Apache JServ Protocol connectors for weak credentials.
nmap -sT -p 2049 --script nfs-ls,nfs-showmount storage.nfs.local
List NFS exports and directory contents.
nmap -sS --script oracle-sid-brute --script-args oracle-sid-brute.sidfile=sids.txt 10.70.0.0/24
Enumerate Oracle SID names using a supplied wordlist.
nmap -sS --script oracle-tns-version 10.70.0.10
Identify Oracle TNS listener versions and features.
nmap -sS -p 2181 --script zookeeper-info 10.80.0.0/26
Gather Apache ZooKeeper cluster metadata.
nmap -sS -p 2375 --script docker-version 10.80.0.0/26
Check Docker daemons for remote API exposure.
nmap -sS --script redis-info 10.80.0.0/26
Inspect unauthenticated Redis instances for summary info.
nmap -sS --script mongodb-info 10.80.0.0/26
Probe MongoDB servers for version and build identifiers.
nmap -sS --script elasticsearch-http-info 10.80.0.0/26
Collect exposed Elasticsearch cluster information.
nmap -sS --script rabbitmq-info 10.80.0.0/26
Query RabbitMQ management ports for queue metadata.
nmap -sS --script ncp-enum-users 192.168.90.0/27
Enumerate Novell NetWare users via NCP.
nmap -sS --script ike-version 198.51.100.0/28
Detect IKE VPN endpoints and their supported versions.
nmap -sS --script dns-zone-transfer --script-args dns-zone-transfer.domain=corp.local dns.corp.local
Attempt DNS zone transfers for corp.local.
nmap -sS --script dns-cache-snoop --script-args dns-cache-snoop.mode=timed targetns.local
Enumerate cached DNS entries via timing side-channel.
nmap -sS --script http-slowloris-check target.com
Test web servers for Slowloris DoS susceptibility.
nmap -sS --script http-stored-xss --script-args http-stored-xss.url=/comments target.com
Probe comment forms for stored XSS vulnerabilities.
nmap -sS --script http-headers,http-security-headers -p 80,443 target.com
Review HTTP response headers for missing security controls.
nmap -sV --script http-vuln-cve2017-5638 --script-args http-vuln-cve2017-5638.uri=/struts2-showcase.action target.com
Probe Apache Struts endpoints for CVE-2017-5638 remote code execution.
nmap -sV --script ssh2-enum-algos -p 22 target.com
Enumerate SSH algorithms to highlight weak key exchange and cipher suites.
nmap -sV --script smb-vuln-cve-2020-0796 -p 445 target.com
Test SMB services for the SMBGhost CVE-2020-0796 vulnerability.
nmap -sV --script mysql-info -p 3306 db.internal
Fingerprint MySQL services and report exposed metadata and capabilities.
nmap -sV --script ldap-rootdse -p 389 dc.internal
Query LDAP root DSE entries to enumerate naming contexts and features.
nmap -sV --script vulners --script-args mincvss=7.0 target.com
Enumerate CVEs rated 7.0+ using the vulners vulnerability feed.
nmap -6 -sT -p 22,80,443 2001:db8:100::/56
Discover IPv6 SSH and web services across a /56 network segment.
nmap -sS --script rdp-enum-encryption -p 3389 target.com
Audit Remote Desktop encryption strength and supported security layers.
nmap -sU --script broadcast-dhcp-discover
Discover rogue DHCP servers by broadcasting DHCP discover probes.
nmap -sS -p 25 --script smtp-vuln-cve2011-1720 mail.example.com
Check Postfix servers for the CVE-2011-1720 STARTTLS downgrade flaw.
nmap -sU -p 161 --script snmp-ios-config,snmp-interfaces core-switch.local
Pull IOS configuration details and interface stats from SNMP-enabled switches.
nmap -sV --script http-shellshock --script-args uri=/cgi-bin/status target.com
Test CGI handlers for Shellshock command execution exposure.
nmap -sV --script ssl-heartbleed -p 443 target.com
Detect Heartbleed (CVE-2014-0160) vulnerabilities on TLS services.
nmap -sV --script smb-vuln-cve-2017-7494 -p 445 target.com
Check Samba servers for the remote code execution flaw CVE-2017-7494.
nmap -sV --script http-winrm-info -p 5985 target.com
Enumerate Windows Remote Management capabilities and authentication modes.
nmap -sV --script bacnet-info -p 47808 10.40.0.0/24
Profile BACnet building automation devices across the control network.
nmap -sV --script modbus-discover -p 502 10.50.0.0/24
Enumerate Modbus controllers and capabilities in industrial segments.
nmap -sV --script ssl-cert -p 443 secure.example.com
Pull the presented X.509 certificate so you can inspect names, issuer, and validity dates quickly.
nmap -sV --script http-methods --script-args http-methods.url-path=/ -p 80,443 target.com
Enumerate allowed HTTP methods to spot dangerous verbs such as PUT, DELETE, or TRACE.
nmap -sV --script smb-os-discovery -p 445 target.com
Identify SMB hosts, operating system details, and NetBIOS naming information on port 445.
nmap -sV --script http-auth-finder -p 80,443 target.com
Search web targets for authentication prompts and protected application paths.
nmap -sU -p 69 --script tftp-enum target.com
Enumerate TFTP services on UDP 69 to see whether trivial file transfer is exposed.
nmap -sS --open -p 22,80,443,3389 target.com
Show only open ports across the selected set so the output stays focused on reachable services.
nmap -sS -sV --version-all --reason target.com
Force deeper version probing and include reasons for the findings during service detection.
nmap -sn -PE -PA80,443 10.0.0.0/24
Combine ICMP and ACK host discovery probes to find systems that ignore simple echo requests.
nmap -sU -p 53,123,161,500,4500 target.com
Check the most common critical UDP infrastructure ports in one targeted sweep.
nmap -6 -sS -p 80,443,8443 2001:db8:100::/64
Probe common HTTPS and alternate web ports across an IPv6 range.
nmap --script ssl-date -p 443 target.com
Compare the remote TLS service clock with your scanner to catch certificate time drift.
nmap -sS --scan-delay 1s --max-rate 50 target.com
Throttle packet rate deliberately for quieter scans against fragile or rate-limited targets.