Specifying Target Hosts and Networks (2024)

Passing a huge list of hosts is often awkward on the commandline, yet it is a common need. For example, your DHCP server mightexport a list of 10,000 current leases that you wish to scan. Ormaybe you want to scan all IP addresses exceptfor those ones to locate hosts using unauthorized static IP addresses. Simplygenerate the list of hosts to scan and pass that filename to Nmap asan argument to the -iL option. Entries can be in anyof the formats accepted by Nmap on the command line (IP address,hostname, CIDR, IPv6, or octet ranges). Each entry must be separatedby one or more spaces, tabs, or newlines. You can specify a hyphen(-) as the filename if you want Nmap to read hostsfromstandard inputrather than an actual file.

For Internet-wide surveys and other research, you may want tochoose targets at random. This is done with the -iRoption, which takes as an argument the number of IPs to generate.Nmap automatically skips certain undesirableIPs, suchas those in private, multicast, or unallocated address ranges. Theargument 0 can be specified for a never-endingscan. Keep in mind that some network administrators bristle atunauthorized scans of their networks. Carefully readthe section called “Legal Issues” before using -iR.

If you find yourself really bored one rainy afternoon, try thecommand nmap -sS -PS80 -iR 0 -p 80to locate random web servers for browsing.

It is common to have machines which you don't want toscan under any circ*mstances. Machines can be so critical that youwon't take any risk of an adverse reaction. You might be blamed for acoincidental outage even if the Nmap scan had nothing to do with it.Or perhaps you have legacy hardware that is known to crash whenscanned, but you haven't been able to fix or replace it yet. Or maybecertain IP ranges represent subsidiary companies, customers, orpartners that you aren't authorized to scan. Consultants often don'twant their own machine included in a scan of their client's networks.Whatever the reason, you can exclude hosts or entire networks with the--exclude option. Simply pass the option acomma-separated list of excluded targets and netblocks using thenormal Nmap syntax. Alternatively, you can create a file of excludedhosts/networks and pass that to Nmap withthe --excludefile option. The--exclude option doesn't mix with IP ranges that usecommas (192.168.0.10,20,30) because--exclude itself uses commas. Use--excludefile in these cases.

While some tools have simple interfaces that only allow a listof hosts or maybe let you specify the start and end IP addresses for arange, Nmap is much more powerful and flexible. But Nmap can also bemore difficult to learn—and scanning the wrong IP addresses isoccasionally disastrous. Fortunately, Nmap offers a dry run using thelist scan(-sL option).Simply executenmap -sL -n <targets> tosee which IPs would be scanned before you actually do it.

Examples may be the most effective way to teach the Nmap hostspecification syntax. This section provides some, starting with the simplest.