NMAPRS(1)

NAME
nmaprs, nms - parallel network scanner with nmap-compatible CLI

SYNOPSIS
nmaprs [OPTIONS] [TARGETS]
nms [OPTIONS] [TARGETS]

nms is the shorter form of nmaprs — same binary, quicker to type.

DESCRIPTION
nmaprs is a Rust-native network scanner that speaks nmap's CLI dialect (nmap--help plus the long-option set from upstream nmap.cc). It implements real TCP connect, UDP, ICMP ping discovery, raw IPv4 / IPv6 half-open TCP (SYN / NULL / FIN / Xmas / ACK / Window / Maimon), SCTP (INIT / COOKIE_ECHO), IP-protocol scan (-sO), idle scan (-sI), FTP bounce (-b), target lists / random hosts, IPv6, resume checkpoints, traceroute, and built-in Rust "scripts" for --script/-sC.

Targets, ports, and timing options accept the same syntax as nmap(1). Auto-detects root via geteuid(2) and falls back from SYN to TCP connect when unprivileged (use --privileged to force raw mode).

nmaprs is not a byte-for-byte reimplementation of nmap. The full NSE Lua runtime is not embedded; OS detection is partial (nmap-os-db MatchPoints scoring for IPv4 only). For authoritative behavior use nmap(1).

OPTIONS

  Target Selection

--iL FILE
    Input from list of hosts/networks.

--iR NUM
    Choose NUM random targets.

--exclude TARGETS
    Exclude hosts/networks (comma-separated).

--excludefile FILE
    Exclude list from FILE.

  Host Discovery

-sL List scan — simply list targets.

-sn Ping scan only (no port scan).

-Pn, --no-ping
    Treat all hosts as online; skip discovery.

-PS[PORTLIST]
    TCP SYN discovery on given ports.

-PA[PORTLIST]
    TCP ACK discovery.

-PU[PORTLIST]
    UDP discovery (default port 40125).

-PY[PORTLIST]
    SCTP INIT discovery (default port 80).

-PE ICMP echo.

-PP ICMP timestamp request.

-PM ICMP address mask request.

-PR ARP ping (auto on local IPv4 subnets; --disable-arp-ping to suppress).

-n  Never do DNS resolution.

-R  Always do DNS resolution.

--dns-servers SERVERS
    Use custom DNS resolvers (comma-separated IPs; hickory-resolver).

--system-dns
    Use the system resolver.

--traceroute
    Trace hop path to each host (concurrent; up to min(parallelism, 32) subprocesses).

  Scan Techniques

-sS TCP SYN scan (privileged raw; default when root).

-sT TCP connect scan (default when unprivileged).

-sU UDP scan.

-sY SCTP INIT scan.

-sZ SCTP COOKIE_ECHO scan.

-sA TCP ACK scan (firewall mapping).

-sW TCP Window scan.

-sN TCP NULL scan.

-sF TCP FIN scan.

-sX TCP Xmas scan.

-sM TCP Maimon scan.

-sO IP protocol scan.

-sI ZOMBIE[:PROBEPORT]
    Idle scan via a zombie host.

-b FTP
    FTP bounce scan (user:pass@host:port).

  Port Specification

-p PORTS
    Port ranges to scan (1-65535, 22,80,443, U:53,T:22 ). Use -p - for all 65536.

--exclude-ports PORTS
    Exclude these ports.

-F  Fast: scan fewer ports than default (top 100).

-r  Scan ports sequentially — don't randomize.

--top-ports N
    Scan the N highest-ratio ports.

  Service / Version / Script

-sV, --version-scan
    Probe open ports to determine service / version info.

--version-intensity 0-9
    Set version-scan intensity.

--version-light
    Equivalent to --version-intensity 2.

--version-all
    Equivalent to --version-intensity 9.

-sC Default scripts (built-in default + banner — Lua NSE not embedded).

--script EXPR
    Run specified built-in scripts.

  OS Detection

-O  Enable OS detection (IPv4: raw probes + nmap-os-db scoring when --datadir is set; IPv6: TTL heuristic).

--osscan-limit
    OS detect only against promising targets.

--osscan-guess
    (--fuzzy) Guess OS more aggressively.

  Timing & Performance

--timing 0-5
    Timing template (T0 paranoid → T5 insane).

-T 0-5
    Same as --timing.

--min-rate N
    Send at least N probes/second.

--max-rate N
    Cap probes at N per second.

--min-parallelism N
-M, --max-parallelism N
    Concurrent probe count bounds.

--min-hostgroup N
--max-hostgroup N
    Bound host group sizes; uniform random in [min,max] when both differ.

--host-timeout TIME
    Wall-clock per host.

--max-retries N
    Extra attempts after probe timeout.

--min-rtt-timeout TIME
--max-rtt-timeout TIME
--initial-rtt-timeout TIME
    RTT bounds for adaptive probe timeout.

--scan-delay TIME
--max-scan-delay TIME
    Per-probe delay (uniform random in range when both set).

--stats-every TIME
    Periodic progress to stderr (% done, ETC, probes/sec).

  Firewall / IDS Evasion

-g PORT
--source-port PORT
    Spoof source port.

--ttl VAL
    Set IP TTL.

--badsum
    Use bad TCP/UDP/SCTP checksum.

-D DECOY1,DECOY2,...
    Cloak scan with decoys.

-S IP
    Spoof source address.

--data HEX
--data-string TEXT
--data-length N
    Append payload to packets.

-f  Fragment packets (8-byte default).

--mtu VAL
    Custom fragmentation MTU.

--spoof-mac MAC
    Spoof source MAC on ARP frames.

  Proxy

--proxies URLS
--proxy URLS
    SOCKS4 / HTTP CONNECT proxies for TCP connect scans (comma-separated).

  Output

-oN FILE
    Normal output.

-oG FILE
    Grepable output.

-oX FILE
    XML output (<nmaprun> root, nmap-compatible).

-oA BASE
    Write all three formats to BASE.{nmap,gnmap,xml}.

-oS FILE
    Script-kiddie output.

-oM FILE
    Machine-readable (currently same as -oG).

--resolve-all
    Scan every resolved address (default: first only).

  Misc

-6  IPv6 targets and scans.

-A  Aggressive: -O + -sV + -sC + --traceroute.

--resume FILE
    Resume from JSON checkpoint.

--iflist
    List network interfaces.

--privileged
    Force raw mode.

--unprivileged
    Force TCP connect (no raw).

-v  Increase verbosity. May be repeated (-vv).

-d  Increase debug level. May be repeated.

-h, --help
    Print help.

-V, --version
    Print version.

EXAMPLES
TCP connect scan of common ports:
    nmaprs scanme.nmap.org

SYN scan + version detection + OS detection (privileged):
    sudo nmaprs -sS -sV -O scanme.nmap.org

Aggressive scan of /24 with grepable output:
    sudo nmaprs -A 192.168.1.0/24 -oG net.gnmap

UDP scan of top 100 ports through a SOCKS4 proxy:
    nmaprs -sU --top-ports 100 --proxies socks4://127.0.0.1:1080 target

Idle scan via a zombie:
    sudo nmaprs -sI zombie.example.com:65535 target

Read targets from file, write all three output formats:
    sudo nmaprs --iL targets.txt -oA scan-results

IPv6 SYN scan with fast (top-100) ports:
    sudo nmaprs -6 -sS -F 2001:db8::1

Resume an interrupted scan:
    sudo nmaprs --resume nmaprs.checkpoint.json

List interfaces:
    nmaprs --iflist

EXIT STATUS

0   Scan completed (regardless of host/port states).

1   Invalid CLI usage, required privileges missing, or fatal I/O error.

2   At least one target failed to resolve.

FILES

./data/nmap-services
./data/nmap-service-probes
./data/nmap-os-db
./data/nmap-protocols
    Nmap reference data (location override via --datadir or NMAPDIR env var).

nmaprs.checkpoint.json
    Default checkpoint path for --resume.

/usr/local/share/man/man1/nmaprs.1
/usr/local/share/man/man1/nmaprsall.1
    This man page + the full reference.

ENVIRONMENT

NMAPDIR
    Override the default --datadir search path for Nmap reference files.

NO_COLOR
    Suppress ANSI color in terminal output.

SEE ALSO
nmaprsall(1), nmap(1), masscan(1), zmap(1), lsofrsall(1), strykeall(1)

AUTHORS
Jacob Menke <https://github.com/MenkeTechnologies>

BUGS
Report bugs at https://github.com/MenkeTechnologies/nmaprs/issues.

SECURITY / ETHICS
Run only against networks and hosts you own or have explicit written permission to scan. Unauthorized scanning is illegal in many jurisdictions.