NMAPRSALL(1)

NAME
nmaprsall - the nmaprs comprehensive reference (target selection, discovery, every scan technique, timing & performance, evasion, OS detection, version scan, output, parity matrix vs nmap, examples)

OVERVIEW
This is the all-in-one nmaprs manual, modeled on zshall(1). It concatenates the major sections of the nmaprs reference into a single page so you can grep with `/`:

    1. INVOCATION — binaries (nmaprs, nms), privilege auto-detect, target syntax
    2. TARGET SELECTION — -iL, -iR, --exclude, --excludefile, IPv4/IPv6/CIDR/range
    3. HOST DISCOVERY — -sL, -sn, -Pn, -PS/PA/PU/PY/PE/PP/PM/PR, --dns-servers
    4. SCAN TECHNIQUES — -sT, -sS, -sU, -sY/sZ SCTP, -sA/sW, -sN/sF/sX/sM, -sO, -sI, -b
    5. PORT SPECIFICATION — -p, -F, -r, --top-ports, --port-ratio, --exclude-ports
    6. SERVICE / VERSION / SCRIPT — -sV, --version-intensity, --script, -sC, --script-help
    7. OS DETECTION — -O, --osscan-limit, --osscan-guess, --max-os-tries
    8. TIMING & PERFORMANCE — -T0..T5, --min/max-rate, parallelism, hostgroup, RTT, retries
    9. FIREWALL / IDS EVASION — -g, --ttl, --badsum, -D decoys, -S spoof, --data*, -f/--mtu, --spoof-mac
    10. PROXY — --proxies / --proxy (SOCKS4 + HTTP CONNECT)
    11. OUTPUT — -oN/-oG/-oX/-oA/-oS/-oM/-oH, --stylesheet, --webxml, --resolve-all
    12. MISC — -6, -A, --resume, --iflist, --privileged / --unprivileged
    13. PARITY MATRIX — implemented / partial / planned vs upstream nmap
    14. ENVIRONMENT
    15. FILES
    16. EXIT STATUS
    17. EXAMPLES
    18. SECURITY / ETHICS

For a shorter quick-reference page see nmaprs(1).

NAME
nmaprs, nms - high-performance parallel network scanner with nmap-compatible CLI surface (Rust)

SYNOPSIS
nmaprs [OPTIONS] [TARGETS]
nms [OPTIONS] [TARGETS]

nms is the shorter form of nmaprs — same binary, quicker to type.

DESCRIPTION
nmaprs is a Rust-native network scanner that speaks nmap(1)'s CLI dialect (nmap --help plus the long-option set from upstream nmap.cc, e.g. --resolve-all, --defeat-rst-ratelimit, --versiondb, -oM/-oH, --vv, --proxy as an alias of --proxies).

Wired at the packet level for raw TCP scans: evasion flags (-g source port, --ttl, --badsum, -D decoys, -S source spoofing, --data/--data-string/--data-length, -f/--mtu fragmentation).

--proxies routes TCP-connect scans through SOCKS4 or HTTP CONNECT proxies. --dns-servers resolves targets via custom DNS servers via hickory-resolver. --spoof-mac spoofs the source MAC on ARP discovery frames. --stats-every prints periodic scan progress with ETC and probes/sec.

Multiple -iL lines and CLI targets resolve in parallel (order preserved) with the same --max-parallelism/--min-parallelism/timing template cap as port probes.

nmaprs is not a byte-for-byte reimplementation of nmap. The full NSE Lua runtime is not embedded; OS detection is partial (IPv4 raw probes + MatchPoints scoring against nmap-os-db; IPv6 TTL heuristic only). For authoritative behavior use nmap(1).

1. INVOCATION
With no flags, nmaprs performs a TCP-connect scan (-sT) of nmap's default top-1000 TCP ports against the given TARGETS.

Privilege auto-detection: on startup nmaprs calls geteuid(2); when not root it downgrades from raw SYN (-sS) to TCP connect (-sT) and rejects raw-only modes (-sO, -sI, SCTP). Use --privileged to force raw mode (kernel may still reject without CAP_NET_RAW) or --unprivileged to force connect mode even as root.

Target syntax (same as nmap):

hostname | scanme.nmap.org
IPv4 | 192.168.1.1
IPv6 | 2001:db8::1 (requires -6)
CIDR v4 | 10.0.0.0/24
CIDR v6 | 2001:db8::/64
range | 10.0.0.1-100 or 10.0.0-255.1

2. TARGET SELECTION

--iL FILE
    Read targets, one per line, from FILE. Multiple -iL flags merge in parallel (order preserved).

--iR NUM
    Pick NUM random hosts.

--exclude TARGETS
    Comma-separated hosts/networks to skip.

--excludefile FILE
    File with hosts/networks to skip (one per line).

--resolve-all
    By default DNS returns one address (nmap's "first only"). Pass this to scan every resolved address per name.

3. HOST DISCOVERY

-sL List-scan only — do not send probes.

-sn Ping scan: skip the port scan. Per-host raw ICMP echo via pnet (privileged), falls back to system ping(8) / ping6(8). Output paths (-oN, -oG, -oX, -oS) write host-up lines like the port-scan path.

-Pn, --no-ping
    Treat all hosts as online; skip discovery entirely.

-PS[PORTLIST]
    TCP SYN discovery on the given ports (default 80, 443).

-PA[PORTLIST]
    TCP ACK discovery (RST/SYN-ACK indicates up).

-PU[PORTLIST]
    UDP discovery probe (default port 40125).

-PY[PORTLIST]
    SCTP INIT discovery (default port 80). Same raw SCTP engines as -sY.

-PO[PROTOS]
    IP-protocol ping (default 1,2,4). Same engines as -sO. Host is up if any probe is open or closed.

-PE ICMP echo.

-PP ICMP timestamp request (IPv4, Unix raw ICMP).

-PM ICMP address-mask request (IPv4, Unix raw ICMP).

-PR ARP ping. Auto-runs for local-subnet IPv4 hosts; disable with --disable-arp-ping.

-n  Never resolve DNS.

-R  Always resolve DNS (default: only for live hosts).

--dns-servers SERVERS
    Comma-separated IPs of custom DNS resolvers (uses hickory-resolver instead of the system stub).

--system-dns
    Force the system resolver.

--traceroute
    Trace hop path to each host using the system traceroute(8) / tracert binary. Up to min(parallelism, 32) hosts run concurrently; output stays in target order.

4. SCAN TECHNIQUES

  TCP connect (-sT)
Default when unprivileged. Async, parallel, timeout-bound.

  TCP SYN (-sS)
Default when privileged. Raw IPv4 + IPv6 TCP via pnet: RST → closed, SYN/ACK → open. Pipelined per family with dedicated recv thread + main-thread sends; sharded across up to 16 concurrent pipelines per family (bounded by effective_probe_concurrency()). Mixed v4+v6 targets run both families concurrently via tokio::join. Falls back to TCP connect per address family on raw failure.

  TCP NULL / FIN / Xmas / Maimon (-sN / -sF / -sX / -sM)
Same raw sharded pipeline as -sS. Maimon sends FIN+ACK.

  TCP ACK (-sA)
Firewall mapping. RST → unfiltered, no reply → filtered. No TCP connect fallback on raw failure (connect can't produce ACK-scan states).

  TCP Window (-sW)
Same ACK probes; RST with non-zero TCP window → open, RST with zero window → closed (BSD-derived stacks); no reply → filtered.

  UDP (-sU)
Reply → open. Raw ICMP listener (privileged) classifies destination unreachable codes: port-unreachable → closed; other unreachable (IPv4 type 3 / ICMPv6 type 1) → filtered. Unix uses one poll(2) + burst-recv thread when both IPv4 and IPv6 targets are in play. closed wins over filtered. With --min-hostgroup/--max-hostgroup, ICMP listener threads start once per scan (not per batch).

  SCTP INIT / COOKIE_ECHO (-sY / -sZ)
CRC32c SCTP segments. IPv4 Layer-3 full datagrams; IPv6 raw SCTP (protocol 132) like IPv6 TCP. Pipelined recv + up to 16 shards per family. Mixed v4+v6 runs both engines concurrently (tokio::join). INIT-ACK / COOKIE-ACK → open, ABORT → closed. Privileged raw socket.

  Idle scan (-sI ZOMBIE[:PROBEPORT])
Spoofed TCP SYN (source = zombie) toward targets; sequential IP-ID sampling on the zombie (RST to a closed probe port, default 65535) so global IP-ID deltas stay interpretable. Delta ≥ 2 → open, else closed; probe / RST failures → filtered. IPv4 only; privileged raw send.

  FTP bounce (-b user:pass@host:port)
Parallel buffer_unordered sessions (one control connection per probe). IPv4 only (PORT). Maps 150/125/250 vs 425/426/421 to open/closed; misconfigured/strict servers may return filtered.

  IP protocol (-sO)
IPv4: raw IPv4 headers; ICMPv4 protocol-unreachable (type 3 code 2) → closed. IPv6 (Unix): raw IPv6 (IPPROTO_RAW + IPV6_HDRINCL) with Next Header = probe; ICMPv6 Parameter Problem type 4 code 1 → closed. Mixed v4+v6 runs both engines concurrently. Sharded recv + up to 16 pipelines per family. -p takes protocol numbers 0..=255; omit -p to probe all 256. -F limits protocols to nmap-protocols (embedded as data/nmap_ip_protocols_fast.txt), matching nmap's [P:0-] fast selection.

  Combined scans (-sS -sU, etc.)
Multiple scan types run sequentially in one pass (e.g. SYN + UDP).

  --scanflags FLAGS
Custom TCP flag set for raw TCP scans. Names: SYN, ACK, FIN, RST, PSH, URG, ECE, CWR. Separators: space, comma, pipe, or glued (e.g. SYNACK). Sequence/ack numbers follow nmap-style rules for SYN vs ACK probes; recv classification still follows the selected scan type. Ignored (warning) when scan type isn't raw TCP.

5. PORT SPECIFICATION

-p PORTS
    Port ranges (1-65535, 22,80,443, U:53,T:22 ). -p - shorthand for all 65536.

--exclude-ports PORTS
    Skip these ports (ignored when --allports is set).

-F  Fast: nmap's top-100 frequency list.

-r  Scan sequentially (don't randomize).

--top-ports N
    Scan the N highest-ratio ports.

--port-ratio RATIO
    Scan ports whose nmap frequency is at least RATIO.

6. SERVICE / VERSION / SCRIPT

-sV, --version-scan
    Load nmap-service-probes: TCP + UDP Probe blocks, with ports / sslports (TLS via rustls when port matches sslports), rarity vs --version-intensity, and match / softmatch with full template fields: p/ product, v/ version, i/ info, o/ OS, d/ device, cpe:/ CPE. Perl-only regex features omitted. Parallel per open port.

--version-intensity 0-9
--version-light
    (=2)
--version-all
    (=9)
--version-trace
    Increase or trace version-scan effort.

-sC Default built-in scripts (default + banner; Lua NSE not embedded).

--script EXPR
    Run specified built-in scripts (no Lua NSE).

--script-args ARGS
--script-args-file FILE
--script-trace
--script-updatedb
--script-help EXPR
    Compat shims for nmap parity (no Lua engine).

7. OS DETECTION

-O  IPv4 (privileged): raw Layer-3 probes + nmap-os-db MatchPoints scoring when --datadir has the DB and the scan found both open and closed TCP ports (and not --osscan-limit with no open TCP). Falls back to ICMP TTL + Class titles from the legacy DB parse. IPv6: TTL-style guess only (no raw OS probe engine yet).

--osscan-limit
    Skip OS pass when no open TCP ports.

--osscan-guess
    (--fuzzy) Limit examples / show probable matches.

--max-os-tries N
    Maximum OS detect tries.

8. TIMING & PERFORMANCE

--timing 0-5
-T 0-5
    Timing template: T0 paranoid, T1 sneaky, T2 polite, T3 normal, T4 aggressive, T5 insane.

--min-rate N
    Send at least N probes/second. Must be ≤ --max-rate when both set. Without --max-parallelism, parallelism is raised toward min(min-rate, 65535) when that exceeds the timing template.

--max-rate N
    Global cap on probe starts per second (TCP connect, UDP, raw half-open TCP, SCTP, IP protocol; mixed IPv4+IPv6 share one limiter).

--min-parallelism N
-M, --max-parallelism N
    Concurrent probe count bounds.

--min-hostgroup N
--max-hostgroup N
    Split resolved host list into batches before building port work. Omit both: scan all hosts in one batch. Set only one: the other defaults to 1 or 1024 (nmap-style). When both differ: uniform random in [min,max] (last batch may be smaller). --resume filters per batch and merges at end.

--host-timeout TIME
    Per-host wall clock from first probe. Remaining ports become filtered with reason host-timeout (TCP connect, UDP, raw half-open TCP, IP protocol; mixed v4+v6 share one per- IpAddr clock).

--max-retries N
    Extra attempts after probe timeout. Total tries = 1 + N. Applies to TCP connect, UDP, raw half-open TCP, IP protocol, FTP bounce, SCTP, idle scan. Retry rounds omit scan-delay and rate pacer.

--min-rtt-timeout TIME
--max-rtt-timeout TIME
--initial-rtt-timeout TIME
    RTT bounds for adaptive probe timeout. max ≥ min required when both set.

--scan-delay TIME
--max-scan-delay TIME
    Per-probe delay before send/connect: fixed scan-delay, or uniform random in [scan-delay,max-scan-delay] when both set. max ≥ min required.

--defeat-rst-ratelimit
    Reduce wait for RST replies from rate-limited hosts.

--defeat-icmp-ratelimit
    Reduce wait for ICMP replies from rate-limited hosts.

--nsock-engine ENGINE
--nmaprs-engine ENGINE
    Reserved for nmap parity.

--stats-every TIME
    Periodic scan progress to stderr (% done, ETC, probes/sec). Per-probe granularity for TCP connect.

9. FIREWALL / IDS EVASION
All evasion flags below are wired at the packet level for raw TCP scans.

-g PORT
--source-port PORT
    Spoof source port (default fast SYN scans use random high port).

--ttl VAL
    Set IP TTL.

--badsum
    Use a bad TCP/UDP/SCTP checksum (firewall vs end-host fingerprint).

-D DECOY1,DECOY2,...,ME,...
    Decoy cloaking. ME inserts your real source at that position.

-S IP
    Spoof source IP. Combine with -e iface when needed.

--data HEX
--data-string TEXT
--data-length N
    Append payload to packets (random when only --data-length is set).

-f  Use small fragments (8-byte payload chunks).

--mtu VAL
    Custom fragmentation MTU.

--spoof-mac MAC
    Spoof source MAC on ARP discovery frames (full MAC, prefix, or vendor name).

-e IFACE
    Force use of a specific interface.

10. PROXY

--proxies URLS
--proxy URLS
    Comma-separated proxy URLs for TCP-connect scans. Supports socks4:// and http:// (HTTP CONNECT). Example: socks4://127.0.0.1:1080,http://10.0.0.1:8080

11. OUTPUT

-oN FILE
    Normal (human-readable) output.

-oG FILE
    Grepable output (one host per line).

-oX FILE
    XML output. Root <nmaprun> with <scaninfo>, <host>, <status>, <address>, <hostnames>, <ports>, <extraports>, <service>, <runstats> — nmap-compatible.

-oA BASE
    Write BASE.{nmap,gnmap,xml} in one go.

-oS FILE
    Script-kiddie output (1337-speak mirror of -oN; stdout stays normal).

-oM FILE
    Machine-readable (currently same lines as -oG).

-oH FILE
    Placeholder hex output (full hex capture not implemented).

--stylesheet URL
--webxml
--no-stylesheet
    XML preamble / xml-stylesheet PI control when -oX is used.

--append-output
    Append to output files instead of clobber.

12. MISC

-6  IPv6 targets and scans (including raw SYN when privileged).

-A  Aggressive: -O + -sV + -sC + --traceroute. Not full nmap NSE/Lua.

--resume FILE
    Resume from JSON checkpoint of completed (host, port). Applies to TCP connect, UDP, raw half-open TCP, IP protocol scan (remaining pairs only after the checkpoint).

--iflist
    List interfaces via if-addrs.

--privileged
    Force raw mode (kernel may still reject without root / CAP_NET_RAW).

--unprivileged
    Force TCP connect mode even as root; rejects raw-only modes (-sO, -sI, SCTP).

--allports
    Ignore --exclude-ports when set.

--datadir PATH
    Override the default ./data directory for nmap reference files (nmap-services, nmap-service-probes, nmap-os-db, nmap-protocols). Also honors the NMAPDIR env var.

--versiondb PATH
    Specific version probe database file.

-v, --vv
    Increase verbosity.

-d  Increase debug level. Repeatable.

-h, --help
    Print help.

-V, --version
    Print version.

13. PARITY MATRIX
Status vs upstream nmap(1). See README for the full table; abridged below.

TCP connect (-sT) | Implemented
TCP SYN raw (-sS, IPv4 + IPv6) | Implemented (privileged)
TCP NULL/FIN/Xmas/Maimon | Implemented (raw, sharded pipeline)
TCP ACK / Window (-sA / -sW) | Implemented (no connect fallback)
UDP (-sU) | Implemented (raw ICMP listener for unreach)
SCTP INIT / COOKIE-ECHO (-sY / -sZ) | Implemented (IPv4 + IPv6, CRC32c)
Idle scan (-sI) | Implemented (IPv4 only, sequential IP-ID)
FTP bounce (-b) | Implemented (IPv4 only)
IP protocol (-sO) | Implemented (IPv4 + IPv6 on Unix)
Ping scan (-sn) | Implemented
Host discovery (-PS/-PA/-PU/-PY/-PO/-PE/-PP/-PM/-PR) | Implemented
ARP ping (-PR, local IPv4) | Implemented (auto)
IPv6 (-6) | Implemented
-iL / -iR | Implemented
--resume | Implemented (TCP connect, UDP, raw, IP-proto)
--traceroute | Implemented (system traceroute, concurrent)
-O OS detection | Partial (IPv4 raw + DB scoring; IPv6 TTL heuristic)
-A aggressive bundle | Implemented (no NSE/Lua)
-sV service/version | Partial (no Perl-only regex; rest implemented)
--script / -sC | Partial (default + banner builtins; no Lua NSE)
--iflist | Implemented
--host-timeout | Implemented
--max-retries | Implemented (omits scan-delay / rate pacer on retry)
--min-rtt / --max-rtt / --initial-rtt timeout | Implemented
--scan-delay / --max-scan-delay | Implemented
--max-rate / --min-rate | Implemented (one global limiter)
--min-hostgroup / --max-hostgroup | Implemented
--scanflags | Implemented (raw TCP scans only)
Port specs (-p, -F, --top-ports, --port-ratio) | Implemented
Evasion (-g, --ttl, --badsum, -D, -S, --data*, -f / --mtu, --spoof-mac) | Implemented (packet-level)
--proxies / --proxy | Implemented (SOCKS4 + HTTP CONNECT)
--dns-servers | Implemented (hickory-resolver)
Auto privilege detection | Implemented
-oN, -oG, -oX, -oA, -oS | Implemented (nmap-compatible XML)
-oM | Partial (same as -oG)
-oH | Partial (placeholder)
--stylesheet / --webxml / --no-stylesheet | Partial
--resolve-all | Implemented
--unprivileged / --privileged | Implemented
--allports | Implemented
--osscan-limit / --osscan-guess / --max-os-tries | Partial
--script-timeout | Partial
--stats-every | Implemented
NSE Lua runtime | Not implemented

If you need authoritative nmap NSE/OS-DB behavior, use nmap(1).

14. ENVIRONMENT

NMAPDIR
    Override the default --datadir search path for nmap reference files.

NO_COLOR
    Suppress ANSI color in terminal output.

RUST_LOG
    Log filter (see tracing-subscriber's EnvFilter).

15. FILES

./data/nmap-services
    TCP/UDP service-port frequency list.

./data/nmap-service-probes
    Service / version probe definitions.

./data/nmap-os-db
    OS fingerprint database.

./data/nmap-protocols
    IP-protocol number/name list.

./data/nmap_ip_protocols_fast.txt
    Embedded fast-mode protocol shortlist for -sO -F.

nmaprs.checkpoint.json
    Default checkpoint path for --resume.

/usr/local/share/man/man1/nmaprs.1
    Short reference man page.

/usr/local/share/man/man1/nmaprsall.1
    This man page.

16. EXIT STATUS

0   Scan completed (regardless of host/port states).

1   Invalid CLI usage, missing privileges, or fatal I/O error.

2   At least one target failed DNS resolution.

17. EXAMPLES

Basic TCP connect of common ports:
    nmaprs scanme.nmap.org

Quick top-100 port SYN scan against a /24 (privileged):
    sudo nmaprs -sS -F 192.168.1.0/24

Full TCP port range (1-65535) with version + OS detection:
    sudo nmaprs -sS -p - -sV -O scanme.nmap.org

Aggressive scan, all three output formats:
    sudo nmaprs -A -T4 target -oA scan-results

UDP scan of top 100 ports through a SOCKS4 proxy:
    nmaprs -sU --top-ports 100 --proxies socks4://127.0.0.1:1080 target

Idle scan via a zombie host:
    sudo nmaprs -sI zombie.example.com:65535 target

FTP bounce:
    nmaprs -b anonymous@ftp.example.com 10.0.0.0/24

SCTP INIT scan:
    sudo nmaprs -sY -p 80,443 sctp-host

IP-protocol scan of all 256 protocols (Unix, privileged):
    sudo nmaprs -sO target

Custom DNS resolvers + custom user-agent style payload:
    nmaprs --dns-servers 1.1.1.1,8.8.8.8 --data-length 64 target

NULL scan with custom TCP flags + fragmentation + spoofed source port:
    sudo nmaprs -sN --scanflags "FIN URG PSH" -f -g 53 target

Decoy cloaking + spoofed source IP + TTL evasion:
    sudo nmaprs -sS -D RND:5,ME -S 192.0.2.1 --ttl 33 -e eth0 target

ARP-only host discovery on a local subnet:
    sudo nmaprs -sn -PR 192.168.1.0/24

Read targets from file, exclude one subnet, write grepable output:
    sudo nmaprs --iL targets.txt --exclude 10.0.0.0/16 -oG out.gnmap

IPv6 SYN scan with all-ports timing template T4:
    sudo nmaprs -6 -sS -p - -T4 2001:db8::1

Resume an interrupted scan:
    sudo nmaprs --resume nmaprs.checkpoint.json

Periodic progress + per-host timeout cap:
    sudo nmaprs -sS --stats-every 30s --host-timeout 5m target

Rate-limited polite scan (T1 + min/max-rate):
    sudo nmaprs -sS -T1 --min-rate 10 --max-rate 100 target

List interfaces:
    nmaprs --iflist

18. SECURITY / ETHICS
Run only against networks and hosts you own or have explicit written permission to scan. Unauthorized scanning is illegal in many jurisdictions. The author and contributors disclaim responsibility for misuse.

SEE ALSO
nmaprs(1), nmap(1), masscan(1), zmap(1), lsofrsall(1), iftoprsall(1), strykeall(1), zshrsall(1)

AUTHORS
Jacob Menke <https://github.com/MenkeTechnologies>

BUGS
Report bugs at https://github.com/MenkeTechnologies/nmaprs/issues.