nmap

Option	Explanation
`-sL`	List scan - list targets without scanning
`-sn`	Ping scan - host discovery only
`-sT`	TCP connect scan - complete three-way-handshake
`-sS`	TCP SYN - only first step of the three-way-handshake
`-sU`	UDP scan
`-F`	Fast mode - scans the 100 most common ports
`-p[range]`	Specifies a range of port numbers (-p- scans all the ports)
`-Pn`	Treat all hosts as online - scan hosts that appear to be down
`-O`	OS detection
`-sV`	Service version detection
`-A`	OS detection, version detection, and other additions
`-T<0-5>`	Timing template see here
`--min-parallelism <numprobes>` and `--max-parallelism <numprobes>`	Minimum and maximum number of parallel probes
`--min-rate <number>` and `--max-rate <number>`	Minimum and maximum rate (packets/second)
`--host-timeout`	Maximum amount of time to wait for a target host
`-v`	Verbosity level – for example, `-vv` and `-v4`
`-d`	Debugging level – for example `-d` and `-d9`
`-oN <filename>`	Normal output
`-oX <filename>`	XML output
`-oG <filename>`	grep-able output
`-oA <basename>`	Output in all major formats