The Exploit HQ

Nmap for Beginners · lesson 5 · 2026-08-18 · updated 2026-10-12

Nmap for Beginners: Scan Only the Ports You Want (Faster Scans)

Before you start

Welcome back to The Exploit HQ. This is part five of our beginner Nmap series, and as always, you need zero experience to follow along.

Let’s recap our journey so far. We have found the open doors on a computer, learned what software sits behind them, learned what open, closed, and filtered mean, and even scanned a whole home network at once.

Today we make our scans faster and more focused. Instead of checking every door, we will learn to check just the doors we care about, and get our answers in a fraction of the time.

This matters, because a full scan can be slow. When you know how to focus, you get the same answers quicker, and you learn to look exactly where it counts.

As always, we begin at the very start. Open the terminal window.

And remember, when you see the prompt, the short line that ends in a dollar sign, the computer is ready for you to type.

Let’s start with the scan we already know, on our friendly practice server, scanme dot nmap dot org.

nmap, space, scanme dot nmap dot org, and press Enter.

nmap scanme.nmap.org

Here is something important that was quietly happening all along. By default, Nmap checks the one thousand most common doors. That is a lot of knocking, and it can take a while.

See the line that says, not shown. That is Nmap telling us it checked hundreds of doors that were closed, and only listed the interesting open ones. Today, we take control of exactly how many doors it checks.

Our first speed trick is the fast scan. We add one flag, dash, capital F. Capital F simply stands for fast.

Instead of a thousand doors, a fast scan checks only the one hundred most common ones. Fewer doors to knock on means a quicker answer.

nmap, space, dash capital F, space, scanme dot nmap dot org, and press Enter.

nmap -F scanme.nmap.org

Same useful result, the open doors we care about, but Nmap got there faster, because it checked one hundred doors instead of a thousand.

Now, what if you want to choose how many doors to check yourself? That is where a lovely option called, dash dash top dash ports, comes in.

Here is the clever part. Nmap keeps a list of doors ranked by how commonly they are used across the whole internet. Top ports simply means, check the most popular ones first.

Let’s ask it to check just the twenty most common doors. We write, dash dash top dash ports, then a space, then the number twenty.

nmap, space, dash dash top dash ports, space, twenty, space, scanme dot nmap dot org, and press Enter.

nmap --top-ports 20 scanme.nmap.org

Nmap checked only the twenty most likely doors, and still found our open ones. You are now in control. You could ask for the top ten for a quick peek, or the top five hundred for a wider look.

So far we have chosen how many doors to check. Now let’s choose exactly which doors, by name.

For this we use, dash p. Think of the p as, ports, the doors themselves. After it, we simply list the door numbers we want, separated by commas.

Remember from part two, door twenty two is for remote login, and door eighty is for web pages. Let’s check just those two.

nmap, space, dash p, space, twenty two, comma, eighty, space, scanme dot nmap dot org, and press Enter.

nmap -p 22,80 scanme.nmap.org

Perfect. Nmap ignored every other door and checked only the two we named. This is the most focused scan of all. You look exactly where you want, and nowhere else.

You can also check a whole row of doors at once, using a range. You write the first number, a dash, then the last number.

Let’s check doors one through one hundred. We write, dash p, then, one, dash, one hundred.

nmap, space, dash p, space, one, dash, one hundred, space, scanme dot nmap dot org, and press Enter.

nmap -p 1-100 scanme.nmap.org

Nmap checked the first hundred doors in order, and, as before, showed us only the open ones. A dash gives you a whole range in one short command.

There is one more you should know about, even though we will not run it now, because it is the slow one. If you write dash p, and then just a dash by itself, that means every single door. All sixty five thousand of them.

That is the most thorough scan there is, perfect for when you must not miss anything. But it is also the slowest, and that is the whole lesson today. The more doors you check, the longer it takes. The fewer you check, the faster you are done.

And our golden rule, always. Only scan a computer you own, or one you have clear permission to test. Our practice server, scanme dot nmap dot org, is offered by the Nmap Project exactly for this, so it is always safe to use.

Let’s go over what you learned today.

Dash capital F gives you a fast scan of the hundred most common doors. Dash dash top dash ports lets you choose how many popular doors to check. And dash p lets you name exactly which doors you want, as a list with commas, or as a range with a dash.

Try these gently on the practice server, and feel how much quicker a focused scan feels. That instinct, to look exactly where it matters, is what real scanning is all about.

In the next tutorial, part six, we will learn how to save your results into a file, so you can keep them, share them, and read them back later.

Thanks for learning with The Exploit HQ. I will see you in part six.