How to scan multiple ports with NMAP?

Nmap (“Network Mapper”) is an open source tool for network exploration and security auditing. It was designed to rapidly scan large networks, but it works fine against single hosts. Nmap uses raw IP packets in novel ways to determine what hosts are available on the network, what services (application name and version) those hosts are offering, what operating systems (and versions) they are running, what type of packet filters/firewalls are in use, and dozens of other characteristics (Official Nmap Project Guide).

There are multiple ways to scan multiple ports with Nmap. Most commonly, you can simply list the ports you want to scan, separated by commas. For example, if you want to scan ports 21, 22, 80, and 443, you would use the command:

```
nmap -p 21,22,80,443
```

According to Nmap’s documentation, you can also specify a range of ports by using a hyphen. For instance, to scan ports 20 through 25, you’d use:

```
nmap -p 20-25
```

If you want to scan all 65535 ports, omit the -p option entirely:

```
nmap
```

Another method to scan multiple ports using Nmap is by using p option. This tells Nmap to scan all ports from 1 through 65535.

```
nmap p
```

Remember to replace `` with the IP address or domain name of the system you want to scan.

Moreover, Nmap commands can be adjusted to scan UDP (-sU) or SCTP (-sY) ports, or to combine TCP, UDP, and SCTP port scans (-sS -sU -sY) (Nmap Port Scanning Techniques).

One important thing to consider is that scanning numerous ports on multiple systems could lead to massive amounts of traffic, which has the potential to slow down networks or cause other issues. For that reason, it’s important to be mindful of where and when you run these scans.

Sources:

- Official Nmap Project Guide from nmap.org (https://nmap.org/book/man.html)
- Nmap Port Scanning Techniques from nmap.org (https://nmap.org/book/man-port-scanning-techniques.html)