Nmap

Nmap Security Scanner
Original authorGordon Lyon (Fyodor)
ReleaseSeptember 1, 1997; 29 years ago (1997-09-01)
Stable release
7.993 Edit this on Wikidata / 23 October 2026; 19 days ago (23 October 2026)
Written inC, C++, Python, Lua
Operating systemCross-platform
Available inEnglish
TypeNetwork scanner, network security
LicenseNPSL; proprietary OEM license available
Websitenmap.org Edit this on Wikidata
Repository

Nmap (Network Mapper) is a network scanner created by Gordon Lyon (also known by his pseudonym Fyodor Vaskovich). It was first released in September 1997 in Phrack magazine. Nmap is used to discover hosts and services on a computer network by sending packets and analyzing the responses.

Nmap provides a number of features for probing computer networks, including host discovery and service and operating system detection. These features are extensible by scripts that provide more advanced service detection, vulnerability detection, and other features. Nmap can adapt to network conditions including latency and congestion during a scan. The Nmap distribution also includes the Zenmap graphical user interface, the Ncat networking utility, the Ndiff scan comparison tool and the Nping packet generation tool.

Nmap started as a Linux utility and was ported to other systems including Windows, macOS, and BSD. According to the Nmap Project, Windows, supported since 2000, has become its second most popular platform after Linux.

Features

Nmap features include:

Nmap can provide further information on targets, including reverse DNS names, device types, and MAC addresses.

Nmap is distributed with several companion programs: Ncat, a reimplementation of netcat that adds support for SSL, connection redirection and proxying; Ndiff, which compares the results of two Nmap scans and reports the changes; and Nping, a tool for network packet generation, response analysis and response time measurement.

Typical uses of Nmap:

Academic surveys of network attack surface mapping review it among the prominent tools used for network reconnaissance.

User interfaces

NmapFE, originally written by Zach Smith, was Nmap's official GUI for Nmap versions 2.11 to 4.22. For Nmap 4.50 (originally in the 4.22SOC development series) NmapFE was replaced with Zenmap, a new official graphical user interface based on UMIT, developed by Adriano Monteiro Marques. Zenmap gained an interactive network topology viewer and the ability to combine several scans into one view in Nmap 4.75, released in 2008.

Web-based interfaces exist that allow either controlling Nmap or analysing Nmap results from a web browser, such as IVRE.

Output

Four different output formats are offered by Nmap. Everything is saved to a file except the interactive output. Text processing software can be used to modify Nmap output, allowing the user to customize reports.

Interactive
presented and updated real time when a user runs Nmap from the command line. Various options can be entered during the scan to facilitate monitoring.
XML
a format that can be further processed by XML tools. It can be converted into a HTML report using XSLT.
Grepable
output that is tailored to line-oriented processing tools such as grep, sed, or awk.
Normal
the output as seen while running Nmap from the command line, but saved to a file.
Script kiddie
meant to be an amusing way to format the interactive output replacing letters with their visually alike number representations. For example, Interesting ports becomes Int3rest1ng p0rtz. This is known as Leet.

History

Nmap was first published in September 1997, as an article in Phrack Magazine with source-code included. The first release ran only on Linux, was about 2,000 lines long and had no version number, because further releases were not planned; a revised version 1.25 followed on 5 September 1997. Lyon later said he had written Nmap for his own network discovery after modifying several existing port scanners to add features they lacked, and had published it in case others found it useful; the bug reports, fixes and suggestions that followed led him to continue releasing new versions. With help and contributions of the computer security community, development continued. Enhancements included operating system fingerprinting, service fingerprinting, code rewrites (C to C++), additional scan types, protocol support (e.g. IPv6, SCTP) and new programs that complement Nmap's core features.

Notable releases include:

DateVersionSignificance
December 12, 1998; 27 years agoNmap 2.00Nmap 2.00 is released, including Operating System fingerprinting inspired by the earlier tool Queso
April 11, 1999; 27 years agoNmapFEA GTK+ front end, is bundled with Nmap
December 7, 2000; 25 years agoWindows port
July 31, 2002; 24 years agoNmap 3.00Mac OS X support, XML output and uptime detection
August 28, 2002; 24 years agoRewrite from C to C++, with initial IPv6 support
September 16, 2003; 23 years agoNmap 3.45The first public release to include service version detection
August 31, 2004; 22 years agoNmap 3.70Core scan engine rewritten for version 3.70. New engine is called ultra_scan
Summer 2005Nmap selected for participation in Google Summer of Code. Added features included Zenmap, Nmap Scripting Engine (NSE), Ncat, and 2nd-generation OS detection.
December 13, 2007; 18 years agoNmap 4.50Nmap 4.50, the 10th Anniversary Edition, was released. Included Zenmap, 2nd-generation OS detection, and the Nmap Scripting Engine
March 30, 2009; 17 years agoNmap 4.85BETA5Emergency release of Nmap 4.85BETA5, leveraging NSE to detect Conficker infections
July 16, 2009; 17 years agoNmap 5.00Included netcat-replacement Ncat and Ndiff scan comparison tool
January 28, 2011; 15 years agoNmap 5.50Included Nping packet generation response analysis and response time measurement, including TCP, UDP and ICMP probe modes.
May 21, 2012; 14 years agoNmap 6.00Released with full IPv6 support, including a new IPv6 OS detection system based on machine learning
November 19, 2015; 10 years agoNmap 7.00 More than 330 improvements since Nmap 6, including mature IPv6 support and an expanded Nmap Scripting Engine of 515 scripts.
December 20, 2016; 9 years agoNmap 7.40 Integrated 568 user-submitted OS fingerprints and 779 service fingerprints. NSE reached 552 scripts, including several for IBM mainframe TN3270 services. A new --defeat-icmp-ratelimit option shortens UDP scans.
June 13, 2017; 9 years agoNmap 7.50 Added scripts detecting the MS17-010 SMB vulnerability and the DoublePulsar backdoor. NSE reached 566 scripts.
July 31, 2017; 9 years agoNmap 7.60 Full SSH support in NSE through libssh2, including password brute-forcing and remote command execution, along with new SMB2 and SMB3 scripts and DTLS support in Ncat. NSE reached 579 scripts.
March 20, 2018; 8 years agoNmap 7.70 Integrated 728 service and 667 IPv4 OS fingerprint submissions. Added nine NSE scripts, including a check for the ROCA vulnerability in RSA keys, bringing the total to 588.
August 10, 2019; 7 years agoNmap 7.80 Updated the bundled Npcap Windows packet capture driver. Added 11 NSE scripts, bringing the total to 598, including vulners, which uses version detection results to query the Vulners database for known vulnerabilities.
October 3, 2020; 6 years agoNmap 7.90 The new fingerprints allow better operating system and service/version detection. Three new NSE scripts, new protocol library and payloads for host discovery, port scanning and version detection. Npcap 1.0.0, the first fully stable version of the Windows raw packet capturing/sending driver. First release under the Nmap Public Source License.
September 1, 2022; 4 years agoNmap 7.93 Released on Nmap's 25th anniversary. Builds with OpenSSL 3.0 and bundles Npcap 1.71.
May 19, 2023; 3 years agoNmap 7.94 Zenmap and Ndiff ported to Python 3. Partial silent-install support added to the Windows installer. License updated to NPSL version 0.95.
April 23, 2024; 2 years agoNmap 7.95 Integrated over 4,000 user-submitted IPv4 OS fingerprints, raising the OS signature count to 6,036, and extended service detection to 1,246 protocols. Added scripts for querying industrial control systems.
May 1, 2025; 18 months agoNmap 7.96 Forward DNS lookups are performed in parallel; in the project's testing, resolving one million hostnames fell from 49 hours to just over an hour. Zenmap gained a dark mode, and NSE reached 612 scripts.
August 21, 2025; 14 months agoNmap 7.98 Windows installer rebuilt to address CVE-2025-43715, a privilege escalation flaw in the Nullsoft Scriptable Install System.
March 26, 2026; 7 months agoNmap 7.99 Integrated new IPv4 and IPv6 OS fingerprints. Zenmap is distributed as a platform-independent Python wheel instead of an RPM package, and the Windows version can scan over VPN virtual adapters.
August 6, 2026; 3 months agoNmap 7.991 Security release fixing memory safety flaws in OS detection, Ncat and Nping reported by outside researchers, and patching six vulnerabilities in the bundled libssh2 library.
October 15, 2026; 27 days agoNmap 7.992 Introduced execution time and memory limits for NSE scripts and a fuzzing framework, and fixed several reported security issues. Added eight scripts for auditing DICOM medical imaging services, bringing NSE to 620 scripts.

Nmap is a tool that can be used to discover services running on Internet connected systems. Like any tool, it could potentially be used for black hat hacking, as a precursor to attempts to gain unauthorized access to computer systems. However, Nmap is also used by security and systems administrators to assess their own networks for vulnerabilities (i.e. white hat hacking).

System administrators can use Nmap to search for unauthorized servers, or for computers that do not conform to security standards.

In 2003 Supreme Court of Finland ruled that port scanning amounted to an attempted computer break-in, which was illegal under Finnish penal code at the time:

In its ruling the Supreme Court stated that the defendant had systematically carried out port scanning operations to gather information for the purpose of unauthorised break-in to the bank's computer network. This amounted to an attempted computer break-in.

License

Nmap was originally distributed under the GNU General Public License (GPL). In later releases, Nmap's authors added clarifications and specific interpretations to the license where they felt the GPL was unclear or lacking. For instance, Nmap 3.50 specifically revoked the license of SCO Group to distribute Nmap software because of their views on the SCO–Linux disputes.

Starting with version 7.90, released in October 2020, Nmap is distributed under the Nmap Public Source License (NPSL), a custom license based on GPLv2 with additional terms, conditions and exceptions. The license prohibits redistribution and use of Nmap within proprietary software and hardware products, and the Nmap Project funds its development by selling a separate Nmap OEM license to companies that embed Nmap in their products. The project states that it believes the NPSL complies with the Open Source Definition, but it has not submitted the license for certification. To ease the transition, versions 7.90, 7.91 and 7.92 may also be used under the previous license terms.

The new license was questioned by several Linux distributions. Developers of GNU Guix, Debian and Gentoo raised concerns that NPSL version 0.92 was not a free software license, in particular over a clause directing "proprietary software companies" to purchase a separate license. In January 2021 Fedora determined that NPSL 0.92 was not acceptable for software it distributes, describing the clause as a field-of-endeavor restriction contrary to the Open Source Definition, and Void Linux and Debian reverted to versions released before the license change. Lyon rewrote the clause in NPSL version 0.93, and version 0.95 was adopted with Nmap 7.94 in 2023. Fedora also classified NPSL 0.95 as not allowed and in 2024 reverted its nmap package to version 7.92, which can still be used under the earlier license terms. Debian resumed packaging NPSL-licensed releases while discussion continued over whether the license meets the Debian Free Software Guidelines.

In The Matrix Reloaded, Trinity is seen using Nmap to find a host with an open SSH port, which she then compromises with a real SSH exploit to access a power plant's computer system, allowing Neo to "physically" break into a building. The appearance of Nmap in the film was widely discussed on Internet forums and hailed as an unusually realistic example of hacking.

Nmap and NmapFE were used in The Listening, a 2006 movie about a former NSA officer who defects and mounts a clandestine counter-listening station high in the Italian alps.

Nmap source code can be seen in the movie Battle Royale, as well as brief views of the command line version of Nmap executing in Live Free or Die Hard and Bourne Ultimatum. In 2013, Nmap continued to make appearances in movies including popular sci-fi movie Elysium.

The film Dredd, a film adaptation of the famous Judge Dredd comics, was released in 2012 and also contains multiple Nmap scenes. Nmap is used for network reconnaissance and exploitation of the slum tower network. It is even seen briefly in the movie's trailer.

The command Nmap is widely used in the video game Hacknet, allowing to probe the network ports of a target system to hack it.

In Snowden, Nmap is used in the aptitude test scene about 14 minutes into the movie.

In academia

Nmap is an integral part of academic activities. It has been used for research involving the TCP/IP protocol suite and networking in general. Besides being a research tool, Nmap has also become a research topic. The detection of Nmap scans has also been studied; a 2020 IEEE conference paper reported that common intrusion detection rules detected Nmap scans far less reliably when its evasion options were used, and proposed a rule set for the Suricata intrusion detection system that achieved 91.7 percent detection accuracy against evasive scans on the authors' dataset.

Examples

$ nmap -f -v -A scanme.nmap.org
Starting Nmap 6.47 ( https://nmap.org ) at 2014-12-29 20:02 CET
Nmap scan report for scanme.nmap.org (74.207.244.221)
Host is up (0.16s latency).
Not shown: 997 filtered ports
PORT     STATE SERVICE    VERSION
22/tcp   open  ssh        OpenSSH 5.3p1 Debian 3ubuntu7.1 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   1024 8d:60:f1:7c:ca:b7:3d:0a:d6:67:54:9d:69:d9:b9:dd (DSA)
|_  2048 79:f8:09:ac:d4:e2:32:42:10:49:d3:bd:20:82:85:ec (RSA)
80/tcp   open  http       Apache httpd 2.2.14 ((Ubuntu))
|_http-title: Go ahead and ScanMe!
9929/tcp open  nping-echo Nping echo
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose|phone|storage-misc|WAP
Running (JUST GUESSING): Linux 2.6.X|3.X|2.4.X (94%), Netgear RAIDiator 4.X (86%)
OS CPE: cpe:/o:linux:linux_kernel:2.6.38 cpe:/o:linux:linux_kernel:3 cpe:/o:netgear:raidiator:4 cpe:/o:linux:linux_kernel:2.4
Aggressive OS guesses: Linux 2.6.38 (94%), Linux 3.0 (92%), Linux 2.6.32 - 3.0 (91%), Linux 2.6.18 (91%), Linux 2.6.39 (90%), Linux 2.6.32 - 2.6.39 (90%), Linux 2.6.38 - 3.0 (90%), Linux 2.6.38 - 2.6.39 (89%), Linux 2.6.35 (88%), Linux 2.6.37 (88%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 13 hops
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE (using port 80/tcp)
HOP RTT       ADDRESS
1   14.21 ms  151.217.192.1
2   5.27 ms   ae10-0.mx240-iphh.shitty.network (94.45.224.129)
3   13.16 ms  hmb-s2-rou-1102.DE.eurorings.net (134.222.120.121)
4   6.83 ms   blnb-s1-rou-1041.DE.eurorings.net (134.222.229.78)
5   8.30 ms   blnb-s3-rou-1041.DE.eurorings.net (134.222.229.82)
6   9.42 ms   as6939.bcix.de (193.178.185.34)
7   24.56 ms  10ge10-6.core1.ams1.he.net (184.105.213.229)
8   30.60 ms  100ge9-1.core1.lon2.he.net (72.52.92.213)
9   93.54 ms  100ge1-1.core1.nyc4.he.net (72.52.92.166)
10  181.14 ms 10ge9-6.core1.sjc2.he.net (184.105.213.173)
11  169.54 ms 10ge3-2.core3.fmt2.he.net (184.105.222.13)
12  164.58 ms router4-fmt.linode.com (64.71.132.138)
13  164.32 ms scanme.nmap.org (74.207.244.221)

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 28.98 seconds

See also

Bibliography

  • Fyodor Lyon, Gordon (1 January 2009). Nmap Network Scanning: The Official Nmap Project Guide to Network Discovery and Security Scanning. Insecure.com LLC. p. 468. ISBN 978-0-9799587-1-7.

References

  1. ↑ "Nmap Release archive". Retrieved 27 October 2026.
  2. 1 2 3 4 5 6 7 "Nmap Public Source License". Nmap.org. Retrieved 2026-11-04.
  3. ↑ "Matrix mixes life and hacking". BBC News. 2003-05-19. Retrieved 2018-10-28.
  4. 1 2 3 Fyodor (1997-09-01). "The Art of Port Scanning". Phrack Magazine. Vol. 7, no. 51. Retrieved 2026-11-04.
  5. 1 2 3 "Nmap Reference Guide". Nmap.org. Retrieved 2018-10-28.
  6. 1 2 "Nmap Scripting Engine: Introduction". Nmap.org. Retrieved 2018-10-28.
  7. 1 2 3 4 5 6 7 8 9 10 11 12 "The History and Future of Nmap". Nmap.org. Retrieved 2026-11-04.
  8. ↑ "Other Platforms". Nmap.org. Retrieved 2018-10-28.
  9. ↑ "Nmap Installation for Windows". Nmap.org. Retrieved 2026-11-04.
  10. 1 2 "Service and Application Version Detection". Nmap.org. Retrieved 2018-10-28.
  11. ↑ "Service and Version Detection". Nmap.org. Retrieved 2026-11-04.
  12. 1 2 3 4 5 Farrow, Rik (Winter 2016). "Interview with Gordon Lyon". login. Vol. 41, no. 4. USENIX. pp. 44–46. Retrieved 2026-11-04.
  13. ↑ "Nmap Scripting Engine". Nmap.org. Retrieved 2018-10-28.
  14. ↑ Nmap Overview and Demonstration.
  15. ↑ When Good Scanners Go Bad, From Archived 2000-06-14 at the Wayback Machine, Computerworld 22 March 1999
  16. ↑ "nmap-audit – Network auditing with Nmap". heavyk.org. Archived from the original on 2009-04-01. Retrieved 2018-10-28.
  17. ↑ "Nping - Network packet generation tool / ping utility". Nmap.org. Retrieved 2018-10-28.
  18. ↑ Leyden, John (2014-08-15). "Revealed ... GCHQ's incredible hacking tool to sweep net for vulnerabilities: Nmap". TheRegister.co.uk. Retrieved 2018-10-28.
  19. 1 2 Everson, Douglas; Cheng, Long (June 2024). "A Survey on Network Attack Surface Mapping". Digital Threats: Research and Practice. 5 (2). Association for Computing Machinery: 1–25. doi:10.1145/3640019.
  20. 1 2 3 4 5 "Nmap Changelog". Nmap.org. Retrieved 2026-11-04.
  21. ↑ "IVRE homepage". Retrieved 2018-10-28.
  22. ↑ "Nmap Reference Guide: Output". Nmap.org. Retrieved 2018-10-29.
  23. ↑ "SCTP Support for Nmap". Roe.ch. 2011-05-10. Retrieved 2018-10-29.
  24. ↑ "Nmap 3.70 Released—Core Scan Engine Rewrite!". Seclists.org. 2004-08-31. Retrieved 2018-10-29.
  25. ↑ "Google sponsors Nmap summer student developers". Seclists.org. 2005-06-02. Retrieved 2018-10-29.
  26. ↑ "Nmap 4.50 Press Release". Insecure.org. 2007-12-13. Retrieved 2018-10-29.
  27. ↑ "Nmap 4.85BETA5: Now with Conficker detection!". Seclists.org. 2009-03-30. Retrieved 2018-10-29.
  28. ↑ "Nmap 5.00 Released". Nmap.org. 2009-07-16. Retrieved 2018-10-29.
  29. ↑ "nmap/nping/docs/nping.1 at master · nmap/nmap". GitHub.
  30. ↑ "Nmap 5.50: Now with Gopher protocol support!". Seclists.org. 2011-01-28. Retrieved 2018-10-29.
  31. ↑ "Nmap 6 Released". Nmap.org. 2012-05-21. Retrieved 2026-11-04.
  32. ↑ "Nmap 7 Released". Nmap.org. 2015-11-19. Retrieved 2026-11-04.
  33. ↑ "The top 7 improvements in Nmap 7". Help Net Security. 2015-11-23. Retrieved 2026-11-04.
  34. ↑ "Nmap 7.00". Nmap.org. 2015-11-19. Retrieved 2026-11-04.
  35. ↑ "Nmap 7.40". Nmap.org. 2016-12-20. Retrieved 2026-11-04.
  36. ↑ "Nmap 7.50". Nmap.org. 2017-06-13. Retrieved 2026-11-04.
  37. ↑ "Nmap 7.60". Nmap.org. 2017-07-31. Retrieved 2026-11-04.
  38. ↑ "Nmap 7.60 released: SSH support, SMB2/SMB3 improvements, 14 more scripts". Help Net Security. 2017-08-02. Retrieved 2026-11-04.
  39. ↑ "Nmap 7.70". Nmap.org. 2018-03-20. Retrieved 2026-11-04.
  40. ↑ "Nmap 7.70 released: Better service and OS detection, 9 new NSE scripts, and more!". Help Net Security. 2018-03-21. Retrieved 2026-11-04.
  41. ↑ "Nmap 7.80". Nmap.org. 2019-08-10. Retrieved 2026-11-04.
  42. ↑ "Nmap 7.80 released: A mature Npcap Windows packet capturing driver, 11 new NSE scripts". Help Net Security. 2019-08-12. Retrieved 2026-11-04.
  43. ↑ "Nmap 7.90". Nmap.org. 2020-10-03. Retrieved 2020-10-03.
  44. ↑ "Nmap 7.90 released: New fingerprints, NSE scripts, and Npcap 1.0.0". Help Net Security. 2020-10-05. Retrieved 2026-11-04.
  45. ↑ "Nmap 7.93". Nmap.org. 2022-09-01. Retrieved 2026-11-04.
  46. ↑ "Nmap 7.93, the 25th anniversary edition, has been released". Help Net Security. 2022-09-05. Retrieved 2026-11-04.
  47. 1 2 "Nmap 7.94". Nmap.org. 2023-05-19. Retrieved 2026-11-04.
  48. ↑ "Nmap 7.95". Nmap.org. 2024-04-23. Retrieved 2026-11-04.
  49. ↑ "Nmap 7.95 released: New OS and service detection signatures". Help Net Security. 2024-05-10. Retrieved 2026-11-04.
  50. ↑ "Nmap 7.96". Nmap.org. 2025-05-01. Retrieved 2026-11-04.
  51. ↑ "Nmap 7.98". Nmap.org. 2025-08-21. Retrieved 2026-11-04.
  52. ↑ "Nmap 7.99". Nmap.org. 2026-03-26. Retrieved 2026-11-04.
  53. ↑ "Nmap 7.991". Nmap.org. 2026-08-06. Retrieved 2026-11-04.
  54. ↑ "Nmap 7.992". Nmap.org. 2026-10-15. Retrieved 2026-11-04.
  55. ↑ Poulsen, Kevin (2004-11-24). "Hacking tool reportedly draws FBI subpoenas". SecurityFocus.com. Retrieved 2018-10-29.
  56. ↑ "How To Conduct A Security Audit" (PDF). PC Network Advisor. No. 120. July 2000. Archived from the original (PDF) on 2021-04-27. Retrieved 2018-10-29.
  57. 1 2 "First ruling by the Supreme Court of Finland on attempted break-in". Osborne Clarke. 2003. Archived from the original on 2005-05-05. Retrieved 2018-10-29.
  58. ↑ "Important Nmap License Terms". Nmap.org. Archived from the original on 2018-07-20. Retrieved 2018-10-29.
  59. ↑ "Nmap 3.50 Press Release". 2004-02-20. Retrieved 2018-10-29.
  60. 1 2 3 4 Edge, Jake (2021-01-13). "A license change for Nmap". LWN.net. Retrieved 2026-11-04.
  61. ↑ "Add NPSL (nmap license) to MISC_FREE". Gentoo's Bugzilla. Retrieved 2021-12-15.
  62. ↑ "Nmap Public Source License (NPSL) Version 0.92". Fedora Mailing-Lists. Retrieved 2021-12-15.
  63. 1 2 "nmap (7.95+dfsg-3) changelog". Debian. Retrieved 2026-11-04.
  64. ↑ "nmap 7.95 is under a license not allowed in Fedora". Red Hat Bugzilla. Bug 2296006. Retrieved 2026-11-04.
  65. 1 2 3 "Nmap In The Movies". Retrieved 2018-10-29.
  66. ↑ "Matrix Hacking – A Slice of Reality in a World of Make Believe". Help Net Security. 2003-05-21. Retrieved 2026-11-04.
  67. ↑ Poulsen, Kevin (2003-05-16). "Matrix Sequel Has Hacker Cred". The Register. Retrieved 2018-10-29.
  68. ↑ Haines, J.; Ryder, D.K.; Tinnel, L.; Taylor, S. (2003-02-19). "Validation of sensor alert correlators". IEEE Security & Privacy. 99 (1): 46–56. Bibcode:2003ISPri..99a..46H. doi:10.1109/MSECP.2003.1176995.
  69. ↑ Medeiros, João Paulo S.; Brito Jr., Agostinho M.; Pires, Paulo S. Motta (2009). "A Data Mining Based Analysis of Nmap Operating System Fingerprint Database". Computational Intelligence in Security for Information Systems. Advances in Intelligent and Soft Computing. Vol. 63. pp. 1–8. doi:10.1007/978-3-642-04091-7_1. ISBN 978-3-642-04090-0.
  70. ↑ Liao, Si; Zhou, Chenming; Zhao, Yonghui; et al. (2020). A Comprehensive Detection Approach of Nmap: Principles, Rules and Experiments. 2020 International Conference on Cyber-Enabled Distributed Computing and Knowledge Discovery (CyberC). IEEE. doi:10.1109/CYBERC49757.2020.00020.