#NMAP most important parameters
What does the following NMAP command -sL | List Scan - simply list targets to scan
What does the following NMAP command -sn | Ping Scan - disable port scan
What does the following NMAP command -Pn | Treat all hosts as online -- skip host discovery
What does the following NMAP command -PS/PA/PU/PY[portlist] | TCP SYN/ACK, UDP or SCTP discovery to given ports
What does the following NMAP command -PE/PP/PM | ICMP echo, timestamp, and netmask request discovery probes
What does the following NMAP command -PO[protocol list] | IP Protocol Ping
What does the following NMAP command -sS/sT/sA/sW/sM | TCP SYN/Connect()/ACK/Window/Maimon scans
What does the following NMAP command -sU | UDP Scan
What does the following NMAP command -sN/sF/sX | TCP Null, FIN, and Xmas scans
What does the following NMAP command --scanflags <flags> | Customize TCP scan flags
What does the following NMAP command -sI <zombie host[:probeport]> | Idle scan
What does the following NMAP command -sY/sZ | SCTP INIT/COOKIE-ECHO scans
What does the following NMAP command -sO | IP protocol scan
What does the following NMAP command -sV | Probe open ports to determine service/version info
What does the following NMAP command -sC | equivalent to --script=default
What does the following NMAP command --script=<Lua scripts> | <Lua scripts> is a comma separated list of directories, script-files or script-categories
What does the following NMAP command -O | Enable OS detection
What does the following NMAP command -b <FTP relay host> | FTP bounce scan
What does the following NMAP command -T<0-5> | Set timing template (higher is faster)
What does the following NMAP command -p <port ranges> | Only scan specified ports
What does the following NMAP command -F | Fast mode - Scan fewer ports than the default scan
What does the following NMAP command -D <decoy1,decoy2[,ME],...> | Cloak a scan with decoys
What does the following NMAP command -S <IP_Address> | Spoof source address
What does the following NMAP command --open | Only show open (or possibly open) ports
What does the following NMAP command -A | Enable OS detection, version detection, script scanning, and traceroute

#NMAP less used parameters
What does the following NMAP command -iL | Input from list of hosts/networks
What does the following NMAP command -iR <num hosts> | Choose random targets
What does the following NMAP command --exclude <host1[,host2][,host3],...> | Exclude hosts/networks
What does the following NMAP command --excludefile <exclude_file> | Exclude list from file
What does the following NMAP command -n/-R | Never do DNS resolution/Always resolve [default: sometimes]
What does the following NMAP command --dns-servers <serv1[,serv2],...> | Specify custom DNS servers
What does the following NMAP command --system-dns | Use OS's DNS resolver
What does the following NMAP command --traceroute | Trace hop path to each host
What does the following NMAP command --exclude-ports <port ranges> | Exclude the specified ports from scanning
What does the following NMAP command -r | Scan ports sequentially - don't randomize
What does the following NMAP command --top-ports <number> | Scan <number> most common ports
What does the following NMAP command --port-ratio <ratio> | Scan ports more common than <ratio>
What does the following NMAP command --version-intensity <level> | Set from 0 (light) to 9 (try all probes)
What does the following NMAP command --version-light | Limit to most likely probes (intensity 2)
What does the following NMAP command --version-all | Try every single probe (intensity 9)
What does the following NMAP command --version-trace | Show detailed version scan activity (for debugging)
What does the following NMAP command --script-args=<n1=v1,[n2=v2,...]> | provide arguments to scripts
What does the following NMAP command --script-args-file=filename | provide NSE script args in a file
What does the following NMAP command --script-trace | Show all data sent and received
What does the following NMAP command --script-updatedb | Update the script database.
What does the following NMAP command --script-help=<Lua scripts> | Show help about scripts.
What does the following NMAP command --osscan-limit | Limit OS detection to promising targets
What does the following NMAP command --osscan-guess | Guess OS more aggressively. Options which take <time> are in seconds, or append 'ms' (milliseconds), 's' (seconds), 'm' (minutes), or 'h' (hours) to the value (e.g. 30m).
What does the following NMAP command --min-hostgroup/max-hostgroup <size> | Parallel host scan group sizes
What does the following NMAP command --min-parallelism/max-parallelism <numprobes> | Probe parallelization
What does the following NMAP command --min-rtt-timeout/max-rtt-timeout/initial-rtt-timeout <time> | Specifies probe round trip time.
What does the following NMAP command --max-retries <tries> | Caps number of port scan probe retransmissions.
What does the following NMAP command --host-timeout <time> | Give up on target after this long
What does the following NMAP command --scan-delay/--max-scan-delay <time> | Adjust delay between probes
What does the following NMAP command --min-rate <number> | Send packets no slower than <number> per second
What does the following NMAP command --max-rate <number> | Send packets no faster than <number> per second
What does the following NMAP command -f; --mtu <val> | fragment packets (optionally w/given MTU)
What does the following NMAP command -e <iface> | Use specified interface
What does the following NMAP command -g/--source-port <portnum> | Use given port number
What does the following NMAP command --proxies <url1,[url2],...> | Relay connections through HTTP/SOCKS4 proxies
What does the following NMAP command --data <hex string> | Append a custom payload to sent packets
What does the following NMAP command --data-string <string> | Append a custom ASCII string to sent packets
What does the following NMAP command --data-length <num> | Append random data to sent packets
What does the following NMAP command --ip-options <options> | Send packets with specified ip options
What does the following NMAP command --ttl <val> | Set IP time-to-live field
What does the following NMAP command --spoof-mac <mac address/prefix/vendor name> | Spoof your MAC address
What does the following NMAP command --badsum | Send packets with a bogus TCP/UDP/SCTP checksum
What does the following NMAP command -oN/-oX/-oS/-oG <file> | Output scan in normal, XML, s|<rIpt kIddi3, and Grepable format, respectively, to the given filename.
What does the following NMAP command -oA <basename> | Output in the three major formats at once
What does the following NMAP command -v | Increase verbosity level (use -vv or more for greater effect)
What does the following NMAP command -d | Increase debugging level (use -dd or more for greater effect)
What does the following NMAP command --reason | Display the reason a port is in a particular state
What does the following NMAP command --packet-trace | Show all packets sent and received
What does the following NMAP command --iflist | Print host interfaces and routes (for debugging)
What does the following NMAP command --append-output | Append to rather than clobber specified output files
What does the following NMAP command --resume <filename> | Resume an aborted scan
What does the following NMAP command --noninteractive | Disable runtime interactions via keyboard
What does the following NMAP command --stylesheet <path/URL> | XSL stylesheet to transform XML output to HTML
What does the following NMAP command --webxml | Reference stylesheet from Nmap.Org for more portable XML
What does the following NMAP command --no-stylesheet | Prevent associating of XSL stylesheet w/XML output
What does the following NMAP command -6 | Enable IPv6 scanning
What does the following NMAP command --datadir <dirname> | Specify custom Nmap data file location
What does the following NMAP command --send-eth/--send-ip | Send using raw ethernet frames or IP packets
What does the following NMAP command --privileged | Assume that the user is fully privileged
What does the following NMAP command --unprivileged | Assume the user lacks raw socket privileges