I am new to nmap and i read that you can limit the output of nmap to the top 100 ports by using the command -F such as:

nmap - F <IP>

My question is what are the top 100 ports. I have been looking everywhere but cannot find it. Appreciate if anyone can point me to the right direction


From the nmap man page:

Nmap needs an nmap-services file with frequency information in order to know which ports are the most common. If port frequency information isn´t available, perhaps because of the use of a custom nmap-services file, -F means to scan only ports that are named in the services file (normally Nmap scans all named ports plus ports 1–1024).

Further googling returns this file: https://svn.nmap.org/nmap/nmap-services

  • 1
    You can see exactly which ports are scanned with this command: ./nmap -F -oG - -v (The IP address is reserved, and should cause an error instead of a port scan, to save time in this particular case) – bonsaiviking Aug 4 '14 at 12:15

This fast scan will look at the top TCP and UDP ports most commonly found to be open following research by Gordon Lyon. The default scan looks at the top 1000 while in the past:

...The first 1024 ports as well as all named ports above 1024 were scanned (1715 TCP and 1488 UDP).

The fast scan is a further reduction and scans the most common of the 1000 most common.

Source: jahboite.co.uk


If you want to know concretely which ports have been scanned, then let nmap create an XML-output file and within that search for the scaninfo tag.


nmap comes with a list. Here's the list in descending order of frequency. The -F option scans the top 100 on this list: Google Sheets » port_open_freq

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.