What's the difference between -sS and -sT on nmap? Both commands give the same output (besides filtered ports/closed ports).

2 Answers 2


What's the difference between -sS and -sT on nmap?


-sS TCP SYN scan:

This technique is often referred to as "half-open" scanning, because you don’t open a full TCP connection. You send a SYN packet, as if you are going to open a real connection and you wait for a response. A SYN|ACK indicates the port is listen- ing. A RST is indicative of a non-listener. If a SYN|ACK is received, a RST is immediately sent to tear down the connection (actually our OS kernel does this for us). The primary advantage to this scanning technique is that fewer sites will log it. Unfortunately you need root privileges to build these custom SYN packets. This is the default scan type for privileged users.

-sT TCP connect() scan:

This is the most basic form of TCP scanning. The connect() system call provided by your operating system is used to open a connection to every interesting port on the machine. If the port is listening, connect() will succeed, oth erwise the port isn’t reachable. One strong advantage to this technique is that you don’t need any special privileges. Any user on most UNIX boxes is free to use this call.

This sort of scan is easily detectable as target host logs will show a bunch of connection and error messages for the services which accept() the connection just to have it immediately shut- down. This is the default scan type for unprivileged users.

Source nmap


With -sS the TCP the packet flow is SYN - SYN/ACK - RST. The service that is listening on the port won't notice since the handshake never completes. On the other hand, -sT performs a proper handshake (SYN - SYN/ACK - ACK) which establishes a connection, so the service notices.

Thus, -sS is stealthier than -sT.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .