Prior to writing nmap, I spent a lot of time with other scannersexploring the Internet and various private networks (note theavoidance of the "intranet" buzzword). I have used many of the topscanners available today, including strobe by Julian Assange, netcatby *Hobbit*, stcp by Uriel Maimon, pscan by Pluvius, ident-scan byDave Goldsmith, and the SATAN tcp/udp scanners by Wietse Venema.These are all excellent scanners! In fact, I ended up hacking most ofthem to support the best features of the others. Finally I decided towrite a whole new scanner, rather than rely on hacked versions of adozen different scanners in my /usr/local/sbin. While I wrote all thecode, nmap uses a lot of good ideas from its predecessors. I alsoincorporated some new stuff like fragmentation scanning and optionsthat were on my "wish list" for other scanners. Here are some of the(IMHO) useful features of nmap:

• dynamic delay time calculations: Some scanners require that yousupply a delay time between sending packets. Well how should I knowwhat to use? Sure, I can ping them, but that is a pain, and plus theresponse time of many hosts changes dramatically when they are beingflooded with requests. nmap tries to determine the best delay timefor you. It also tries to keep track of packet retransmissions,etc. so that it can modify this delay time during the course of thescan. For root users, the primary technique for finding an initialdelay is to time the internal "ping" function. For non-root users, ittimes an attempted connect() to a closed port on the target. It canalso pick a reasonable default value. Again, people who want tospecify a delay themselves can do so with -w (wait), but you shouldn'thave to.
  
  
• retransmission: Some scanners just send out all the query packets,and collect the responses. But this can lead to false positives ornegatives in the case where packets are dropped. This is especiallyimportant for "negative" style scans like UDP and FIN, where what youare looking for is a port that does NOT respond. In most cases, nmapimplements a configurable number of retransmissions for ports thatdon't respond.
  
  
• parallel port scanning: Some scanners simply scan ports linearly,one at a time, until they do all 65535. This actually works for TCPon a very fast local network, but the speed of this is not at allacceptable on a wide area network like the Internet. nmap usesnon-blocking i/o and parallel scanning in all TCP and UDP modes. Thenumber of scans in parallel is configurable with the -M (Max sockets)option. On a very fast network you will actually decrease performanceif you do more than 18 or so. On slow networks, high values increaseperformance dramatically.
  
  
• Flexible port specification: I don't always want to just scan all65535 ports. Also, the scanners which only allow you to scan ports 1- N sometimes fall short of my need. The -p option allows you tospecify an arbitrary number of ports and ranges for scanning. Forexample, '-p 21-25,80,113, 60000-' does what you would expect (atrailing hyphen means up to 65536, a leading hyphen means 1 through).You can also use the -F (fast) option, which scans all the portsregistered in your /etc/services (a la strobe).
  
  
• Flexible target specification: I often want to scan more then onehost, and I certainly don't want to list every single host on a largenetwork to scan. Everything that isn't an option (or option argument)in nmap is treated as a target host. As mentioned before, you canoptionally append /mask to a hostname or IP address in order to scanall hosts with the same initial bits of the 32 bit IPaddress. You can use the same powerful syntax as the portspecifications to specify targets like '150.12.17.71-79.7.*'. '*' isjust a shortcut for 0-255, remember to escape it from your shell ifused.
  
  
• detection of down hosts: Some scanners allow you to scan largenetworks, but they waste a huge amount of time scanning 65535 ports ofa dead host! By default, nmap pings each host to make sure it is upbefore wasting time on it. It also does thin in parallel, to speedthings up. You can change the parrallel ping lookahead with '-L' andthe ping timeout with '-T'. You can turn pinging off completely withthe '-D' command line option. This is useful for scanning networkslike microsoft.com where ICMP echo requests can't get through. Nmapis also capable of bailing on hosts that seem down based on strangeport scanning errors. It is also meant to be tolerant of people whoaccidentally scan network addresses, broadcast addresses, etc.
  
  
• detection of your IP address: For some reason, a lot of scannersask you to type in your IP address as one of the parameters. Jeez, Idon't want to have to 'ifconfig' and figure out my current addressevery time I scan. Of course, this is better then the scanners I'veseen which require recompilation every time you change your address!nmap first tries to detect your address during the ping stage. Ituses the address that the echo response is received on, as that is theinterface it should almost always be routed through. If it can't dothis (like if you don't have host pinging enabled), nmap tries todetect your primary interface and uses that address. You can also use-S to specify it directly, but you shouldn't have to (unless you wantto make it look like someone ELSE is SYN or FIN scanning ahost.
  
  

 -v (verbose): This is highly recommended for interactive use.  Among otheruseful messages, you will see ports come up as they are found, rather thanhaving to wait for the sorted summary list. -r (randomize): This will randomize the order in which the target host'sports are scanned. -q (quash argv): This changes argv[0] to FAKE_ARGV ("pine" by default).It also eliminates all other arguments, so you won't look too suspicious in'w' or 'ps' listings. -h for an options summary. -R show and resolve all hosts, even down ones.