Count
7.991 added 8 DICOM scripts and reached 620 NSE scripts. The 7.96 release had reached 612.
Version 7.991
What 7.991 can actually report
Host discovery, TCP and UDP port states, service versions, OS guesses, and 620 NSE scripts. Zenmap shows the same results in a window. Ncat, Ndiff, and Nping ship in the suite.
The notes below use the flags and screen names from the program. Scan only systems you are allowed to test. Install trouble is on the troubleshooting guides.
Hosts
See who answers before you list ports
A ping scan (-sn) asks which addresses are up and skips the port list. On a local Ethernet segment Nmap can use ARP. It can also use ICMP echo, TCP, and UDP probes when you are checking a routed network.
The Intense scan in this screenshot starts with a ping, then a SYN scan of 1,000 ports, and loads NSE. The command Zenmap shows is nmap -T4 -A -v -PE -PS22,25,80 -PA21,23,80,3389. -A turns on OS detection, version detection, default scripts, and traceroute.
If a Windows scan of your own PC fails, the usual cause is a missing Npcap driver. See localhost scans on Windows.
Ports
Scan types and the states they report
A port is open, closed, filtered, unfiltered, open|filtered, or closed|filtered. Open means an application accepted the probe. Closed means the host answered and nothing is listening. Filtered means a filter dropped the probe, so Nmap cannot tell.
| Technique | Flag | What you learn |
|---|---|---|
| TCP SYN | -sS | Whether a TCP port accepts the start of a handshake. This is the usual scan when raw packets are allowed. |
| TCP connect | -sT | The same question through the operating system socket API. It works without Npcap. On Windows, 7.96 stopped labeling many closed ports as filtered. |
| UDP | -sU | Whether a UDP port responds. It is slower than TCP. Use it when DNS, SNMP, or similar services matter. |
| TCP ACK | -sA | Whether a port looks unfiltered. It does not by itself tell you that a service is open. |
| Ping only | -sn | Which hosts are up, without a port scan. |
| Skip discovery | -Pn | Treat every target as up. Useful when ICMP is blocked and you already know the host exists. |
More probe types are described in the man page installed with Nmap. This page does not walk through firewall evasion.
Services
Version strings and an OS guess
-sV talks to the open port and prints a service name plus a version when the banner is recognized. In the screenshot, port 22 is ssh with an OpenSSH string, port 53 is domain with ISC BIND, and port 80 is http with Apache httpd. Port 25 and port 113 are closed.
-O compares replies with a fingerprint database. The screenshot says the OS match was not ideal because no UDP reply came back. That is a normal outcome, not a failed install. Nmap 7.99 added a large set of new IPv4 and IPv6 OS fingerprints and updated service fingerprints.
--version-light is the lighter version probe used in the Quick scan plus profile shown here.
Scripts
NSE in 7.991: 620 scripts, with limits
The Nmap Scripting Engine runs Lua scripts against services you choose. Scripts sit in categories such as default, discovery, auth, and vuln. You can run the default set, one category, or one script. -A includes the default set.
Time limit
A script thread that runs longer than 5 seconds without yielding, for example without a socket call, is killed.
Memory limit
An allocation past 400 MB throws an error. The project says those limits may change later.
Use NSE on hosts you are allowed to test. A script can log in, enumerate, or touch a service, so read its name before you add it.
GUI
Zenmap keeps the command in sight
Zenmap is the official interface. The target box, profile menu, and command line are the top of the window. Tabs are Nmap Output, Ports / Hosts, Topology, Host Details, and Scans. Profiles in the screenshots include Quick scan, Quick scan plus, and Intense scan. Pressing Scan runs the command in the Command field, so you can read it first.
7.96 added dark mode under Profile, Toggle Dark Mode. 7.991 fixed profile-editor crashes when a saved command contained a percent sign, plus a KeyError: 'vl_6_logo' crash and a DuplicateSectionError in the profile editor. If an older Zenmap still closes, update and read the Zenmap guide.
Installer
What an older setup window listed
The Windows installer is a Nullsoft setup. It asks for a folder and which pieces to keep: Nmap core files, the PATH registration, the packet driver, Zenmap, Ncat, and Ndiff. Nping is part of the suite as well.
This capture is older. It still lists WinPcap. Current installers install Npcap instead. Do not look for a WinPcap checkbox on 7.991. File sizes and the SHA-256 are on the download page.
The rest of the suite
Ncat, Ndiff, and Nping
Ncat
Ncat reads and writes across the network and can use TLS. It is the tool antivirus products flag most often, because it can attach a program to a connection. 7.991 fixed a memory-consuming hang in Ncat's HTTP proxy code for both connect and listen modes. Listen mode no longer sends termination signals to the whole process group. On Windows, a bug that made Ncat quit after about 2 minutes while reading stdin was fixed.
Ndiff
Compares two scan results so you can see a host or port that changed. 7.991 fixed make check-ndiff on Python 3.12 and newer.
Nping
Generates packets and shows replies. The --rate option refuses a rate above 1,000 packets per second because Nsock timers are millisecond based. Use --delay 0 if you need no cap. On Windows without Npcap, Nping can fall back to TCP connect mode.
Speed
Timing templates T0 through T5
Templates change how fast probes go out. Faster is not always better on a production LAN.
T0 and T1
Paranoid and sneaky. Very slow. Rarely what an inventory needs.
T2
Polite. A calmer choice when you must not crowd a link.
T3
Normal. The default when you do not pass -T.
T4
Aggressive. The Quick scan and Intense scan profiles in the screenshots use -T4.
T5
Insane. Easy to trip monitoring and to lose accuracy. Leave it for a lab.
Files
Output you can compare later
Normal
The text you see in the Nmap Output tab. -oN writes it to a file.
XML
-oX is the format other tools, including Ndiff, expect.
Grepable
-oG is a single-line style for quick searches. XML is the better archive.
All three
-oA writes normal, XML, and grepable files from one scan. 7.991 also lets --stats-every print progress when there is no terminal, together with --noninteractive.