nnmap

nnmap is a high-performance network scanning tool implemented in Go, designed to replicate nmap's core functionality. nnmap provides port scanning, service detection, operating system detection, and more, while maintaining a similar command-line interface and output format to nmap.

✨ Core Features

🚀 Scanning Capabilities

• Port Scanning: Supports TCP SYN, TCP Connect, UDP, FIN, Null, Xmas, ACK and other scanning methods
• Service Detection: Signature-based service version detection for TCP and UDP protocols
• Operating System Detection: OS fingerprinting through TCP/IP stack analysis
• Host Discovery: Multiple probe types including ICMP, TCP, UDP, SCTP
• Traceroute: Trace the network path to target hosts

🔧 Build Options

• Static Build Support: Pure Go compilation without CGO dependencies, suitable for containerized deployment
• Embedded Data Files: Optionally embed data files into binary for single-file distribution
• Flexible Building: Control feature modules through build tags for different use cases

⚡ Performance Advantages

• Concurrent Scanning: Multi-port, multi-host concurrent scanning with full resource utilization
• Smart Timeout: Adaptive timeout mechanism based on network conditions
• Timing Templates: Six timing templates (T0-T5) balancing speed and accuracy

📦 Installation

Build from Source

Standard Build (Full Features)

# Clone repository
git clone https://github.com/vsermae/nnmap.git
cd nnmap

# Build (with embedded data files, recommended)
go build -ldflags="-s -w" -o nnmap ./cmd/nnmap

Static Build (Pure Go, No CGO)

Suitable for Docker Alpine, CI/CD, and similar environments:

CGO_ENABLED=0 go build -tags norawsocket -ldflags="-s -w" -o nnmap ./cmd/nnmap

Build Options Comparison

Build Option	Command	Features
Standard Mode	go build -o nnmap ./cmd/nnmap	SYN/UDP scanning, OS detection, requires libpcap
Standard (No Embed)	go build -tags noembed_data -o nnmap ./cmd/nnmap	Requires external data directory
Static Mode	CGO_ENABLED=0 go build -tags norawsocket -o nnmap ./cmd/nnmap	Pure Go, Connect scan only, suitable for containers
Static (No Embed)	CGO_ENABLED=0 go build -tags norawsocket,noembed_data -o nnmap ./cmd/nnmap	Minimal size, requires external data

🚀 Quick Start

Basic Usage

# TCP Connect scan (no root required)
./nnmap -sT 192.168.1.1

# TCP SYN scan (root required)
sudo ./nnmap -sS 192.168.1.1

# UDP scan
sudo ./nnmap -sU 192.168.1.1

# Specify port range
./nnmap -sT -p 1-1000 192.168.1.1

# Service version detection
./nnmap -sT -sV 192.168.1.1

# Operating system detection
sudo ./nnmap -O 192.168.1.1

# Aggressive scan
sudo ./nnmap -A 192.168.1.1

Host Discovery

# Ping scan (no port scan)
./nnmap -sn 192.168.1.0/24

# TCP SYN ping
./nnmap -sn -PS80,443 192.168.1.0/24

# ICMP Echo ping
sudo ./nnmap -sn -PE 192.168.1.0/24

# Traceroute
sudo ./nnmap --traceroute 192.168.1.1

Performance Tuning

# Use timing template (T0-T5, higher is faster)
./nnmap -T4 192.168.1.1

# Set parallelism
./nnmap --min-parallelism 10 --max-parallelism 100 192.168.1.1

# Limit packet rate
./nnmap --max-rate 100 192.168.1.1

Output Options

# Show only open ports
./nnmap --open 192.168.1.1

# Output to file
./nnmap -oN result.txt 192.168.1.1
./nnmap -oX result.xml 192.168.1.1

# Verbose output
./nnmap -v 192.168.1.1
./nnmap -vv 192.168.1.1  # More verbose

📊 Feature Comparison

Feature	Standard Mode	Static Mode	Notes
TCP SYN Scan (-sS)	✅	❌	Requires rawsocket support
TCP Connect Scan (-sT)	✅	✅	No special privileges needed
UDP Scan (-sU)	✅	❌	Requires rawsocket support
TCP FIN/Null/Xmas Scan	✅	❌	Requires rawsocket support
Service Version Detection (-sV)	✅	✅	Supports TCP and UDP
OS Detection (-O)	✅	❌	Requires rawsocket support
Host Discovery (-sn)	✅	✅	ICMP requires root
Traceroute (--traceroute)	✅	❌	Requires rawsocket support
Requires CGO	❌	✅	Static mode is pure Go
Depends on libpcap	✅	❌	Standard mode requires
Alpine Compatible	❌	✅	Static mode for containers

🎯 Use Cases

Standard Mode

• ✅ Security auditing and penetration testing
• ✅ Full scanning capabilities required
• ✅ Root privileges and libpcap available
• ✅ Network device and service exploration

Static Mode

• ✅ Containerized environments (Docker, Kubernetes)
• ✅ CI/CD pipeline integration
• ✅ Service discovery without root privileges
• ✅ Alpine Linux environments
• ✅ Quick port availability checks

📖 Command Reference

Target Specification

-iL <inputfilename>    Read targets from file
<target specification> IP addresses, ranges, or CIDR notation

Scan Types

-sS    TCP SYN scan (stealth scan)
-sT    TCP Connect scan
-sU    UDP scan
-sV    Service version detection
-sA    TCP ACK scan
-sF    TCP FIN scan
-sN    TCP Null scan
-sX    TCP Xmas scan

Host Discovery

-sn    Ping scan - disable port scan
-sL    List scan - list targets only
-Pn    Treat all hosts as online - skip host discovery
-PS    TCP SYN Ping
-PA    TCP ACK Ping
-PU    UDP Ping
-PE    ICMP Echo Ping
-PP    ICMP Timestamp Ping
-PM    ICMP Netmask Ping
-PO    IP Protocol Ping

Port Specification

-p <port ranges>    Specify port ranges
                    Examples: -p22; -p1-65535; -p U:53,111,137,T:21-25,80,139,8080

OS Detection

-O    Enable OS detection
-A    Aggressive mode: enable OS detection, version detection, script scanning, and traceroute

Performance and Timing

-T<0-5>                    Set timing template (higher is faster)
--min-parallelism <num>    Minimum parallelism
--max-parallelism <num>    Maximum parallelism
--min-rate <rate>          Minimum packet rate
--max-rate <rate>          Maximum packet rate
--scan-delay <ms>          Scan delay (milliseconds)

Output

-v              Increase verbosity level
-oN <file>      Output normal format to file
-oX <file>      Output XML format to file
--open          Only show open ports

Miscellaneous

-6                        Enable IPv6 scanning
-n                        Never do DNS resolution
-R                        Always resolve DNS
--dns-servers <serv1[,serv2],...>    Specify custom DNS servers
--traceroute              Perform traceroute

🏗️ Project Structure

nnmap/
├── cmd/nnmap/              # Main entry point
│   ├── main.go             # Main logic
│   ├── help_*.go           # Help information (conditional build)
│   └── *_*.go              # Feature modules (conditional build)
├── internal/               # Internal packages
│   ├── data/               # Data management
│   ├── hostdiscovery/      # Host discovery
│   ├── osdetect/           # OS detection
│   ├── packet/             # Packet processing
│   ├── portlist/           # Port list management
│   ├── scanengine/         # Scan engine
│   │   ├── connect/        # Connect scan
│   │   ├── synscan/        # SYN scan
│   │   └── udpscan/        # UDP scan
│   ├── service/            # Service detection
│   ├── target/             # Target parsing
│   └── timing/             # Timing control
├── embeddata/              # Embedded data interface
├── data/                   # Data files directory
│   ├── nmap-services
│   ├── nmap-protocols
│   ├── nmap-mac-prefixes
│   ├── nmap-os-db
│   └── nmap-service-probes
└── go.mod                  # Go module definition

🔬 Technical Implementation

Core Features

• Concurrent Architecture: Efficient concurrent scanning using goroutines and channels
• Smart Scheduling: Adaptive timeout and retransmission mechanisms for efficiency
• Modular Design: Flexible feature control through build tags
• Compatibility: Output format consistent with nmap for easy tool integration

Scanning Principles

• SYN Scan: Send SYN packets, determine port status from responses
• Connect Scan: Complete three-way handshake, no special privileges needed
• UDP Scan: Send UDP probes, judge based on response or timeout
• Service Detection: Pattern matching based on nmap-service-probes
• OS Detection: Operating system matching through TCP/IP fingerprint database

🤝 Contributing

Contributions are welcome! Please feel free to submit issues or pull requests.

1. Fork the repository
2. Create feature branch (git checkout -b feature/AmazingFeature)
3. Commit changes (git commit -m 'Add some AmazingFeature')
4. Push to branch (git push origin feature/AmazingFeature)
5. Open Pull Request

Development Guidelines

• Ensure go test ./... passes
• Follow Go code conventions
• Add necessary unit tests
• Update relevant documentation

📄 License

This project is licensed under the GNU General Public License v3.0 - see LICENSE file for details

Important Note: This project uses data files from the nmap project (such as nmap-services, nmap-service-probes, nmap-os-db, etc.), which are licensed under GPLv2. To ensure license compatibility, this project adopts the GPLv3 license.

🙏 Acknowledgments

• Thanks to nmap for inspiration, data files, and technical references
• Thanks to gopacket for network packet processing capabilities
• Thanks to all contributors

⚠️ Legal Notice

The data files used in this project are from the nmap project and are copyrighted by Insecure.Com LLC. These data files include but are not limited to:

• nmap-services
• nmap-service-probes
• nmap-os-db
• nmap-protocols
• nmap-mac-prefixes

These data files are licensed under the GNU General Public License Version 2. For more information about nmap's license, please visit: https://nmap.org/

---

⚠️ Disclaimer: Please comply with local laws and regulations. Only use this tool for network scanning within authorized scope. Unauthorized scanning may violate the law.