Post History
According to nmap's documentation, it scans the 1000 most commonly open ports. How does it know, which ports are common? It consults the file nmap-services, located at /usr/share/nmap/nmap-service...
#1: Initial revision
by
Matthias Braun
·
2026-03-06T16:38:54Z (7 months ago)
According to [nmap's documentation](https://nmap.org/book/nmap-services.html), it scans the 1000 most commonly open ports.
How does it know, which ports are common? It consults the file `nmap-services`, located at `/usr/share/nmap/nmap-services` on Arch Linux that contains the column "port frequency" that determines whether a port has been commonly found open or not.
You can see the scanned ports by adding the debugging option twice to `nmap`, as in:
nmap -dd localhost