17.打印主机接口和路由
　　你可以使用nmap的“–iflist”选项检测主机接口和路由信息。
　　[root@server1 ~]# nmap --iflist
　　Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-11 17:07 EST************************INTERFACES************************DEV  (SHORT) IP/MASK          TYPE     UP MAC
　　lo   (lo)    127.0.0.1/8      loopback up
　　eth0 (eth0)  192.168.0.100/24 ethernet up 08:00:27:11:C7:89
　　**************************ROUTES**************************DST/MASK      DEV  GATEWAY192.168.0.0/0 eth0169.254.0.0/0 eth0
　　从上面的输出你可以看到，nmap列举出了你系统上的接口以及它们各自的路由信息。
　　18.扫描特定的端口
　　使用Nmap扫描远程机器的端口有各种选项，你可以使用“-P”选项指定你想要扫描的端口，默认情况下nmap只扫描TCP端口。
　　[root@server1 ~]# nmap -p 80 server2.tecmint.com
　　Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-11 17:12 ESTInteresting ports on server2.tecmint.com (192.168.0.101):
　　PORT   STATE SERVICE80/tcp open  http
　　MAC Address: 08:00:27:D9:8E:D7 (Cadmus Computer Systems)
　　Nmap finished: 1 IP address (1 host up) sca
　　19.扫描TCP端口
　　你可以指定具体的端口类型和端口号来让nmap扫描。
　　[root@server1 ~]# nmap -p T:8888，80 server2.tecmint.com
　　Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-11 17:15 ESTInteresting ports on server2.tecmint.com (192.168.0.101):
　　PORT     STATE SERVICE80/tcp   open  http8888/tcp open  sun-answerbook
　　MAC Address: 08:00:27:D9:8E:D7 (Cadmus Computer Systems)
　　Nmap finished: 1 IP address (1 host up) scanned in 0.157 seconds
　　20.扫描UDP端口
　　[root@server1 ~]# nmap -sU 53 server2.tecmint.com
　　Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-11 17:15 ESTInteresting ports on server2.tecmint.com (192.168.0.101):
　　PORT     STATE SERVICE53/udp   open  http8888/udp open  sun-answerbook
　　MAC Address: 08:00:27:D9:8E:D7 (Cadmus Computer Systems)
　　Nmap finished: 1 IP address (1 host up) scanned in 0.157 seconds
　　21.扫描多个端口
　　你还可以使用选项“-P”来扫描多个端口。
　　[root@server1 ~]# nmap -p 80，443 192.168.0.101
　　Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-18 10:56 ESTInteresting ports on server2.tecmint.com (192.168.0.101):
　　PORT    STATE  SERVICE80/tcp  open   http443/tcp closed https
　　MAC Address: 08:00:27:D9:8E:D7 (Cadmus Computer Systems)
　　Nmap finished: 1 IP address (1 host up) scanned in 0.190 seconds
　　22.扫描指定范围内的端口
　　您可以使用表达式来扫描某个范围内的端口。
　　[root@server1 ~]#  nmap -p 80-160 192.168.0.101
　　23.查找主机服务版本号
　　[root@server1 ~]# nmap -sV 192.168.0.101
　　Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-11 17:48 ESTInteresting ports on server2.tecmint.com (192.168.0.101):
　　Not shown: 1674 closed ports
　　PORT     STATE SERVICE VERSION22/tcp   open  ssh     OpenSSH 4.3 (protocol 2.0)80/tcp   open  http    Apache httpd 2.2.3 ((CentOS))111/tcp  open  rpcbind  2 (rpc #100000)957/tcp  open  status   1 (rpc #100024)3306/tcp open  mysql   MySQL (unauthorized)8888/tcp open  http    lighttpd 1.4.32MAC Address: 08:00:27:D9:8E:D7 (Cadmus Computer Systems)
　　Nmap finished: 1 IP address (1 host up) scanned in 12.624 seconds
　　24.使用TCP ACK (PA)和TCP Syn (PS)扫描远程主机
　　有时候包过滤防火墙会阻断标准的ICMP ping请求，在这种情况下，我们可以使用TCP ACK和TCP Syn方法来扫描远程主机。
　　[root@server1 ~]# nmap -PS 192.168.0.101
　　Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-11 17:51 ESTInteresting ports on server2.tecmint.com (192.168.0.101):
　　Not shown: 1674 closed ports
　　PORT     STATE SERVICE22/tcp   open  ssh80/tcp   open  http111/tcp  open  rpcbind957/tcp  open  unknown3306/tcp open  mysql8888/tcp open  sun-answerbook
　　MAC Address: 08:00:27:D9:8E:D7 (Cadmus Computer Systems)
　　Nmap finished: 1 IP address (1 host up) scanned in 0.360 seconds
　　You have new mail in /var/spool/mail/root
　　25.使用TCP ACK扫描远程主机上特定的端口
　　[root@server1 ~]# nmap -PA -p 22，80 192.168.0.101
　　Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-11 18:02 ESTInteresting ports on server2.tecmint.com (192.168.0.101):
　　PORT   STATE SERVICE22/tcp open  ssh80/tcp open  http
　　MAC Address: 08:00:27:D9:8E:D7 (Cadmus Computer Systems)
　　Nmap finished: 1 IP address (1 host up) scanned in 0.166 seconds
　　You have new mail in /var/spool/mail/root
　　26. 使用TCP Syn扫描远程主机上特定的端口
　　[root@server1 ~]# nmap -PS -p 22，80 192.168.0.101
　　Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-11 18:08 ESTInteresting ports on server2.tecmint.com (192.168.0.101):
　　PORT   STATE SERVICE22/tcp open  ssh80/tcp open  http
　　MAC Address: 08:00:27:D9:8E:D7 (Cadmus Computer Systems)
　　Nmap finished: 1 IP address (1 host up) scanned in 0.165 seconds
　　You have new mail in /var/spool/mail/root
　　27.执行一次隐蔽的扫描
　　[root@server1 ~]# nmap -sS 192.168.0.101
　　Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-11 18:10 ESTInteresting ports on server2.tecmint.com (192.168.0.101):
　　Not shown: 1674 closed ports
　　PORT     STATE SERVICE22/tcp   open  ssh80/tcp   open  http111/tcp  open  rpcbind957/tcp  open  unknown3306/tcp open  mysql8888/tcp open  sun-answerbook
　　MAC Address: 08:00:27:D9:8E:D7 (Cadmus Computer Systems)
　　Nmap finished: 1 IP address (1 host up) scanned in 0.383 seconds
　　You have new mail in /var/spool/mail/root
　　28.使用TCP Syn扫描常用的端口
　　[root@server1 ~]# nmap -sT 192.168.0.101
　　Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-11 18:12 ESTInteresting ports on server2.tecmint.com (192.168.0.101):
　　Not shown: 1674 closed ports
　　PORT     STATE SERVICE22/tcp   open  ssh80/tcp   open  http111/tcp  open  rpcbind957/tcp  open  unknown3306/tcp open  mysql8888/tcp open  sun-answerbook
　　MAC Address: 08:00:27:D9:8E:D7 (Cadmus Computer Systems)
　　Nmap finished: 1 IP address (1 host up) scanned in 0.406 seconds
　　You have new mail in /var/spool/mail/root
　　29.执行TCP空扫描以骗过防火墙
　　[root@server1 ~]# nmap -sN 192.168.0.101
　　Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-11 19:01 ESTInteresting ports on server2.tecmint.com (192.168.0.101):
　　Not shown: 1674 closed ports
　　PORT     STATE         SERVICE22/tcp   open|filtered ssh80/tcp   open|filtered http111/tcp  open|filtered rpcbind957/tcp  open|filtered unknown3306/tcp open|filtered mysql8888/tcp open|filtered sun-answerbook
　　MAC Address: 08:00:27:D9:8E:D7 (Cadmus Computer Systems)
　　Nmap finished: 1 IP address (1 host up) scanned in 1.584 seconds
　　You have new mail in /var/spool/mail/root