How to specify Nmap targets: CIDR, ranges, input lists, and exclusions

The target syntaxes

Nmap accepts hostnames, single addresses, CIDR blocks like 10.10.0.0/24, and octet ranges like 10.10.0-3.1-50, where each octet can hold a range or a comma list. Several targets can be listed on one command line separated by spaces. For anything longer than a few entries, put one target per line in a file and pass it with -iL.

CIDR math is where mistakes hide. A /16 is 65,536 addresses, not 256. If someone hands you “10.20.0.0/16” as a scope, confirm they meant it, because that is a different conversation from scanning one office floor.

Preview with a list scan

The -sL option is a list scan. It expands your targets, optionally does reverse DNS, and prints every address it would scan without sending a single probe to them. Run it before every real scan of a new scope and compare the count to what you expected.

Reverse DNS names in the list output are a quick sanity check. If a range you believed was the lab returns names under a production domain, stop and confirm the scope before going further. Add -n to the list scan if you want to avoid DNS queries entirely.

Snippet

nmap -sL -n -iL scope.txt | grep "Nmap scan report" | wc -l

Lab: build a scope file with exclusions

Create scope.txt with your lab subnet and an exclude.txt with the gateway and your own scanning machine. The --excludefile option removes those addresses from the expanded list. Run a list scan with both files and confirm the excluded addresses are gone, then run the real ping scan using the same two files.

Keeping scope and exclusions in files that live with your engagement notes gives you a record of exactly what was in bounds. If a host owner later asks whether you touched their address, the file and the saved output answer the question.

Snippet

printf "192.168.56.0/24\n" > scope.txt
printf "192.168.56.1\n192.168.56.10\n" > exclude.txt
nmap -sL -n -iL scope.txt --excludefile exclude.txt | tail -3
sudo nmap -sn -iL scope.txt --excludefile exclude.txt -oA discovery

Common target mistakes

Hostnames resolve at scan time, so a name that points to a load balancer or a CDN may land on an address that belongs to someone else. Resolve and confirm names first, then scan addresses.

Randomized target ordering with --randomize-hosts spreads load, but it also makes partial output harder to read. For small lab scopes, the default order is fine.

Diagram

From scope to scan without surprises

Write
Put in-scope ranges in scope.txt and out-of-scope hosts in exclude.txt.
Preview
Expand the list with -sL -n and count addresses.
Command
```
nmap -sL -n -iL scope.txt --excludefile exclude.txt
```
Compare
Check the count and any reverse DNS names against the agreed scope.
Scan
Run the real scan with the same two files and save output with -oA.

Check yourself

1. How many addresses are in 10.20.0.0/16?

2. Which option prints the expanded target list without probing the targets?

3. A hostname in scope points at a CDN. What should you do before scanning it?