TCP Connect Scan

A TCP connect scan establishes a complete connection to the target host by completing a TCP three-way handshake. After the scan is complete, Nmap terminates the connection.

Note: This is not to be confused with another common scan technique, the TCP SYN stealth scan (-sS), which completes up to half of its connection with the target host. Therefore, the TCP connect scan takes longer and requires more packets to perform.

The following image shows how this scan connects with the TCP three-way handshake and then terminates afterward:

Syntax

nmap -sT <target>

A TCP connect scan connects to a

Example

The following example performs a TCP connect scan on the site scanme.nmap.org:

nmap -sT scanme.nmap.org

Note: This is a site explicitly set up for testing Nmap. Scans should only be performed on domains with explicit permissions given to the user.

This results in the following output:

Starting Nmap 7.80 ( https://nmap.org ) at 2022-12-24 17:08 EST
Nmap scan report for scanme.nmap.org (45.33.32.156)
Host is up (0.095s latency).
Other addresses for scanme.nmap.org (not scanned): 2600:3c01::f03c:91ff:fe18:bb2f
Not shown: 992 closed ports
PORT      STATE    SERVICE
22/tcp    open     ssh
25/tcp    filtered smtp
80/tcp    open     http
135/tcp   filtered msrpc
139/tcp   filtered netbios-ssn
445/tcp   filtered microsoft-ds
9929/tcp  open     nping-echo
31337/tcp open     Elite

Nmap done: 1 IP address (1 host up) scanned in 4.03 seconds