> For the complete documentation index, see [llms.txt](https://notes.cavementech.com/pentesting-quick-reference/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.cavementech.com/pentesting-quick-reference/scanning/nmap-alternatives.md).

# Nmap Alternatives

### Smap

<p align="center"><strong>passive Nmap like scanner built with shodan.io</strong></p>

{% embed url="<https://github.com/s0md3v/Smap>" %}

### Naabu

{% embed url="<https://github.com/projectdiscovery/naabu>" %}

<figure><img src="/files/lP3qyQfnDKtBHT28WNz3" alt=""><figcaption></figcaption></figure>

### fping

```
fping -a -g 10.10.23.0/24 2>/dev/null > live_hosts.txt
```

* `-a`: This flag stands for "alive." It filters the output to *only* show you the hosts that respond to the ping request.
* `-g`: This flag stands for "generate." It tells `fping` to generate a list of target IP addresses from a given range.
* `10.10.23.0/24`: This is the target network you are scanning.
  * The `/24` (a CIDR notation) represents a subnet mask of `255.255.255.0`.
  * This tells `fping` to generate and scan all 256 IP addresses in this range, from `10.10.23.0` to `10.10.23.255`.

<figure><img src="/files/fgWqcPpkxfrvlSuV2crf" alt=""><figcaption></figcaption></figure>

### Zenmap

{% file src="/files/8wGrmswsUtPtD1xTBfyb" %}