Why scan all 65535 ports, and how do you do it efficiently with nmap?

A surprising number of OSCP boxes deliberately place their key service on a non-standard high port — say a web app on 8080 or a custom service on 50000. nmap's default behavior only probes the 1000 most common ports, so if you trust the default you will simply never see that service and the box becomes impossible.

The two-stage pattern

Running a deep version and script scan across all 65535 ports is painfully slow. The efficient approach splits the work:

1. Fast discovery. A SYN scan across every port (nmap -p- --min-rate 1000 <ip>) tells you which ports are open quickly without doing expensive probing.
2. Targeted depth. Take only the open ports and run version detection and default scripts against them (nmap -p 22,80,8080 -sV -sC <ip>). This gives banners, software versions, and quick wins like anonymous FTP or exposed shares. The nmap scans that survive real networks cheatsheet covers the timing and evasion flags worth knowing.

Why the order matters

Version numbers from -sV are the seed for searchexploit and CVE lookups. The default scripts in -sC are safe, lightweight checks that often surface low-hanging fruit. Saving them for the focused pass keeps your initial sweep fast.

Do not forget UDP

TCP is the priority, but services like SNMP (161), TFTP (69), and DNS (53) live on UDP and are easy to overlook. A top-ports UDP scan (nmap -sU --top-ports 100) catches the common ones; UDP is slow because closed ports often do not reply, so full UDP sweeps are rarely worth it on the clock.

What interviewers look for

They want the candidate who knows the default misses high ports, splits discovery from deep scanning for speed, and remembers UDP exists. Naming the actual flags and explaining the trade-offs shows real hands-on time.