Packet Trace (--packet_trace)
The --packet_trace option provides a network-level packet display of nmap's conversations during the scan process. This includes a timestamp, IP addresses, port numbers, and protocol header information. This option is extremely useful for learning more about how nmap interacts with remote devices. This can be used as a powerful educational tool for any network professional!

clock
The packet trace option shows network interactions only, not nmap's internal debugging information. However, if the debug option level is greater than 2, the --packet_trace option will be enabled automatically.



The --packet_trace output is displayed to stdout and can also be saved to nmap's normal (-oN) output file. This packet trace information will not be saved into greppable (-oG) or XML (-oX) output files.

An excerpt from the standard output shows the extensive network information contained in the packet trace:
SENT (0.0340s) ICMP 192.168.0.7 > 192.168.0.1 Echo request (type=8/code=0) ttl=57 id=55712 iplen=28
SENT (0.0350s) TCP 192.168.0.7:57019 > 192.168.0.1:80 A ttl=53 id=54387 iplen=40 seq=3243190494 win=2048 ack=2504992990
RCVD (0.0350s) ICMP 192.168.0.1 > 192.168.0.7 Echo reply (type=0/code=0) ttl=64 id=16746 iplen=28
SENT (0.5710s) TCP 192.168.0.7:56996 > 192.168.0.1:3389 S ttl=44 id=14391 iplen=40 seq=860312039 win=1024
SENT (0.5710s) TCP 192.168.0.7:56996 > 192.168.0.1:80 S ttl=55 id=29561 iplen=40 seq=860312039 win=4096
SENT (0.5710s) TCP 192.168.0.7:56996 > 192.168.0.1:636 S ttl=51 id=60961 iplen=40 seq=860312039 win=4096
SENT (0.5710s) TCP 192.168.0.7:56996 > 192.168.0.1:23 S ttl=44 id=26608 iplen=40 seq=860312039 win=1024
SENT (0.5710s) TCP 192.168.0.7:56996 > 192.168.0.1:21 S ttl=46 id=52419 iplen=40 seq=860312039 win=3072
SENT (0.5710s) TCP 192.168.0.7:56996 > 192.168.0.1:113 S ttl=48 id=42709 iplen=40 seq=860312039 win=1024
SENT (0.5710s) TCP 192.168.0.7:56996 > 192.168.0.1:389 S ttl=54 id=37581 iplen=40 seq=860312039 win=3072
SENT (0.5710s) TCP 192.168.0.7:56996 > 192.168.0.1:256 S ttl=58 id=56038 iplen=40 seq=860312039 win=3072
SENT (0.5710s) TCP 192.168.0.7:56996 > 192.168.0.1:53 S ttl=40 id=9325 iplen=40 seq=860312039 win=1024
SENT (0.5720s) TCP 192.168.0.7:56996 > 192.168.0.1:1723 S ttl=42 id=64956 iplen=40 seq=860312039 win=3072
RCVD (0.5720s) TCP 192.168.0.1:3389 > 192.168.0.7:56996 RA ttl=64 id=16750 iplen=40 seq=0 win=0 ack=860312039
RCVD (0.5720s) TCP 192.168.0.1:80 > 192.168.0.7:56996 SA ttl=64 id=16751 iplen=44 seq=28372096 win=3072 ack=860312040
RCVD (0.5730s) TCP 192.168.0.1:636 > 192.168.0.7:56996 RA ttl=64 id=16752 iplen=40 seq=0 win=0 ack=860312039
RCVD (0.5730s) TCP 192.168.0.1:23 > 192.168.0.7:56996 RA ttl=64 id=16753 iplen=40 seq=0 win=0 ack=860312039
RCVD (0.5740s) TCP 192.168.0.1:21 > 192.168.0.7:56996 RA ttl=64 id=16754 iplen=40 seq=0 win=0 ack=860312039
RCVD (0.5750s) TCP 192.168.0.1:113 > 192.168.0.7:56996 RA ttl=64 id=16755 iplen=40 seq=0 win=0 ack=860312039
RCVD (0.5750s) TCP 192.168.0.1:389 > 192.168.0.7:56996 RA ttl=64 id=16756 iplen=40 seq=0 win=0 ack=860312039
RCVD (0.5750s) TCP 192.168.0.1:256 > 192.168.0.7:56996 RA ttl=64 id=16757 iplen=40 seq=0 win=0 ack=860312039
RCVD (0.5760s) TCP 192.168.0.1:53 > 192.168.0.7:56996 RA ttl=64 id=16758 iplen=40 seq=0 win=0 ack=860312039
RCVD (0.5770s) TCP 192.168.0.1:1723 > 192.168.0.7:56996 RA ttl=64 id=16759 iplen=40 seq=0 win=0 ack=860312039
SENT (0.5770s) TCP 192.168.0.7:56996 > 192.168.0.1:22 S ttl=48 id=11606 iplen=40 seq=860312039 win=1024
SENT (0.5770s) TCP 192.168.0.7:56996 > 192.168.0.1:554 S ttl=46 id=53764 iplen=40 seq=860312039 win=3072
SENT (0.5770s) TCP 192.168.0.7:56996 > 192.168.0.1:443 S ttl=59 id=34121 iplen=40 seq=860312039 win=4096
SENT (0.5770s) TCP 192.168.0.7:56996 > 192.168.0.1:25 S ttl=49 id=45437 iplen=40 seq=860312039 win=2048
SENT (0.5770s) TCP 192.168.0.7:56996 > 192.168.0.1:428 S ttl=52 id=19724 iplen=40 seq=860312039 win=1024
SENT (0.5770s) TCP 192.168.0.7:56996 > 192.168.0.1:2 S ttl=38 id=27980 iplen=40 seq=860312039 win=3072
SENT (0.5770s) TCP 192.168.0.7:56996 > 192.168.0.1:818 S ttl=50 id=57246 iplen=40 seq=860312039 win=3072
SENT (0.5770s) TCP 192.168.0.7:56996 > 192.168.0.1:1492 S ttl=45 id=19237 iplen=40 seq=860312039 win=2048
SENT (0.5780s) TCP 192.168.0.7:56996 > 192.168.0.1:958 S ttl=54 id=60894 iplen=40 seq=860312039 win=3072
SENT (0.5780s) TCP 192.168.0.7:56996 > 192.168.0.1:754 S ttl=49 id=46608 iplen=40 seq=860312039 win=2048
SENT (0.5780s) TCP 192.168.0.7:56996 > 192.168.0.1:3531 S ttl=45 id=8839 iplen=40 seq=860312039 win=2048
SENT (0.5780s) TCP 192.168.0.7:56996 > 192.168.0.1:720 S ttl=38 id=31256 iplen=40 seq=860312039 win=3072
If a version scan (-sV) is combined with the --packet_trace option, the --version_trace option is automatically enabled.