Using Nmap

This tutorial is your practical introduction to Nmap (Network Mapper) — the Swiss Army knife of network scanning. We’ll explain what it does, how it works, when to use it, and how to interpret results safely and ethically. Whether you’re a beginner technician or an experienced professional, you’ll find actionable examples and advanced tips here.

What is Nmap?

Nmap is a free, open-source tool designed to discover hosts and services across a network.
It works by sending crafted packets to targets and analyzing their responses — revealing:

Which devices are online;
Which ports and protocols are open;
What operating systems and versions are running;
Which services may be vulnerable or misconfigured.

It’s used by network admins, security engineers, and pentesters around the world for visibility, auditing, and defense.

When to use Nmap — common use cases

Use Nmap whenever you need visibility of networked devices or services. Typical scenarios:

Inventory / asset discovery: find all devices on a LAN or in a subnet.
Network troubleshooting: check whether a server’s port is reachable.
Service discovery: see which services (HTTP, SSH, database ports) are listening.
Vulnerability triage / pentesting: identify versions and points to investigate further.
Compliance & audits: verify open ports match your security policy.
Baseline & monitoring: detect newly exposed services that shouldn’t be there.

Important legal/ethical note: only scan networks you own or where you have explicit permission. Unauthorized scanning can be illegal or disruptive.

Benefits of Nmap for professionals

Fast visibility: quickly map hosts and open ports in a network segment.
Low friction: simple commands for basic scans; deep options for advanced users.
Actionable intel: service/version detection and scripting engine help prioritize follow-ups.
Automation-friendly: scripts and output formats let you integrate Nmap into audits and pipelines.
Community & ecosystem: Nmap has a mature scripting library (NSE) and extensive docs.

How Nmap works (brief architecture)

At a high level:

Reporting: outputs results in human or machine-readable formats (-oN, -oX).
Host discovery: checks which IPs respond to pings or probes (-sn);
Port scanning: sends TCP/UDP packets to identify open ports (-sS, -sU);
Service & version detection: identifies what software is listening (-sV);
OS detection: infers operating system from network fingerprints (-O);
Script scanning: runs advanced scripts via NSE (--script);

Types of scans you should know

Scan Type	Command	Description	Use Case
SYN (Half-open)	`-sS`	Sends SYN, waits for SYN/ACK, doesn’t complete handshake.	Fast and stealthy TCP discovery.
Connect (Full)	`-sT`	Completes TCP handshake.	Use when raw sockets aren’t available.
UDP Scan	`-sU`	Tests UDP ports (slower, but essential for DNS, SNMP, etc.).	Auditing UDP-based services.
ACK Scan	`-sA`	Checks firewall filtering by sending TCP ACK packets.	Identify filtered vs unfiltered ports.
FIN/NULL/XMAS	`-sF`, `-sN`, `-sX`	Send unusual TCP flags; bypass some firewalls.	Stealth scans for research/testing.
Idle Scan	`-sI zombie_host`	Spoofs a third-party host to scan anonymously.	Advanced, rarely needed — for experts only.

The Nmap Scripting Engine (NSE)

NSE turns Nmap into a modular vulnerability scanner.
You can run scripts for:

Vulnerability detection: --script vuln
Authentication tests: --script auth
Brute-force attempts: --script brute
SSL/TLS inspection: --script ssl-cert,ssl-enum-ciphers
CVE-based detection: --script http-vuln*
Banner grabbing: --script banner

Example:

nmap --script ssl-cert -p 443 example.com

→ retrieves SSL certificate details.

You can also write custom NSE scripts in Lua, perfect for automated scanning pipelines.

Practical command examples

1. Discover active hosts

nmap -sn 192.168.1.0/24

2. Scan open TCP ports

nmap -sS -p 1-1000 192.168.1.10

3. Identify services and versions

nmap -sV target.example.com

4. Detect operating system

nmap -O 203.0.113.5

5. Aggressive scan (version + OS + traceroute)

nmap -A target.example.com

6. Run vulnerability scripts

nmap --script vuln 192.168.1.10

7. Save scan results

nmap -oA results 192.168.1.10

8. Evade firewalls (stealth example)

nmap -f -T2 203.0.113.5

(Fragment packets and slow down timing – use responsibly.)

Understanding results

State	Meaning	Action
open	Service is accepting connections.	Investigate necessity and patch.
closed	Port reachable but no service listening.	Generally safe but still reachable.
filtered	No response — likely blocked by firewall.	Verify firewall rules.
unfiltered	No filtering, but uncertain state.	Check manually.

Integration & automation

Nmap outputs can be used by:

SIEMs (e.g., Wazuh, Elastic) to correlate asset changes;
CICD pipelines for security checks (nmap -sV -oX > report.xml);
Python scripts (via python-nmap or libnmap) for custom automation;
Visualization tools (like Zenmap or IVRE) for graphical mapping.

Common mistakes to avoid

Scanning the wrong subnet (always double-check IP ranges);
Running too aggressive scans in production;
Forgetting to use output options (-oA) for reproducibility;
Ignoring UDP scans (often where vulnerabilities hide);
Treating results as proof of vulnerability instead of indicators.

Pro tips

Use --reason to understand why Nmap labels a port a certain way.
Combine -sV with --script=banner for detailed service info.
Use -Pn if ICMP is blocked but host is known alive.
Use timing templates (-T0 to -T5) carefully — -T4 is often the sweet spot.
Run in batches and monitor network performance.

Summary: your Nmap workflow

Discover hosts (-sn)
Scan ports (-sS or -sU)
Identify versions (-sV)
Run scripts (--script vuln)
Save outputs (-oA)
Correlate and report results

Conclusion

Nmap is far more than a “port scanner.” It’s a network reconnaissance platform that can reveal topology, detect vulnerabilities, and automate security checks — if used responsibly.
For beginners, start small and practice on local or lab networks.
For professionals, integrate it into your asset management and vulnerability lifecycle.
Used correctly, Nmap turns “unknown networks” into visible, understandable, and controllable systems — the foundation of any strong security posture.