📑 Table of Contents

• 1. What is Nmap?
• 2. What are Nmap Commands?
• 3. Key Takeaways
• 4. Port Scanning Basics
• 5. Installation Guide
• 6. Complete Command Reference
• 7. NSE Scripts
• 8. Firewall Evasion
• 9. Timing & Performance
• 10. Lab Tutorials
• 11. Real Use Cases
• 12. Nmap vs Alternatives
• 13. FAQ
• 14. Common Mistakes

💡 Quick Start: One command — nmap <target> — performs host discovery and scans the 1,000 most common TCP ports. Run with sudo for a stealthier SYN scan.

# Basic Nmap command structure

nmap [flags] [target]

# Examples:

sudo nmap -sS -sV 192.168.1.10

nmap -p 80,443 -sC scanme.nmap.org

• 1 Nmap is the industry-standard network mapper — host discovery, port scanning, service/version detection, OS fingerprinting, and scripting (NSE) in one tool.
• 2 Default command is enough for quick checks — nmap <target>; layered flags (-sV, -sC, -O, -p-) unlock full enumeration depth.
• 3 Port states matter — open, closed, filtered, and open|filtered each tell you something different about the host and its firewall.
• 4 Timing templates (-T0 to -T5) control scan speed and stealth — they trade accuracy for speed.
• 5 NSE scripts turn Nmap into a mini vulnerability scanner — vulners, smb-vuln-ms17-010, http-enum, and hundreds more.
• ⚠ Always define scope and get written authorization before scanning anything you don’t own. Unauthorized scanning is illegal in most jurisdictions.

🔑 Why this matters for Nmap: -sS (SYN scan) sends SYN and on SYN-ACK sends RST to tear down — connection never completes, faster and stealthier. -sT (Connect scan) completes the full handshake through the OS socket API — visible to service logs.

# Verify installation

nmap –version # Shows version and build info

nmap -h # Full option summary

sudo nmap -sS -p 22 127.0.0.1 # Smoke test against localhost

nmap -sL <targets> — List scan (DNS only)
Resolves reverse DNS without sending packets. Best practice: validate target lists before scanning.

sudo nmap -sn <targets> — Ping sweep (host discovery only)
Default probes: ICMP echo, TCP SYN to 443, TCP ACK to 80, ICMP timestamp; local subnet uses ARP. No port scan.

nmap -Pn <target> — Skip host discovery (treat all as up)
Essential when ICMP is blocked. Warning: scanning large ranges wastes time on dead IPs.

nmap -PS80,443 <target> — TCP SYN ping
Sends SYN to listed ports; any response marks host up. Good for hosts that block ICMP.

nmap <target> — Default scan
Baseline: host discovery + top 1000 TCP ports. As root: SYN scan; non-root: connect scan.

sudo nmap -sS <target> — SYN (half-open) scan
Sends SYN; SYN-ACK → open (then RST to abort), RST → closed, no reply → filtered. Requires root. Faster and stealthier than connect scan.

nmap -sT <target> — TCP connect scan
Full handshake via OS sockets; works without root; visible in service logs.

sudo nmap -sU <target> — UDP scan
Sends UDP probes; ICMP port-unreachable → closed, data reply → open, silence → open|filtered. Slow by nature — use --top-ports 50.

nmap -p- <target> — All 65535 ports
Scans every TCP port. Critical for thorough assessments — many services run on non-standard high ports.

nmap --top-ports 100 <target> — Top-N ports
Scans the most frequently used ports. Balances speed and coverage.

nmap -sV <target> — Version detection
Probes open ports with protocol-specific payloads — e.g., 80/tcp open http nginx 1.24.0. Critical for vulnerability research.

sudo nmap -O <target> — OS fingerprinting
Analyzes TCP/IP stack quirks against a database of 6,000+ fingerprints. Best with one open and one closed port.

sudo nmap -A <target> — Aggressive all-in-one
Combines -O + -sV + -sC + --traceroute. The go-to for thorough scanning of a single authorized host.

sudo nmap -sC <target> — Default scripts
Runs the “safe” script category — non-intrusive checks (banner grabs, common misconfigurations).

nmap --script=http-title -p 80 <target> — Run specific scripts
By name or comma-separated: --script=http-title,http-headers

nmap --script=vulners <target> — CVE lookup
Queries Vulners API for CVEs matching detected services/versions. Requires internet. Always verify findings manually.

nmap --script=smb-vuln-ms17-010 -p 445 <target> — EternalBlue checker
Specific vulnerability script. Never run on production without authorization.

sudo nmap -f <target> — Fragment packets
Splits packets into 8-byte fragments to slip past simple filters that don’t reassemble.

sudo nmap -D RND:10 <target> — Decoy scan
Spoofs random decoy source IPs to bury the real scan. Does not guarantee anonymity.

sudo nmap -g 53 <target> — Source port spoofing
Sets source port to 53 (DNS) — some legacy firewalls trust DNS source ports.

sudo nmap --badsum <target> — Bad checksum
Sends packets with wrong TCP checksums; most stacks drop them, but some firewalls respond — revealing their presence.

--min-rate 1000 / --max-rate 200 — Explicit packet rates

--host-timeout 30m — Abort slow hosts; essential for mixed-response networks

--max-retries 2 — Reduces retries; speeds scans but increases false “filtered” results

-n — Skip DNS resolution (speeds up large scans)

-oN file.txt — Normal output (human-readable)

-oX file.xml — XML output (canonical for tools)

-oG file.gnmap — Grepable output (scripting/automation)

-oA basename — All formats (.nmap, .xml, .gnmap) — the professional default

-v / -vv — Verbosity (adds progress and port states)

--reason — Show state rationale (indispensable for firewall analysis)

Lab 1 — Discover live hosts
sudo nmap -sn 192.168.56.0/24
Expected: list of up-hosts with MAC addresses and vendors. Compare with your known inventory.

Lab 2 — Identify open services
sudo nmap -sV -p- 192.168.56.10
Expected: every TCP port with service + version. Cross-check one result manually (e.g., curl -I against the web port).

Lab 3 — Detect operating systems
sudo nmap -O 192.168.56.10
Ensure at least one open and one closed port. Compare the guess with the VM’s actual OS.

Lab 4 — Safe NSE scripts
sudo nmap -sC -sV -p 80,443,22 192.168.56.10
Review each script result and verify one finding manually.

1. Auditing a small office network
Goal: inventory every device. Approach: -sn sweep, then -sV on live hosts. Interpretation: unexpected hosts/ports = investigation trigger.

2. Verifying exposed services before deployment
Goal: confirm only intended ports listen externally. Approach: external -Pn -p- scan of the public IP; compare with the allowed list.

3. Checking firewall rules after changes
Goal: prove a rule blocks/permits as designed. Approach: -sS + --reason from both sides of the firewall; verify states match intent.

• Scanning without authorization — the single most serious error; a signed scope document is non-negotiable.
• Misinterpreting filtered ports — filtered ≠ closed; it means “firewall in the path.” Verify with --reason and -sA.
• Ignoring firewall behavior — assuming “no response” means the host is down; use -Pn and understand stateful filtering.
• Using aggressive timing on production — -T5/--min-rate causes packet loss and can disrupt services.
• Forgetting to save results — no -oA, no evidence, no report. Always -oA.
• Trusting the default 1000 ports — critical services on high ports are invisible without -p-.
• Skipping version detection — reporting “port 80 open” without “nginx 1.24.0” is incomplete enumeration.
• Running intrusive NSE scripts blindly — --script=vuln or intrusive against production can crash services.
• No verification — reporting NSE or vulners output as fact without manual confirmation.
• Ignoring UDP entirely — DNS, SNMP, NTP, DHCP live on UDP; a TCP-only scan misses them.

• Timing templates as a scale: -T0–-T2 for stealth, -T3 default, -T4 for labs, -T5 only for isolated targets.
• NSE category strategy: default → safe for audits; targeted scripts (http-enum, smb-os-discovery, ssl-enum-ciphers) for depth; vulners for CVE triage; verify everything.
• Automation pattern: nmap -sn -oG - <range> | awk '/Up/{print $2}' > hosts.txt then feed -iL hosts.txt into detailed scans.
• Recurring audits: run scans on schedule, save with -oA, and ndiff against the previous baseline.
• Output formats for tooling: XML (-oX) is the integration format — import into Metasploit, parse with Python, or use xsltproc to render HTML reports.
• Know your lab: use a disposable VM network (VirtualBox host-only/VMware) so timing and evasion tests never touch real infrastructure.

🔒 Master Network Reconnaissance with Nmap

Nmap is the foundation of every security assessment. Combine these commands, scripts, and best practices to map, audit, and secure your networks — always with proper authorization.

📖 Reference: Nmap Network Scanning by Gordon Lyon (Fyodor)