Nmap Notes

A practical walkthrough for asking better questions about a network you are allowed to test

1. What is Nmap? (Theory and Foundation)

Nmap is a network question tool. You give it a target, and it helps you learn what is reachable, which ports respond, and what services might be running there. It does not automatically prove "this system is hacked" or "this server is safe." It gives you evidence so you can decide what to check next.

In real work, that evidence is useful everywhere: a SOC analyst might review a suspicious internal host, a sysadmin might confirm which services are exposed after a change, and a learner might map a small home lab to understand how networking actually looks from the terminal.

Who Uses Nmap?

Different people use Nmap for different reasons, but the workflow is similar: start broad, narrow down, then verify. This is the part beginners usually miss. Nmap is not the whole investigation. It is the first clean map before you decide where to spend attention.

• System administrators use it to confirm what is running on servers they manage.
• SOC analysts use it carefully when a host looks suspicious and they need quick network context.
• Security engineers use it to check exposed services before deeper vulnerability review.
• Students use it to connect theory with what real hosts and ports look like.
• Penetration testers use it during authorized reconnaissance to plan the next step.

Core Concepts to Understand

What is a Port?

A port is a numbered place where a service can listen for network traffic. Think of the IP address as the building, and ports as the doors for different services. SSH often listens on port 22, web traffic often uses 80 or 443, and DNS often uses 53.

Why does this matter? Because an open port tells you where a system is willing to talk. It does not prove a vulnerability by itself, but it tells you where to look next.

• Port Range: 0-65535 (total 65,536 ports)
• Well-Known Ports: 0-1023 (reserved for common services)
• Registered Ports: 1024-49151
• Dynamic/Private Ports: 49152-65535

Port States in Nmap

When Nmap scans a port, it reports a state. Read the state before jumping to conclusions. In real work, filtered often means "a firewall or network device is affecting the answer," not "nothing exists there."

nmap 192.168.56.10

2. Installation and Getting Started

Install Nmap from a trusted package source and verify that the command works before you start scanning. This sounds boring, but it saves time later. A broken install or an old version can make you chase scan behavior that is really just a local setup problem.

In a lab, install it on the machine you will scan from. That could be Kali, Ubuntu, Windows with Nmap installed, or any admin workstation you control.

Linux (Debian/Ubuntu)

# Update and install
sudo apt update
sudo apt install nmap

# Verify installation
nmap --version

Linux (RHEL/CentOS/Fedora)

sudo dnf install nmap    # Fedora
sudo yum install nmap    # CentOS/RHEL

macOS

# Using Homebrew
brew install nmap

Windows

Download the installer from nmap.org or use:

# Using Chocolatey
choco install nmap

# Using winget
winget install nmap

3. Basic Syntax and Your First Scan

The basic shape is simple: choose scan options, then give Nmap a target. The target might be one IP, a hostname, a subnet, or a file of hosts. The skill is not memorizing every flag. The skill is knowing what question you are asking before you run the command.

General Syntax

nmap [Scan Type] [Options] {target specification}

Target Specification

Targets tell Nmap where to send probes. In a home lab, this might be your test VM. In a company environment, this should be a written scope from your team. Never guess the scope.

Your first authorized scan

Start small. A basic scan checks the most common TCP ports and gives you a first view of what the host exposes.

# Basic scan (scans 1000 most common ports)
nmap scanme.nmap.org

# Scan specific ports
nmap -p 22,80,443 scanme.nmap.org

# Scan port range
nmap -p 1-1000 scanme.nmap.org

# Scan all ports (takes longer)
nmap -p- scanme.nmap.org

# Fast scan (top 100 ports)
nmap -F scanme.nmap.org

4. Host Discovery Techniques

Before you care about ports, you need to know which hosts are alive from your point of view. Host discovery is the sweep step. It asks, "Which devices on this range respond at all?"

In real work, this is useful for inventory, lab mapping, and sanity checks. For example, if your home lab subnet is 192.168.56.0/24, discovery tells you which VMs are currently online before you run deeper scans.

Host Discovery Flags

Different networks answer different probe types. On a local subnet, ARP discovery is often reliable. Across routed networks, ICMP or TCP probes may work better. If a host is known to exist but blocks discovery probes, -Pn tells Nmap to skip the "are you alive?" step and scan anyway.

Practical Examples

Run discovery first when you are not sure what is online. The output should show hosts that are up. If nothing appears, do not immediately assume the network is empty. Check your subnet, VPN, interface, and permission scope.

# Find all live hosts on your network (no port scan)
nmap -sn 192.168.1.0/24

# Scan host even if it doesn't respond to ping
nmap -Pn 192.168.1.50

# Use TCP SYN ping on port 80 and 443
nmap -PS80,443 192.168.1.0/24

# Use ARP discovery (best for local network)
nmap -PR 192.168.1.0/24

# Combine multiple discovery methods
nmap -PE -PS22,80,443 -PA80 192.168.1.0/24

# Quick discovery scan
nmap -sn 10.0.0.0/24 -oG - | grep "Up" | awk '{print $2}'

# With hostnames
nmap -sn 10.0.0.0/24

5. Port Scanning Types

Once you know a host is reachable, the next question is: which ports are listening? Nmap can ask that question in different ways. Some scan types are quick and common, some need admin privileges, and some are mainly useful when you are testing firewall behavior in a lab.

For learning, start with the default scan or SYN scan. Do not jump into unusual scan types until you understand what open, closed, and filtered mean in the output.

TCP Scans

TCP scans are the normal starting point because most familiar services use TCP: SSH, HTTP, HTTPS, SMB, databases, and many admin panels. In real work, this is where you build your first attack surface list or inventory list.

NULL, FIN, and Xmas Scans

These scans send unusual TCP flag combinations and then watch how the target responds. They are worth knowing because they teach you how TCP behavior affects scanning, but they are not reliable on every system.

UDP Scan

UDP is different because it does not have the same connection handshake as TCP. DNS, SNMP, DHCP, and some VPN services use UDP, so ignoring UDP can leave gaps in your understanding of a host.

UDP scans are slower and often need privileges. Start with a small port list instead of scanning every UDP port at once.

# UDP scan (slower because no handshake)
nmap -sU 192.168.1.1

# Scan specific UDP ports
nmap -sU -p 53,67,68,161,500 192.168.1.1

# Combined TCP and UDP
nmap -sS -sU -p T:22,80,443,U:53,161 192.168.1.1

Practical Examples

Use these examples in a lab to compare how the output changes. The useful skill is not running every scan type. The useful skill is seeing when one scan gives you uncertainty and another scan gives you a clearer answer.

# Default SYN scan (requires root/admin)
sudo nmap -sS 192.168.1.1

# Connect scan (no root needed)
nmap -sT 192.168.1.1

# Xmas scan for firewall testing
sudo nmap -sX 192.168.1.1

# ACK scan to map firewall rules
sudo nmap -sA 192.168.1.1

6. Service and Version Detection

An open port only tells you that something answered. Version detection tries to learn what that "something" is. This is where Nmap becomes more useful for security work, because "port 80 is open" is vague, while "Apache httpd 2.4.18 is responding" gives you something concrete to verify.

In real work, service detection helps with patch review, asset inventory, suspicious host triage, and deciding which logs or owners to check next.

Version Detection Flags

The -sV flag sends extra probes and reads the responses. Higher intensity can produce better detail, but it can also take longer and create more traffic. Start with the default version detection, then increase intensity only when the result is unclear.

# Basic version detection
nmap -sV 192.168.1.1

# More detailed version detection
nmap -sV --version-all 192.168.1.1

# Combined with service scripts
nmap -sV -sC 192.168.1.1

# Detailed version scan on common ports
nmap -sV --version-all -p 21,22,80,443,3306,8080 webserver.local

# Output shows:
# PORT     STATE SERVICE  VERSION
# 22/tcp   open  ssh      OpenSSH 7.2p2 Ubuntu
# 80/tcp   open  http     Apache httpd 2.4.18
# 443/tcp  open  ssl/http Apache httpd 2.4.18
# 3306/tcp open  mysql    MySQL 5.5.62

7. OS Detection and Fingerprinting

OS detection tries to guess the target operating system by looking at tiny differences in network responses. It is useful context, not a courtroom-level fact. A result like "Linux 4.x" can help you choose the right admin team or log source, but you should verify it before making decisions.

In a home lab, try this against a Linux VM and a Windows VM. Seeing the difference makes the feature easier to understand than reading the flag alone.

OS Detection Flags

OS detection usually works best when Nmap can see at least one open port and one closed port. If every port is filtered, the fingerprint may be weak or missing.

# Basic OS detection
sudo nmap -O 192.168.1.1

# More detailed OS guessing
sudo nmap -O --osscan-guess 192.168.1.1

# Combined with version detection (common combo)
sudo nmap -O -sV 192.168.1.1

sudo nmap -A 192.168.1.1

8. Nmap Scripting Engine (NSE)

NSE is Nmap's scripting layer. Think of it as a library of small checks that can ask more specific questions after you know which services exist. For example, a script can read an HTTP title, check TLS certificate details, list supported SMB information, or look for a known vulnerability pattern.

This is useful in real work because it turns a port list into a more readable set of clues. Still, scripts are not all equal. Some are safe information gathering. Others are intrusive and should stay in labs unless you have explicit written permission.

Script Categories

Categories help you choose scripts without memorizing every script name. Beginners should spend most of their time with default, safe, discovery, and focused service scripts. Save intrusive categories for controlled labs.

Using NSE Scripts

Start with one script or one safe category. If you run too many scripts at once, the output gets noisy and you will not learn which result came from which check.

# Run default scripts
nmap -sC 192.168.1.1

# Run specific script
nmap --script=http-title 192.168.1.1

# Run multiple scripts
nmap --script=http-title,http-headers 192.168.1.1

# Run category of scripts
nmap --script=vuln 192.168.1.1

# Run all safe scripts
nmap --script=safe 192.168.1.1

# Combine categories
nmap --script="vuln and safe" 192.168.1.1

# Exclude specific scripts
nmap --script="default and not intrusive" 192.168.1.1

Essential Security Scripts

These examples show the style of NSE usage. Read the script name out loud and ask what it is checking. http-security-headers checks web headers. ssh-auth-methods checks SSH authentication methods. That simple habit keeps the output connected to the goal.

# Check for vulnerabilities in an authorized lab
nmap --script vuln 192.168.1.1

# SSL/TLS vulnerability check
nmap --script ssl-heartbleed,ssl-poodle,ssl-ccs-injection -p 443 192.168.1.1

# SMB vulnerabilities (EternalBlue etc.)
nmap --script smb-vuln* -p 445 192.168.1.1

# HTTP security headers
nmap --script http-security-headers -p 80,443 192.168.1.1

# DNS zone transfer
nmap --script dns-zone-transfer -p 53 ns.target.com

# FTP anonymous login
nmap --script ftp-anon -p 21 192.168.1.1

# SSH auth methods
nmap --script ssh-auth-methods -p 22 192.168.1.1

9. Timing and Performance

Timing controls how fast Nmap sends probes and how patient it is while waiting for replies. Faster scans feel nice in a lab, but they can miss results on slow networks or create unnecessary noise. Slower scans take longer, but they are easier on fragile systems and monitored environments.

In real work, timing is not about being clever. It is about matching the scan to the network. A small home lab can handle faster scans. A production subnet, a VPN link, or old equipment deserves more patience.

Timing Templates

The -T templates are shortcuts. -T3 is the default. -T4 is common on reliable internal networks. -T5 is usually too aggressive for serious work because speed can cost accuracy.

Fine-Tuned Timing Options

Fine-tuned options are useful when you need more control than a template gives you. For example, --max-rate can stop a scan from sending probes too quickly, and --host-timeout prevents one stubborn host from holding up the whole run.

# Set max outstanding probes
nmap --min-parallelism 100 192.168.1.0/24

# Set timeout values
nmap --host-timeout 30m 192.168.1.0/24

# Set probe rate
nmap --min-rate 1000 192.168.1.0/24
nmap --max-rate 500 192.168.1.0/24

# Set scan delay for monitored networks
nmap --scan-delay 1s 192.168.1.1

10. Output Formats

If a scan matters, save it. Terminal output disappears, scrollback gets messy, and reports need evidence. Output files let you compare before and after changes, share results with a teammate, or parse the scan later with tools.

In real work, this is a habit that separates casual scanning from useful notes. Name files clearly so future you knows what was scanned and why.

Output Options

Nmap can save human-readable text, XML for tools, grepable output for quick parsing, or all common formats at once. Most of the time, -oA is the clean choice because it writes several useful formats with one base name.

# Save in all formats
nmap -sV -oA myscan 192.168.1.0/24

# Append to existing file
nmap --append-output -oN results.txt 192.168.1.1

# Verbose output to screen + file
nmap -v -sV -oN scan.txt 192.168.1.1

11. Firewall Testing and Scan Behavior

Firewalls change what Nmap can see. Sometimes a port is open, but a firewall blocks your probe. Sometimes the host is alive, but it does not answer ping. This section is about reading those clues, not trying random tricks until something works.

In real work, firewall testing should be scoped and documented. If you are checking a lab firewall, change one thing at a time and compare the output. That way you learn what the control is doing instead of creating confusing noise.

Scan Behavior Options

These options help you understand scan behavior and firewall responses. Use them in authorized labs, and write down what changed between each run.

# Scan a known host even if ping-style discovery is blocked
nmap -Pn -p 22,80,443 192.168.56.10

# Ask Nmap to explain why it chose each state
nmap --reason -p 22,80,443 192.168.56.10

# Check firewall filtering behavior in a lab
sudo nmap -sA -p 22,80,443 192.168.56.10

# Show packets while learning or troubleshooting
sudo nmap --packet-trace -p 80 192.168.56.10

12. Practice Scenarios

The best way to learn Nmap is to practice small workflows. Each scenario below starts with a simple question, uses a command that matches that question, and points out what to notice in the result.

# Step 1: Find live hosts
nmap -sn 192.168.56.0/24 -oG lab-hosts.gnmap

# Step 2: Scan the common ports on hosts you own
nmap -iL live_hosts.txt -F -oA lab-quick-scan

# Step 3: Take a closer look at one interesting host
nmap -sV -sC -O -p 22,80,443 -oA lab-webserver 192.168.56.10

# Full web scan
nmap -sV -sC -p 80,443,8080,8443 \
  --script http-enum,http-headers,http-methods,http-security-headers \
  -oA web-review webserver.local

# Visible service review
nmap -sV -sC -p 22,80,135,139,445,3389 -oA suspicious-host 10.10.20.45

# Comprehensive network inventory
nmap -sV --top-ports 1000 -oA weekly-inventory 192.168.1.0/24

# Quickly list hosts with open ports from grepable output
grep "Ports:" weekly-inventory.gnmap

13. Quick Reference

Use this section as a reminder, not as a replacement for understanding the output. Pick the flag that matches your question, run a small scan, read the result, then decide the next step.

nmap 192.168.1.1         # Single IP
nmap 192.168.1.0/24      # Subnet
nmap -iL targets.txt     # From file
nmap 192.168.1.1-100     # Range

nmap -sn                 # Ping scan
nmap -Pn                 # Skip discovery
nmap -PS22               # TCP SYN ping
nmap -PR                 # ARP ping

nmap -sS                 # SYN scan
nmap -sT                 # Connect scan
nmap -sU                 # UDP scan
nmap -sA                 # ACK scan

nmap -p 22               # Single port
nmap -p 1-1000           # Range
nmap -p-                 # All ports
nmap -F                  # Fast (100)

nmap -sV                 # Version
nmap -O                  # OS detect
nmap -A                  # OS, version, scripts, route
nmap -sC                 # Scripts

nmap -T0                 # Slowest
nmap -T3                 # Normal
nmap -T4                 # Fast
nmap -T5                 # Very fast

nmap -oN file.txt        # Normal
nmap -oX file.xml        # XML
nmap -oG file.gnmap      # Grepable
nmap -oA basename        # All

nmap -Pn                 # Skip discovery
nmap --reason            # Explain states
nmap -sA                 # Check filtering
nmap --packet-trace      # Show packets

14. Knowledge Check

Use these as quick self-checks. The goal is not to memorize every command. The goal is to recognize which Nmap question you are asking.

nmap -F 192.168.1.50

sudo nmap -sS -T2 192.168.1.50

sudo nmap -A -oA webserver_scan target.com

sudo nmap -O -sV -sC --traceroute -oA webserver_scan target.com

nmap -sV -p 22,80,443 192.168.1.50

nmap -sn 10.0.0.0/24 -oG live_hosts.txt

nmap -Pn --reason -p 22,80,443 192.168.1.50

nmap -sV --version-all -p 8080 192.168.1.50

sudo nmap -sU -p 53,161 192.168.1.0/24