VMware ESXi and vSphere Cluster Management

Introduction to Nmap: Network Discovery and Port Scanning Basics

Learn what Nmap is, install and verify it, run authorized scans, interpret port states, detect services, scan ranges, and use Zenmap.

Nmap, short for Network Mapper, is an open-source utility for network discovery and security auditing. It helps you identify reachable hosts, inspect network ports, recognize services, and build an evidence-based inventory of an authorized environment.

Nmap was created by Gordon Lyon, who is also known by the handle Fyodor. It is available for Linux, Windows, macOS, and many other Unix-like platforms. Nmap is distributed under the GNU General Public License (GPL), which broadly permits use, study, modification, and redistribution under the license terms.

This lesson introduces the command-line tool and its graphical front end, Zenmap. For a related reference, see the Nmap introduction.

Authorization and safe scanning boundaries

Scan only systems, IP addresses, and networks that you own or are explicitly authorized to assess. Authorization should define the targets, time window, scan types, and acceptable impact. A scan of an unfamiliar Internet address can create security alerts, logs, support incidents, or extra load on a device.

Use one of these contexts for practice:

• A local lab or virtual machine that you control.
• A private subnet for which you have written or otherwise clear permission.
• Nmap's designated public training host, scanme.nmap.org, while following the provider's current usage policy.

What Nmap can do

Network mapping means discovering and documenting hosts, services, and relationships in a network. Nmap supports this work through several related capabilities.

Nmap also includes the Nmap Scripting Engine (NSE). NSE scripts extend Nmap with discovery, enumeration, and selected security checks. An NSE result requires careful validation: Nmap output alone is not proof that a vulnerability exists.

Installing and verifying Nmap

Some security-focused Linux distributions include Nmap already. Check first:

nmap --version

The output can include the installed version, platform, libraries, and scan-engine information. If the shell reports that nmap is not found, install it using the package manager for your platform.

Targets and scan scope

A target is a hostname, IP address, or authorized network range supplied to Nmap. Common target formats include:

CIDR notation uses a suffix such as /24 to describe how many leading bits identify the network. A typical IPv4 /24 represents 256 addresses in the block; it does not confirm that every address belongs to a live host. Each discovered target receives its own result section.

Running a first default scan

A default scan checks a selected set of common TCP ports rather than every possible port. TCP is a transport protocol commonly used by port-based services, and a port is a numbered communication endpoint used by a transport-layer service.

Against the designated training host, use:

nmap scanme.nmap.org

Against an authorized local target, use:

nmap 192.168.5.102

Results depend on Internet connectivity, DNS resolution, routing, permissions, host availability, and firewall behavior. A remote firewall may make ports appear filtered or prevent host discovery. A local scan may reveal more details, including MAC addresses, because the scanner is on the same network segment.

Reading basic Nmap output

A basic result normally contains a scan header, target resolution, host availability, latency, a port table, and a completion summary. A simplified result might look like this:

Starting Nmap 7.x (https://nmap.org/)
Nmap scan report for lab-host.example
Host is up (0.0020s latency).
Not shown: 998 closed tcp ports
PORT    STATE    SERVICE
22/tcp  open     ssh
80/tcp  filtered http

Nmap done: 1 IP address (1 host up) scanned in 1.25 seconds

• 22/tcp means port number 22 using TCP. The notation is port/protocol.
• Host is up means Nmap received a response consistent with a reachable host.
• Latency is the observed response delay between scanner and target.
• The port table reports the port, its state, and a likely service label.
• An omitted-port summary represents many ports that share the same state and are not listed individually.
• The completion line summarizes the number of addresses and hosts scanned and the elapsed time.

The service name is often a port-based guess. For example, http beside port 80 reflects a conventional assignment, not proof that HTTP is running. A nonstandard service may use that port.

Service and version detection

Service detection actively probes a discovered port to identify the application or protocol behind it. Version detection attempts to identify product and release information. Use -sV in an authorized environment:

nmap -sV 192.168.5.102

Depending on the target's responses, output may include a protocol, product or application, version, hostname hints, device type, operating-system clues, and sometimes a CPE (Common Platform Enumeration) name. Accurate version information helps with asset inventory, patch verification, and authorized vulnerability research. Detection requires additional exchanges, so it can increase runtime, and services may hide banners or respond ambiguously.

OS and device identification are informed estimates based on responses and other observations. Treat them as clues to validate against system inventory, configuration, and administrator knowledge.

Selecting ports with -p

The -p option narrows the scan to specific ports. Targeted scanning is useful when validating a known service, checking firewall exposure, or reducing scope and runtime.

# One TCP port
nmap -p 135 192.168.5.102

# Inclusive numeric range: ports 80 through 90
nmap -p 80-90 192.168.5.102

The range includes both endpoints. When expanding beyond these introductory TCP examples, pair port selection with the appropriate protocol context, because TCP and UDP use separate port spaces and require different scan considerations.

Scanning multiple targets and CIDR ranges

Scan two authorized hosts with the same selected-port test:

nmap -p 135 192.168.5.1 192.168.5.102

Each target receives its own report. Differences such as open on one host and filtered or closed on another often reflect different services or firewall policies.

For a narrow, authorized subnet inventory, scan one selected port across a private /24:

nmap -p 135 192.168.5.0/24

A subnet-wide scan can produce traffic and alerts on many devices. Confirm the scope first, and remember that an address range is only a set of possible addresses—not evidence that every address represents a live host.

Zenmap graphical interface

Zenmap is Nmap's graphical interface where supported and available. It is useful for beginners and for reviewing results without relying exclusively on a terminal. Packaging and availability vary by operating system and current Nmap distribution.

The basic workflow is:

1. Enter an authorized hostname, address, or range in the target field.
2. Choose a suitable scan profile or enter the command options for the approved scan.
3. Run the scan and inspect the output pane.
4. Review graphical host and port views, including states and detected services.
5. Save repeatable profiles and results when your change-management process permits it.

Zenmap can support result comparison and scan-history-based change tracking. Comparing two authorized scans may reveal a newly visible host, changed port exposure, or a service that is no longer reachable. The command-line interface remains valuable for automation, remote systems, and precise documentation.

Introductory command reference

Troubleshooting common results

Nmap is not found

Install the distribution's Nmap package and rerun nmap --version. If it is installed but still unavailable, check whether its executable directory is in the current PATH.

A hostname fails or resolves unexpectedly

Check for a spelling error, verify DNS resolution and network access, and compare the result with an authorized known IP address. DNS is the system that resolves hostnames and IP addresses, so a DNS problem can prevent a hostname scan even when the host itself is available.

A known target appears down

Verify the address and network path through normal administration tools. The host may be offline, discovery probes may be blocked, routing or VLAN segmentation may prevent reachability, or the address may be wrong. Do not conclude that a system is absent from one scan alone.

An expected port is filtered

Filtering may result from a host firewall, network firewall, security appliance, packet loss, or asymmetric routing. Review authorized rules and service exposure from the target side. Filtered is inconclusive; it is not equivalent to closed.

The service label is unexpected

The initial label may come only from conventional port assignments. Use -sV in an authorized environment and validate the result against the system's service configuration. Do not treat a basic service label as definitive identification.

Version detection is slow or incomplete

Version probing requires extra exchanges. Latency, filtering, suppressed banners, or limited service responses can slow or limit identification. Allow adequate time and regard the result as an informed attempt rather than absolute proof.

Zenmap is unavailable

The graphical front end may be packaged separately, omitted from the current platform package, or unsuitable for a system without a graphical desktop. Check the current platform packaging information and use the command-line interface when necessary.

Exam-relevant summary

• Nmap is an open-source, GPL-licensed network discovery and security-auditing utility created by Gordon Lyon (Fyodor).
• Host discovery asks which targets appear alive; port scanning tests the reachability and apparent state of numbered TCP or UDP endpoints.
• open suggests a service may be accepting connections, closed indicates a reachable port without a listening application, and filtered means filtering prevents a conclusive answer.
• Default scans check a selected set of common ports, not every possible port.
• -sV enables service and version probing, while -p selects individual ports or ranges.
• CIDR notation such as 192.168.5.0/24 specifies a network range; it does not mean every address is alive.
• Service names and version results are identification clues that should be validated.
• NSE can perform selected checks, but Nmap output alone is not proof of a vulnerability.
• Always define authorization and scope before scanning.