Asi

Introduction to Nmap: Network Discovery and Port Scanning

Learn how to install Nmap, run authorized network scans, read port states and service results, scan selected ports and subnets, and use Zenmap.

Nmap is a free, open-source utility for network discovery and security auditing. It helps administrators identify reachable hosts, inspect observable ports, recognize services, and build a basic inventory of network assets.

This lesson focuses on beginner-friendly, command-line use. Run every example only against systems you own or systems for which you have explicit permission to scan.

What Nmap Is and When to Use It

Nmap, short for Network Mapper, identifies hosts and examines network ports. It is commonly used for:

• Network mapping and host discovery.
• Port scanning and exposure review.
• Service and version identification.
• Basic asset inventory.
• Firewall and access-control validation.
• Authorized security auditing and vulnerability-assessment preparation.

Nmap runs on major operating systems. It is frequently used from Linux terminals, while graphical options are available on platforms where they are packaged. Gordon Lyon, also known as Fyodor, created Nmap. The project is licensed under the GNU General Public License, or GPL, at a high level.

Authorization, Scope, and Safe Scanning

A target is the authorized hostname, IP address, or network range supplied to Nmap. Authorization should cover both the targets and the activity: host discovery, port scanning, service detection, and any later scripts may have different operational effects.

Define these items before starting:

• Target scope: Which hosts or subnet addresses may be scanned?
• Port scope: Which TCP or UDP ports are relevant?
• Timing: When may probes run, and is there a maintenance window?
• Purpose: Is the task inventory, firewall validation, change detection, or troubleshooting?
• Evidence: Where will commands, timestamps, scanner location, and results be recorded?

A larger address range, wider port scope, or more intensive detection creates more traffic and may take longer. Start with one lab host and a small port set before scanning a complete authorized subnet.

Installing and Verifying Nmap

First check whether Nmap is available and identify its installed version:

nmap --version

If the shell reports that nmap is not found, install it with your operating system's supported package source.

Some security-oriented Linux distributions include Nmap already. The installed version matters because features, scripts, fingerprints, and output can change between releases. Privileges also affect scan behavior and available scan methods. Use approved administrative privileges when required, and record the Nmap version with your results.

Nmap Command Structure

The general command structure is:

nmap [options] target

Options control scan behavior. Target arguments define what will be assessed. A target may be a hostname, one IPv4 or IPv6 address, several explicitly listed addresses, or a CIDR network range.

Running a First Default Scan

A basic scan of one authorized target is a useful first inventory:

nmap scanme.nmap.org

For a private lab host, use its approved address instead:

nmap 192.168.5.102

A default scan is not an exhaustive test of every possible port. It uses Nmap's normal initial host and port-selection behavior, making it a practical starting point. DNS resolution, routing, connectivity, host firewalls, and endpoint policies all influence the result.

At the end, Nmap normally reports how many targets were scanned and how long the operation took. Treat this completion summary as operational evidence: record the target, scanner location, time, version, and elapsed time with the output.

Reading Basic Nmap Output

A typical report contains a scan header, target-resolution information, host status, latency, a port table, and a completion summary. A simplified result might look like this:

Nmap scan report for 192.168.5.102
Host is up (0.0040s latency).

PORT   STATE  SERVICE
22/tcp open   ssh
80/tcp closed http
443/tcp filtered https

Nmap done: 1 IP address (1 host up) scanned in 2.31 seconds

The report header identifies the target Nmap resolved or scanned. Host is up means Nmap received evidence that the host responded or was reachable according to the discovery method. The value in parentheses is observed latency, or response time between the scanner and target.

A service label is not always proof of the exact application. A custom application may use a familiar port, and a proxy may answer on behalf of another service.

Common Port States

Large groups of ports may be omitted from the display, especially when they share a state such as closed. Omitted ports are not necessarily untested; consult the command options and Nmap's summary to understand what was reported.

Host Discovery and Network Mapping

Host discovery determines which devices respond or appear reachable. It is the foundation of a network inventory: first identify apparent hosts, then examine the services visible on each host.

For example, an authorized subnet inventory can use:

nmap -p 135 192.168.5.0/24

Each address receives its own result. One host may be up with an open port, another may be up with a filtered port, and another may not respond. Firewalls and endpoint policies can make a reachable system appear unavailable or filtered, so a missing response is not proof that a device does not exist.

More advanced discovery methods and scan-type selection are useful next steps, but beginners should first understand the scope and result of a basic scan.

Service and Version Detection

Service detection probes an accessible service to identify its protocol, product, and potentially its version. Enable Nmap's service-version detection with -sV:

nmap -sV 192.168.5.102

Depending on the response, results may include a product name, version, hostname, operating-system clues, device type, or CPE identifier. CPE, or Common Platform Enumeration, is a standardized naming format that may help connect an identified platform to asset and vulnerability-management records.

Version clues can support asset management, patch verification, and authorized vulnerability assessment. Fingerprinting can be incomplete or inaccurate, however. Verify important findings using host configuration, package inventories, application records, logs, banners, or the service owner.

Scanning Selected Ports

Use -p when the task concerns one port, several comma-separated ports, or a contiguous range. Valid TCP and UDP port numbers are 1 through 65535.

nmap -p 135 192.168.5.102
nmap -p 80,443 192.168.5.102
nmap -p 80-90 192.168.5.102

A targeted scan is often faster and easier to interpret when you are checking one expected administrative port or a small web-service range. A default scan is more useful for an initial, broad inventory. Always state whether your selected ports are TCP or UDP; the examples above use TCP unless another protocol is specified.

Scanning Multiple Targets and CIDR Ranges

You can list multiple authorized targets in one command:

nmap -p 135 192.168.5.1 192.168.5.102

CIDR notation expresses a network address and prefix length. In 192.168.5.0/24, the /24 means that 24 of the 32 IPv4 bits identify the network, leaving 8 bits for addresses in that range. This represents 256 address values, commonly written as 192.168.5.0 through 192.168.5.255; usable-host conventions depend on the network design.

nmap -p 135 192.168.5.0/24

Using Zenmap

Zenmap is Nmap's graphical front end where it is available and packaged. It provides a visual way to construct and review scans, but command-line skills remain useful because Zenmap availability and packaging vary by platform and version.

1. Enter an authorized hostname, address, or range in the Target field.
2. Select an appropriate basic scan profile.
3. Review the generated command and confirm its scope.
4. Start the scan.
5. Review host-oriented and service-oriented result views.
6. Save the result when your process requires repeatable records.

Useful GUI capabilities include saved scan profiles, host views, service views, and scan comparison. Comparing a previous scan with a current one can reveal a newly exposed service, a new host, a missing system, or a service that disappeared. Investigate differences rather than assuming that every change is a security incident.

Practical Interpretation for Administrators

Relate an open port to an expected business function. TCP 22 commonly supports SSH, 80 and 443 commonly support web services, Windows file sharing may involve ports such as 445, and remote-management services may use other documented ports. These are associations, not proof of a particular deployment.

• An expected open port should be matched to its owner, service configuration, and permitted source networks.
• An unexpected open port should trigger validation with the system owner, firewall review, and service-configuration checks.
• A filtered result often indicates packet filtering or no usable response. It is not confirmation that a service is absent.
• A version result is evidence for investigation, not definitive proof of a vulnerability or exposure.

Compare two authorized lab hosts when learning:

nmap -p 135 192.168.5.1 192.168.5.102

If one host is open and the other is filtered, consider host firewalls, network segmentation, source-based access controls, routing, and service configuration before drawing conclusions.

Troubleshooting Common Results

Nmap Is Not Found

Install the package, run nmap --version, and confirm that the executable is in the shell's PATH. Check package-installation status if the command remains unavailable.

No Hosts Appear Reachable

Check the hostname or IP address, DNS resolution, routing, and connectivity. A host firewall or network policy may suppress discovery responses. Do not infer that the device is absent from one scan result.

A Known Service Is Filtered

A network firewall, host firewall, ACL, or security appliance may be dropping probes. The service may also allow only approved source networks. Review policy with the owner and repeat only from an authorized monitoring or management location.

The Service Name or Version Looks Wrong

Nmap may have made a port-based guess, or a proxy, load balancer, custom service, or banner configuration may have changed the response. Use -sV within scope and validate against host configuration, logs, and owner records.

A Subnet Scan Takes Too Long

Large scopes, filtered devices, latency, rate controls, and version-detection probes can increase scan time. Reduce the address range or selected ports when appropriate, test first with a small lab range, and schedule broader inventory work during an approved window.

Results Differ by Scanning Location

Record the scanner location, source address, target, and time. NAT, segmentation, VPN paths, load balancing, routing, and source-based controls can all change what is visible from different approved vantage points.

Limitations and Next Steps

Nmap reports what its probes can observe from a particular location and time. Firewalls, NAT, IDS or IPS controls, service proxies, DNS failures, routing, restricted privileges, and source-based policies can alter results. Port discovery is not vulnerability confirmation: an open port does not prove a flaw, and a filtered port does not prove safety.

After mastering these basics, study:

• TCP SYN and connect scan types.
• UDP scanning and its different timing and state interpretation.
• Operating-system detection.
• The Nmap Scripting Engine, or NSE, for additional authorized checks.
• Output formats and reporting workflows.
• Periodic inventory scans and change detection.
• Firewall validation, service hardening, segmentation, and vulnerability-management processes.

Core Nmap Commands for Beginners

Key Exam Notes

• Nmap performs network discovery and security auditing; it is not automatically a vulnerability scanner.
• Open means a service responded as accepting connections or probes; closed means the host was reachable but no service accepted; filtered means filtering or missing responses prevented a determination.
• -sV enables service-version detection, but fingerprints require validation.
• -p narrows the port scope. Port numbers range from 1 through 65535 for TCP and UDP.
• A CIDR prefix such as /24 describes a network range, not one host.
• Always interpret results in context: scanner location, time, DNS, routing, firewall policy, privileges, and authorization all matter.