IT Course Directory: VMware, Linux, Networking, and Raspberry Pi

Nmap Fundamentals: Network Discovery and Port Scanning

Learn how to install and use Nmap for authorized host discovery, TCP and UDP port scanning, service detection, result interpretation, and safe network documentation.

Nmap is an open-source command-line utility for network discovery, asset inventory, service-exposure review, and troubleshooting. It can identify reachable hosts, examine TCP and UDP ports, probe services, and infer operating-system characteristics from network behavior.

What Nmap Does

Nmap performs several related tasks. Host discovery determines which targets appear reachable. Port scanning checks numbered TCP or UDP endpoints. Service detection sends additional probes to identify the application protocol and possible software version behind a port. Operating-system fingerprinting infers an operating system from network-stack behavior.

These activities answer different questions. A host can be online even when discovery probes are blocked. A port can be reachable without revealing its service version. An open port indicates a listening service, not automatically a vulnerability or a configuration error.

Networking Concepts for Nmap

Addresses, networks, and names

An IP address identifies a network interface. A subnet is a group of addresses treated as one network. CIDR notation expresses a network and its prefix length, such as 192.0.2.0/24. A /24 commonly represents 256 addresses, although usable-host conventions depend on the network design.

A gateway forwards traffic from one network to another. DNS maps hostnames to addresses. localhost refers to the local system, commonly through 127.0.0.1 for IPv4 or ::1 for IPv6. Before scanning, confirm that the address or name belongs to the approved scope.

TCP, UDP, and ports

TCP is a connection-oriented transport protocol. It uses a handshake and provides ordered, reliable delivery. UDP is connectionless and has less built-in signaling, so a UDP scan often needs to infer state from an application response, an ICMP message, or a timeout.

A port is a numbered endpoint used by a TCP or UDP application. A listening service accepts or processes traffic on a port. Common associations include SSH on TCP 22, HTTP on TCP 80, HTTPS on TCP 443, DNS on TCP or UDP 53, and SMB on TCP 445. These associations are conventions, not proof: applications can use nonstandard ports.

TCP flags and filtering

TCP packets contain flags that describe connection behavior. SYN begins a connection attempt, ACK acknowledges received data or a handshake step, RST rejects or resets a connection, and FIN indicates orderly closure. A SYN scan uses responses to an initial SYN to assess a port without completing the ordinary application connection.

Firewalls and packet filters may allow, reject, or silently drop traffic. Network address translation can also change which address and service are visible from a particular scan location. Consequently, Nmap results describe reachability from the scanner's network position; they are not a complete security verdict.

Installation and Lab Setup

Obtain Nmap from its official distribution sources. On Linux, use the package manager supplied by the distribution. On Windows, use the official Windows installer, follow the installation wizard, and allow the installer to place Nmap on the command-line path when that option is offered.

# Debian or Ubuntu
sudo apt update
sudo apt install nmap

# Fedora or related distributions
sudo dnf install nmap

# Arch Linux
sudo pacman -S nmap

Kali Linux includes many networking and security tools and can be used for an authorized lab, but it is not required. A normal Linux workstation, a local virtual machine, or a deliberately configured test subnet is sufficient. Keep practice isolated from production systems.

nmap --version

The version command verifies that the executable is installed and callable. If the shell reports that nmap is not found, confirm installation, reopen the terminal, and check the system PATH.

Command Structure and Scope

The basic pattern is nmap [options] target. A target may be one IP address, a hostname, a CIDR range, an explicit address range, or a file containing targets.

nmap 192.0.2.10
nmap lab-server.example.test
nmap 192.0.2.0/28
nmap 192.0.2.10-20
nmap -iL approved-targets.txt
nmap 192.0.2.0/28 --exclude 192.0.2.5

Review target selection before pressing Enter. Start with one known lab host or a small approved range. Resolve names and verify addresses using local DNS tools such as nslookup or getent hosts where appropriate. Exclusions help prevent accidental scanning of known out-of-scope assets, but they do not replace a written scope review.

Host Discovery

Before a normal port scan, Nmap commonly performs discovery probes to decide whether a target appears online. A target may be reported as down when it is actually running if ICMP, TCP discovery, or other probes are blocked. A host that is filtered may respond differently from one that is simply unreachable, but silence alone cannot always distinguish the causes.

nmap -sn 192.0.2.0/28

The -sn option performs host discovery without a port scan. It is useful for inventorying a small authorized subnet. If you already know that a host is live and discovery probes are blocked, -Pn skips the discovery phase:

nmap -Pn -p 443 192.0.2.10

Skipping discovery can make a scan slower because Nmap treats the target as available and proceeds with the requested probes. It must never be used to expand scope.

Basic TCP Port Scanning

A default scan against one approved host is a useful first inventory step:

nmap 192.0.2.10

Nmap's default scan checks a commonly used set of TCP ports rather than every possible port. Use -p to define an exact selection.

nmap -p 80 192.0.2.10
nmap -p 22,80,443 192.0.2.10
nmap -p 1-1024 192.0.2.10

A SYN scan, -sS, evaluates the initial TCP handshake and normally avoids completing the connection. It commonly requires elevated privileges for raw packets. A TCP connect scan, -sT, asks the operating system to complete the connection and is useful when raw-packet privileges are unavailable.

sudo nmap -sS -p 22,80,443 192.0.2.10
nmap -sT -p 80,443 192.0.2.10

Port States and Their Meaning

Reading and Documenting Output

Normal output usually identifies the target, reports whether it appears up, gives latency, presents a port table, and ends with a scan summary. The port table commonly includes the port number, protocol, state, and service label. For example, 443/tcp open https means that TCP port 443 appeared open and the label suggests HTTPS.

Service labels in a default scan are often based on the port number. Use version detection when the service identity matters:

nmap -sV -p 22,80,443 192.0.2.10

Version probing can improve inventory and help administrators compare observed software with the intended system role. Results may have limited confidence because banners can be hidden, altered, blocked, or supplied by a proxy or load balancer. Compare findings with local configuration and asset-owner records.

Save a record containing the approved scope, date and time, scanner location, exact command, observed ports, interpretation, and follow-up questions. Protect scan files because they may reveal infrastructure details.

nmap -oN scan.txt -oX scan.xml -p 22,80,443 192.0.2.10
nmap -oG scan.gnmap 192.0.2.10
nmap -oA lab-review 192.0.2.10

Service Detection and Operating-System Fingerprinting

Service detection uses additional probes to identify protocols and possible versions. It is useful when a port uses a nonstandard service, when an inventory needs software detail, or when an administrator is verifying expected exposure. It is not infallible.

OS fingerprinting, enabled with -O, infers the operating system from characteristics such as responses, TCP options, and other network-stack behavior. Virtual machines, firewalls, proxies, load balancers, limited open or closed port evidence, and network address translation can reduce accuracy.

The -A option is an aggressive convenience profile that combines several detection features. It creates more traffic and should be reserved for explicitly approved environments. Prefer focused options when only one question needs answering.

UDP Scanning

UDP scanning differs from TCP scanning because UDP has no three-way handshake. An application may respond only to a correctly formed request, while a closed port may generate an ICMP error. Silence often leaves the result as open|filtered.

sudo nmap -sU -p 53,123 192.0.2.10

Begin with a narrow, approved UDP port set. A result of open|filtered is not proof that a service is listening. Validate it with an authorized application-aware test, local socket information, or service-owner documentation.

Timing, Performance, and Operational Impact

Scan duration depends on latency, packet loss, target count, firewall behavior, retransmissions, selected ports, and UDP timeouts. Faster is not always better: aggressive traffic can increase load, trigger alerts, and reduce result quality on unreliable links.

Nmap provides timing templates from conservative to aggressive. For a controlled lab comparison, begin with a small range and a moderate template:

nmap -T3 -p 1-1024 192.0.2.10

Inter-probe delays and packet-rate limits can also control traffic. Tune gradually: scan a small scope, observe duration and output, document the change, and stop if the target or network behaves poorly. Avoid high-rate scanning on production networks or unreliable links without explicit approval.

Common Failures and Interpretation Limits

A false negative is a result that fails to show a host or service that actually exists. Local firewalls, remote filtering, VPN routing, intermediary devices, and discovery restrictions can all contribute. When a result matters, validate it using service-owner records, firewall rules, local socket listings, or a repeat scan from an approved alternate network position.

Authorized Network Review Workflow

1. Define scope and approval. Record addresses, names, exclusions, permitted scan types, timing limits, and the responsible contact.
2. Confirm addressing and expected services. Compare DNS, asset inventory, host role, and firewall expectations.
3. Start with low impact. Perform host discovery or a limited direct scan against a small approved set.
4. Review relevant TCP ports. Use explicit ports when the question concerns management, web, file sharing, or another known service.
5. Check focused UDP ports. Scan only relevant DNS, NTP, SNMP, DHCP-related, or other approved services.
6. Apply version detection selectively. Use -sV where software identity helps answer an inventory question.
7. Save and compare. Preserve normal or XML output and compare observed exposure with the intended role.
8. Escalate unexpected exposure. Tell the responsible administrator rather than attempting exploitation.

Practical Command Set

# Verify installation
nmap --version

# Basic scan of one authorized host
nmap 192.0.2.10

# Selected TCP ports
nmap -p 22,80,443 192.0.2.10

# Small authorized discovery range
nmap -sn 192.0.2.0/28

# Known live host when discovery is blocked
nmap -Pn -p 443 192.0.2.10

# Service versions
nmap -sV -p 22,80,443 192.0.2.10

# Focused UDP review
sudo nmap -sU -p 53,123 192.0.2.10

# Exclude an out-of-scope address
nmap 192.0.2.0/28 --exclude 192.0.2.5

# Save readable and XML records
nmap -oN scan.txt -oX scan.xml -p 22,80,443 192.0.2.10

Exam-Relevant Notes

• Open means Nmap has evidence of a listener; it does not mean the service is vulnerable.
• Closed means the host is reachable but no service is listening on that port at scan time.
• Filtered means filtering or missing responses prevents a reliable conclusion.
• UDP commonly produces open|filtered because silence does not distinguish an open service from filtering.
• -sn performs host discovery without a port scan; -Pn skips discovery for selected targets.
• -sS is a SYN scan, while -sT completes a TCP connection through the operating system.
• -sV performs service and version detection; -O attempts OS detection; -A combines several aggressive features.
• Always interpret results in context: scan position, routing, firewalls, NAT, virtualization, and authorization scope affect findings.

For related study, review the networking fundamentals course, the Free Linux Course, and the Nmap course curriculum.