IT Course Directory: VMware, Linux, Networking, and Raspberry Pi

Nmap Online Course: Network Port Scanning and Discovery

Learn authorized Nmap host discovery, TCP and UDP port scanning, service and OS detection, NSE, timing, reporting, and remediation validation.

Nmap is an open-source command-line tool for network discovery and security auditing. It helps administrators and security professionals identify reachable hosts, inspect TCP and UDP ports, recognize network services, estimate operating systems, and validate firewall or hardening changes.

Learning goals and prerequisites

By the end of this lesson, you should be able to define an authorized target, discover hosts, select an appropriate port-scan method, interpret port states, identify services, use carefully selected NSE scripts, save evidence, and explain scan limitations.

Useful prerequisites include basic command-line navigation, IP addressing and subnetting, DNS, TCP and UDP, common network services, firewalls, and ethical security-testing practices. The Free Linux Course can help with terminal fundamentals.

What Nmap does

A target is an authorized hostname, IP address, range, or subnet selected for scanning. A host is a networked system identified by an IP address. A port is a numbered TCP or UDP endpoint. A service is the application listening on that endpoint, such as a web server, DNS server, or SSH server.

Nmap can support network inventory, troubleshooting, exposure reviews, firewall validation, service-hardening checks, and authorized penetration testing. It does not automatically prove that a host is secure or that a reported software version is accurate. Results are observations that should be validated against configuration records, logs, authenticated inspection, and the intended network path.

Responsible scanning workflow

1. Obtain written authorization and define the engagement owner.
2. Record approved IP addresses, DNS names, subnets, ports, scan methods, time windows, and exclusions.
3. Choose the least disruptive scan that answers the question.
4. Run a limited test, observe impact and monitoring alerts, then expand only if permitted.
5. Save commands, timestamps, output, vantage point, and limitations.
6. Report actionable findings and repeat an approved scan to verify remediation.

Do not scan public addresses, third-party infrastructure, school or workplace networks, or cloud assets merely because they are reachable. Network address translation can make several internal systems appear behind one public address, so ownership and scope must be confirmed rather than inferred.

Installation and initial setup

Install Nmap through the official package manager or installer appropriate to your operating system. On Linux, use the distribution package manager; on macOS, use an approved package manager or installer; on Windows, use the approved Windows installer. Follow organizational software-management policy and verify downloaded packages according to that policy.

Run commands in a terminal. Confirm that Nmap is installed and identify its release with:

nmap --version

Some scan types create raw network packets and require elevated privileges. On Unix-like systems, an approved administrator may use sudo. On Windows, use an administrator terminal only when organizational policy permits it. A TCP connect scan is often available without raw-packet privileges.

Zenmap is Nmap's graphical interface where available. It can help beginners construct commands, review results, and save profiles, but the generated command and scope should still be reviewed manually. Command-line use is valuable for repeatability and evidence.

Network and protocol fundamentals

An IP address identifies a network interface. A subnet groups addresses according to a prefix length, written in CIDR notation, such as 192.0.2.0/24. A DNS name is a human-readable name that may resolve to one or more addresses. Always confirm the address returned by DNS before scanning.

TCP is connection-oriented. A typical connection begins with a SYN, receives a SYN-ACK, and completes with an ACK. UDP is connectionless and commonly produces no response when a port is open, so UDP results are usually slower and less conclusive.

Firewalls and access-control lists can drop or reject probes. NAT can rewrite addresses and ports. These controls affect what Nmap sees and may cause an apparent absence of a service even when the service exists internally.

Target specification

A single target can be a hostname or address:

nmap 192.0.2.10
nmap server.example.internal

A CIDR range targets the addresses represented by the prefix:

nmap -sn 192.0.2.0/24

Address ranges and target lists can also be used. For example, an approved range may be written as 192.0.2.10-20, and a file can contain one hostname or address per line:

nmap -iL approved-targets.txt

Exclude systems that are explicitly out of scope:

nmap -iL approved-targets.txt --exclude 192.0.2.15

Before execution, resolve names, inspect the target list, compare it with the authorization document, remove broadcast or sensitive addresses where appropriate, and perform a small validation scan. Never treat a typo or DNS result as authorization.

Host discovery

Host discovery identifies systems that appear reachable or online. A ping-style discovery scan uses multiple permitted probes rather than conducting a normal port scan:

nmap -sn 192.0.2.0/24

On a local Ethernet network, ARP-based discovery is often especially effective because hosts must answer address-resolution requests to communicate locally. Discovery can still be incomplete: ICMP may be blocked, a firewall may suppress probes, a system may be asleep, routing may be asymmetric, or the host may be outside the expected network path.

If an authorized assessment must scan a known target even when discovery probes receive no response, disable host discovery:

nmap -Pn 192.0.2.10

Use -Pn deliberately. It treats the target as online and may spend time scanning an unreachable address.

Port scanning methods

Nmap's default behavior performs host discovery and scans a default set of common TCP ports. Specify ports when the assessment has a focused question.

Examples:

nmap -p 22,80,443 192.0.2.10
sudo nmap -sS -p 1-1024 192.0.2.10
nmap -sT -p 80,443 192.0.2.10
sudo nmap -sU -p 53,123,161 192.0.2.10
nmap -p- 192.0.2.10

-p- requests all TCP ports and should be justified by scope, timing, and system sensitivity. A common-port set can be useful for a quick review, but “not found” means only that the selected ports or probes produced no evidence.

Reading scan results

A port state is Nmap's classification of a scanned port. It describes the evidence available to Nmap, not an absolute property of the service.

Host latency estimates response time. Timing summaries describe how long the scan took and how many hosts or ports were examined. A filtered or absent result does not prove that a service is unavailable; it may only show that the chosen path and probe could not confirm it.

Service and version detection

Use -sV to send additional probes intended to identify the application and potential version behind open ports:

nmap -sV -p 22,80,443 192.0.2.10

Nmap may display a service name, product, version, banner, and a confidence level. A banner is text returned by a service; a fingerprint is a pattern of responses used for identification. Proxies, load balancers, custom banners, rate limiting, encryption, and insufficient responses can produce incomplete or incorrect results. Treat versions as evidence to validate with package inventories, configuration management, service logs, or authenticated inspection.

Operating-system detection

OS fingerprinting estimates an operating system from characteristics such as TCP/IP responses, packet behavior, and available port responses:

sudo nmap -O 192.0.2.10

It generally works best when Nmap can observe suitable open and closed ports. Privileges, filtering, NAT, middleboxes, unusual network stacks, and incomplete fingerprints can reduce accuracy. Report a probable match and confidence rather than claiming certainty. An OS guess should be checked against asset-management and administrative records.

Nmap Scripting Engine

The Nmap Scripting Engine (NSE) extends Nmap with scripts for discovery, enumeration, and other authorized assessment tasks. Categories describe intended use and risk. Select scripts explicitly when possible, read their documentation, review arguments, and confirm that they are approved.

An explicitly selected banner script can support limited discovery:

nmap --script banner -p 80,443 192.0.2.10

Script arguments use the --script-args option when documented. Review output for discovered names, protocols, and evidence, and record the script version and limitations. Never run exploit-oriented or intrusive scripts merely to see what happens.

Timing, performance, and reliability

A timing template is a predefined performance profile. Lower settings favor caution; higher settings can increase speed, parallelism, and network load. A conservative example is:

nmap -T3 -p 1-1024 192.0.2.10

Use narrow target and port ranges first. Nmap also provides controls such as --max-retries, --host-timeout, and rate or parallelism options. Change them only when you understand the effect and the authorization permits it. Retries can improve completeness on lossy networks but increase duration and traffic. Host timeouts can prevent a fragile or unreachable system from delaying the entire job, but may omit evidence.

UDP scans, large ranges, packet loss, filtering, and conservative settings commonly cause long runtimes. Avoid aggressive timing on production or fragile systems, monitor impact, and schedule broad scans during an approved maintenance window.

Firewalls, monitoring, and ambiguous results

Packet filtering can drop probes, reject them, rate-limit them, or allow only particular source addresses. These behaviors change port states and can create false negatives. Intrusion-detection and security-monitoring systems may log scan sources, targets, ports, timing, and unusual probe patterns. Scanning should not be designed to evade those controls; use the permitted settings and coordinate with the monitoring team.

If most ports are filtered, verify the intended route, firewall policy, NAT behavior, and scan vantage point. An approved alternative vantage point may reveal a different exposure, such as an internal service hidden from the external network.

Output formats and reporting

Nmap can display human-readable normal output, structured XML, grepable output for simple text processing, or several formats together.

nmap -sV -oA approved-server-scan 192.0.2.10

Record the authorization reference, target list, exclusions, source network, command, Nmap version, date and time, scan duration, findings, and limitations. A remediation-oriented report should identify the asset, exposed port and service, business owner, expected state, evidence, risk context, recommended action, and verification result. Protect scan files because they can reveal infrastructure details.

Practical authorized workflows

Inventory an approved subnet

nmap -sn 192.0.2.0/24 -oA approved-subnet-discovery

Review discovered hosts against the asset register. Investigate differences through approved administrative channels; discovery alone does not identify ownership.

Check common services on one server

nmap -p 22,80,443 192.0.2.10 -oA server-common-ports

Compare open ports with the server's intended role. Closed ports confirm that the host responded without a listener; filtered ports require firewall or path validation.

Inventory a managed web server

nmap -sV -p 80,443 192.0.2.10 -oA web-service-inventory

Validate the reported products and versions against deployment records, then remediate unsupported software or unnecessary exposure.

Assess approved UDP exposure

sudo nmap -sU -p 53,123,161 192.0.2.10 -oA udp-service-check

Interpret open|filtered cautiously and use protocol-specific or authenticated validation where permitted.

Verify a firewall or hardening change

Save a pre-change scan and repeat the same command after the change, from the same approved vantage point. Compare target, ports, states, service evidence, timestamps, and network conditions. A port changing from open to filtered may demonstrate reduced reachability, but confirm that the intended users and management paths still work.

Troubleshooting

A known host does not appear

ICMP or other discovery probes may be blocked, the host may be offline, routing may differ, or endpoint policy may suppress responses. Confirm connectivity and scope, use approved discovery methods, or use -Pn for a known authorized target when justified.

Most ports are filtered

Firewalls, ACLs, routing, and security devices are likely affecting the result. Treat it as inconclusive, verify the path and policy, and compare from an approved alternative location if available.

The scan is slow

UDP scanning, packet loss, retries, large scopes, and conservative timing are common causes. Reduce the approved port or target set, review timing and timeout choices, and schedule broad scans appropriately.

Version detection is incomplete

Proxies, load balancers, custom banners, encryption, filtering, or rate limiting may obscure the service. Validate with approved records, logs, or authenticated inspection.

OS detection has no exact match

There may be too few useful port responses, a middlebox may alter traffic, or the fingerprint may be uncommon. Treat the result as a hypothesis and seek corroborating evidence.

A permission error occurs

The selected scan may require raw-packet privileges. Use the approved elevated session or choose a suitable non-privileged method such as -sT. Follow access-control policy rather than bypassing it.

Exam-relevant notes

• Open means an application responded; it does not mean the service is secure.
• Closed means the host is reachable but no listener was found on that port.
• Filtered means Nmap cannot determine the state because filtering prevents a conclusive response.
• UDP scanning is generally slower and more ambiguous than TCP scanning.
• -sS is a TCP SYN scan, -sT is a TCP connect scan, -sU is a UDP scan, -sV performs service/version detection, -O estimates the OS, -sn performs host discovery without a normal port scan, and -Pn skips host discovery.
• XML is structured and useful for tooling; -oA saves normal, XML, and grepable output using one base name.
• Discovery results are vantage-point dependent. A service hidden externally may still be reachable internally.
• Authorization, least-impact settings, accurate documentation, and remediation verification are part of a technically complete scan.

For continued study, review the Nmap Online Course and its curriculum. Network troubleshooting and Linux command-line practice are also useful complements.