VMware ESXi and vSphere Cluster Management

Example Zenmap Scan: Running and Reading an Nmap Scan

Learn how to launch Zenmap, scan an authorized private-lab host, use profiles or custom commands, and interpret open, closed, and filtered ports.

Zenmap is the graphical user interface for Nmap, a network discovery and port-scanning tool. It lets you create, launch, save, and review Nmap scans without typing every option at a shell prompt.

This lesson uses the private-lab address 192.168.5.102 as an example. Scan only systems you own or systems whose owner has explicitly authorized you to assess. An unauthorized scan can violate policy, contracts, or law.

What Zenmap Does

Zenmap presents Nmap's command-line behavior through graphical controls and result views. You can select a predefined scan profile, inspect the Nmap command that profile represents, run the scan, and read the terminal-style output in the application.

A target is the authorized host, address, hostname, or defined network scope that Nmap examines. You can usually enter an IP address such as 192.168.5.102 or a resolvable hostname such as lab-web-01. A hostname must resolve through the applicable DNS or local name-resolution system.

Authorization and Safe Target Selection

A private IPv4 address is commonly used inside a lab or internal network, but being private does not automatically mean that every host is yours to scan. Confirm both the target and the permitted scan scope before starting.

Starting Zenmap

On a desktop system, open Zenmap from the application menu or a desktop shortcut. If it is installed and its executable is available in the system path, you can also start it from a shell:

zenmap

The executable name and launch method can vary by operating system and package. The main window normally includes a Target field, a Profile selector, a Command field, a Scan control, and one or more result panes.

Zenmap Main-Window Controls

Interface element	Purpose	Typical input or action	Common beginner mistake
Target	Specifies the authorized host or scope to scan.	Enter an IP address such as `192.168.5.102` or a resolvable hostname.	Entering a target without confirming authorization or mistyping the address.
Profile	Selects a predefined collection of Nmap options.	Choose a quick or basic profile available in the local installation.	Assuming every Zenmap version has identical profile names or settings.
Command	Shows the Nmap command generated by the selected profile and may allow editing.	Review the options, then use an approved custom command when necessary.	Running a command without checking its target, scope, or options.
Scan control	Executes the selected configuration.	Click Scan after confirming the target and command.	Changing fields while assuming the previous scan has already used the new values.
Results/output pane	Displays Nmap's text output and related result views.	Read host status, port states, service information, and the completion summary.	Relying only on colors or a single service label instead of reading the text.

Basic Example: Scan an Authorized Lab Host

Open Zenmap from the desktop application menu or shortcut. Alternatively, run zenmap from a shell when it is installed and available in the system path.
Enter 192.168.5.102 in the Target field. Treat this address as an authorized private-lab host only; replace it with the target assigned to you.
Choose a quick or basic scan profile available in your installation. Profile names and exact settings can differ between Zenmap versions.
Inspect the Command field before running the scan. The profile is not a separate scanning engine: it is a saved group of Nmap options.
Start the scan with the Scan control and wait for Nmap to finish. The time required depends on the profile, network conditions, filtering, and the number of ports checked.
Review the results area. Locate the target status, host-discovery messages, port table, service information, and scan completion summary.

For example, a quick profile might generate a command resembling:

nmap -T4 -F 192.168.5.102

This is an illustrative command, not a promise that every installation uses these exact options. Here, 192.168.5.102 is the target, while -T4 and -F are Nmap options. The selected profile determines the generated command in your installation, so always read the actual Command field.

Using Built-In Scan Profiles

Profiles are useful for beginners because they group related options into repeatable configurations. They also make routine tasks easier to reproduce: two scans using the same target and profile can be compared more consistently than two scans assembled from memory.

Profiles are saved groups of Nmap options, not different scanning engines. A profile can affect port selection, timing, host discovery, service detection, scan behavior, and output detail. Availability and exact command options vary by Zenmap and Nmap version.

Before clicking Scan, verify the generated command. Check that the target is correct, the scope is authorized, and the options match the exercise or change plan.

Profile Versus Custom Command

Method	Best use case	Advantages	Risks or limitations
Built-in scan profile	Learning, routine checks, and repeatable lab exercises.	Easy to select, less typing, and usually consistent across repeated runs on the same installation.	Names and settings differ by version; the profile may check more or fewer ports than expected.
Edited Nmap command	An authorized task that needs options not provided by a convenient profile.	Fine-grained control over scope, ports, timing, discovery, detection, and output.	It is easier to select an unintended scope or create a scan that is slower or more intrusive.

Entering a Custom Nmap Command

The Command field can usually be edited. This allows you to use Nmap options beyond the default profiles, but it also means you are responsible for understanding the resulting command.

Keep the target value distinct from the command options. In an example such as nmap -sV --top-ports 20 192.168.5.102, -sV requests service detection, --top-ports 20 limits the selected port list, and 192.168.5.102 is the target. Changing the command can alter scan scope, port selection, timing, discovery behavior, and output detail.

Begin with low-impact scans against an authorized lab target. Read the relevant Nmap options and your organization's rules before execution. Change only options approved for the exercise, then compare the new summary with the earlier scan.

Reading Terminal-Style Scan Output

Zenmap displays familiar Nmap text output. Although the interface may add tabs, tables, or color highlighting, the text remains the important evidence. Color can help distinguish categories, but it does not replace reading the state and service columns.

Common result elements include:

Target status: Indicates whether Nmap considered the host up, down, or otherwise reachable under the selected discovery and scan conditions.
Host-discovery information: Describes observations used to determine whether the target appears reachable.
Port table: Lists examined ports and commonly includes the port number, protocol, state, and service.
Port state: Reports what Nmap observed for that port under the selected scan method and current network conditions.
Service or protocol: Associates a port with a commonly known protocol or a detected or estimated service.
Completion summary: Reports timing, the number of hosts, and other details about the completed scan.

State	What Nmap observed	Typical interpretation	Caution
open	Nmap received evidence of a reachable listener or service.	An application is probably accepting connections on that port.	It is not automatically a vulnerability or proof that the service is configured securely.
closed	The target responded, but no service was listening on that port.	The host is reachable at the network level, while that port currently has no listener.	A closed port can become open later, and the result depends on the scan method and conditions.
filtered	Filtering or insufficient responses prevented Nmap from determining normal reachability.	A firewall, access-control list, packet filter, or other network behavior may be suppressing responses.	Filtered does not prove which device or rule caused the result.

A port state is an observation, not an absolute security conclusion. It reflects the chosen scan method, the source network, routing, latency, packet loss, host behavior, and filtering at the time of the scan.

Interpreting a Simple Result

Consider this fictional result for the authorized lab host:

PORT     STATE     SERVICE
22/tcp   open      ssh
80/tcp   closed    http
443/tcp  filtered  https

22/tcp open ssh suggests that the host is reachable and that a service is listening on TCP port 22. The ssh label is an association with the commonly used service; validate it through an authorized administrative method if the exact software matters.
80/tcp closed http means the host responded, but Nmap found no listener on TCP port 80 during this scan. It does not mean that the host is unreachable.
443/tcp filtered https means Nmap could not determine normal reachability because responses were blocked or insufficient. A firewall or packet filter is one possible explanation.

Do not treat all non-open results as identical. A host with only closed ports responded to the scan but has no detected listeners on those ports. A host reported as down may be offline, incorrectly addressed, or protected by discovery filtering. A host with many filtered ports may be reachable while network controls suppress responses.

Service Detection and Service Labels

Service detection is the process of identifying or estimating the service associated with a reachable port. A service name in the output is useful for orientation, but it can be based on a conventional port association or limited evidence. Confirm important findings through authorized configuration review, asset records, or controlled service checks.

After Reviewing the Results

Compare discovered services with the services expected for the authorized host. Investigate unexpected open ports through the system owner or approved administrative process.
Document the target, date and time, selected profile, complete generated command, source network, and important findings.
Save the scan results when Zenmap and local policy permit it. Reusing the same profile or command makes later comparisons more meaningful.
Record relevant conditions such as host availability, firewall policy, scan method, and whether the result was collected from the expected network location.
Use a carefully scoped follow-up scan only when it is authorized and needed to answer a specific question.

Troubleshooting Common Problems

Zenmap does not start from a shell

The application may not be installed, its executable may not be in the system PATH, or the operating system may use a different launch method. Verify installation through the operating system's package or application manager, try the desktop menu, and confirm the executable location and path configuration where appropriate.

The hostname does not resolve

Check the spelling first. If the hostname still fails, use an authorized IP address to separate a name-resolution problem from a network problem. Then verify DNS or local name-resolution configuration and network connectivity.

The host appears down or the output is sparse

Confirm the authorized address and whether the device should be reachable from your network location. Read the host-discovery messages. The device may be offline, the address may be wrong, or a firewall or network policy may block discovery or scan traffic. Compare results only with approved diagnostic changes.

All ports appear filtered

A host firewall, network firewall, access-control list, or packet-filtering policy may be suppressing responses. Filtered is an observation, not proof of a particular firewall rule. Validate expected policy with the system or network owner, and document the scan method and source network.

The scan takes longer than expected

Latency, packet loss, filtering retries, a large port set, or additional detection can increase scan time. Review the profile and generated command, and use a smaller authorized scope for a learning exercise. Do not bypass safety controls or organizational policy merely to make a scan faster.

Key Takeaways

Zenmap is a graphical interface that creates and runs Nmap commands.
The Target field identifies the authorized host or scope; the Profile field selects saved Nmap options.
Always inspect the generated Command field before running a profile or custom command.
Open means Nmap detected a reachable listener, closed means the host responded without a listener, and filtered means filtering or missing responses prevented a normal determination.
Port states and service labels are observations that require context and, when needed, authorized validation.
Save the target, time, profile, command, conditions, and findings so scans can be repeated and compared.

For broader study, continue with Zenmap scan concepts and detailed Nmap result interpretation.