VMware ESXi and vSphere Cluster Management

Nmap: Network Discovery, Port Scanning, and Security Assessment

Learn authorized Nmap scanning for host discovery, TCP and UDP ports, service and OS detection, NSE, timing, output analysis, and remediation.

Nmap is a command-line tool for network discovery, port scanning, service identification, and security auditing. It helps you answer questions such as which approved hosts are reachable, which TCP or UDP ports respond, and which services may be exposed.

Nmap is not a substitute for an asset inventory, vulnerability scanner, configuration review, or penetration test. A port scan identifies network exposure; it does not by itself prove that a service is vulnerable or that exploitation is appropriate.

What Nmap Does

An authorized assessment commonly separates four activities:

• Discovery: Determine which addresses appear to have live hosts.
• Inventory: Record hosts, ports, protocols, services, products, and versions.
• Vulnerability assessment: Compare validated software and configurations with known weaknesses and security requirements.
• Exploitation: Demonstrate impact using controlled methods. This is a separate activity requiring specific authorization and safeguards.

Nmap primarily supports discovery and inventory, with additional information gathering through service detection and the Nmap Scripting Engine (NSE).

Prerequisites and Installation

Helpful background includes IPv4 and IPv6 addressing, CIDR notation, routing, firewalls, TCP/IP, UDP, common services such as DNS and HTTPS, and command-line navigation. Review IP addresses, the TCP/IP suite, and TCP and UDP ports if these topics are unfamiliar.

Linux

Use your distribution's package manager. For Debian or Ubuntu:

sudo apt update
sudo apt install nmap
nmap --version

Other distributions provide an equivalent package, often named nmap. See installing Nmap on Linux for distribution-specific details.

macOS

Install Nmap using an approved package supplied by the Nmap project or a package manager used by your organization. After installation, verify it from Terminal:

nmap --version

Windows

Install the official Windows package, follow the installer prompts, and open PowerShell or Command Prompt. Confirm that Nmap is available on the command path:

nmap --version

See installing Nmap on Windows. Some Windows packages also offer Zenmap, an optional graphical interface. Availability depends on the package and release; the command-line interface remains the primary way to learn and automate Nmap. Read what Zenmap is for its role.

Privileges

Elevated privileges let Nmap create and inspect certain raw packets. On Unix-like systems, a SYN scan may require sudo. Without raw-packet access, Nmap can use a TCP connect scan. On Windows, installer and driver configuration affect which scan methods are available.

sudo nmap -sS -p 80,443 192.0.2.10
nmap -sT -p 80,443 192.0.2.10

The first command requests a SYN scan; the second uses the operating system's normal connection mechanism. Use the least privilege that provides the evidence you need.

Command Structure and Target Scope

The general form is:

nmap [scan options] [target specification]

Targets can be individual addresses, hostnames, CIDR networks, address ranges, or files. Validate every target before pressing Enter. A typo in a CIDR prefix can expand a small lab scan into a much larger assessment.

Useful scope controls include:

nmap -iL approved-targets.txt --exclude 192.0.2.254
nmap 192.0.2.10 192.0.2.20
nmap 192.0.2.10-20

Use IP range syntax and keep a copy of the approved scope with the scan record.

Host Discovery

Host discovery determines which targets appear reachable before Nmap spends time testing ports. Depending on the network and privileges, Nmap can use ICMP echo or timestamp probes, TCP SYN or ACK probes, and ARP on a local Ethernet network.

-sn: Discovery Without Port Scanning

nmap -sn 192.0.2.0/24

This performs host discovery and reports responsive targets without conducting the normal port scan. On a local IPv4 Ethernet segment, ARP discovery is often particularly effective because local hosts must respond to address-resolution traffic.

A host can appear down even when it is operating. Firewalls may filter ICMP, TCP probes, or ARP visibility may not extend across a routed network. A justified -Pn skips host discovery and treats each target as online:

nmap -Pn -p 80,443 192.0.2.10

Use -Pn selectively because it can cause Nmap to scan every supplied address, including inactive ones. Related lessons cover online-host discovery, TCP SYN discovery, and disabling the ping sweep.

Ports, Selection, and States

A port is a numbered transport-layer endpoint used by a TCP or UDP service. By default, Nmap checks a set of common ports. Specify ports when you need a focused, repeatable test.

nmap -p 22 192.0.2.10
nmap -p 22,80,443 192.0.2.10
nmap -p 1-1024 192.0.2.10
nmap -p- 192.0.2.10
nmap --top-ports 100 192.0.2.10

A broader port set gives better coverage but takes more time and creates more traffic. A narrow set is faster and less disruptive but can miss nonstandard services. Use port-range selection to make the scope explicit.

These meanings are explained further in Nmap port states and interpreting scan results.

TCP Scan Methods

A SYN scan sends an initial TCP connection request and evaluates the response without completing a normal application connection. It is commonly requested with -sS and often needs elevated privileges:

sudo nmap -sS -p 1-1024 192.0.2.10

A connect scan, -sT, asks the operating system to complete a normal TCP connection. It is useful when raw-packet privileges are unavailable:

nmap -sT -p 80,443 192.0.2.10

Specialized methods include ACK (-sA), Window (-sW), FIN (-sF), NULL (-sN), and Xmas (-sX) scans. ACK scans can help map filtering behavior; the others rely on TCP behavior that varies between operating systems and modern firewalls. They are not reliable universal firewall-bypass techniques and may generate alerts. Interpret their results conservatively.

Firewalls can drop packets, reject them, proxy connections, or apply rules based on source, destination, and time. Therefore, “filtered” often describes the path and policy observed from the scanner, not the complete state of the target.

UDP Scanning

UDP is connectionless and has no TCP-style handshake. An open UDP service may respond only to a correctly formed application request, while a closed port may return an ICMP error. Firewalls and ICMP rate limiting can produce long waits and uncertain results.

nmap -sU -p 53,123,161 192.0.2.20

Common outcomes include open, closed, and open|filtered. The last result is not confirmation that a service is open. Focus on relevant infrastructure ports, allow adequate time, and validate important results with service-specific administrative tools or logs. See UDP scanning for additional considerations.

Service and Version Detection

Port numbers are conventions, not proof of application identity. A web service can listen on a nonstandard port, and an unrelated application can use a familiar port. The -sV option performs banner probing and service fingerprinting:

nmap -sV -p 22,80,443 192.0.2.10

Output may include a protocol or service name, product and version, a CPE identifier, and a confidence value. CPE is a standardized naming format for software and hardware platforms. Confidence indicates how strongly the observed response matches a fingerprint; it is not a vulnerability score.

Version detection can be affected by encryption, proxies, load balancers, custom builds, suppressed banners, and nonstandard ports. Treat a detected version as an inventory lead, not proof of a vulnerability. Confirm unexpected services with the owner, configuration management, authenticated administrative data, or service logs. See service-version detection.

Operating-System Detection and Traceroute

OS fingerprinting infers an operating system from network-stack response characteristics. Request it with -O:

nmap -O -sV --traceroute 192.0.2.10

OS detection works best when Nmap can observe useful open and closed TCP ports. NAT, firewalls, proxies, virtualization, unusual network stacks, and too few suitable ports can reduce accuracy. Results are estimates with confidence values, not authoritative endpoint inventory. Use asset-management or endpoint-management data for confirmation. The combined -A option requests OS detection, version detection, default scripts, and traceroute; use it only when that broader activity is approved.

Traceroute shows information about the path from the scanner to the target. It is useful for observing routing and approximate intermediary hops, but it is not definitive topology documentation. Asymmetric routing, filtering, NAT, and load balancing can hide or alter the apparent path. Read more about OS detection.

Nmap Scripting Engine

NSE is Nmap's Lua-based scripting framework. Scripts can collect metadata, inspect configurations, query protocols, and perform checks beyond basic port scanning. Categories include default, safe, discovery, version, auth, brute, intrusive, vuln, exploit, dos, and others.

Categories are useful labels, not a replacement for reading documentation. Discovery and broadly safe inventory scripts are generally the best starting point. Intrusive, exploit-oriented, denial-of-service, brute-force, and malware-related scripts can cause service impact, trigger defenses, or alter systems. They require explicit authorization and a defined test plan.

nmap -sV --script default,safe 192.0.2.10
nmap --script-help http-title
nmap --script-updatedb
nmap --script example-script --script-args 'name=value' 192.0.2.10

Review each script's purpose, arguments, network behavior, and impact before execution. Prefer scripts for inventory and configuration checks rather than making exploitation the default workflow.

Timing, Performance, and Reliability

Nmap balances speed and accuracy using timing templates, parallelism, retransmission limits, host timeouts, scan delays, and rate controls. Faster is not automatically better: packet loss, latency, firewalls, and rate limiting can make an aggressive scan less complete.

Timing templates range from cautious to aggressive, using -T0 through -T5. Choose based on the approved network and device sensitivity rather than defaulting to maximum speed. Options such as --max-retries, --host-timeout, --scan-delay, --max-rate, and --min-rate can control behavior, but poorly chosen values can reduce reliability.

nmap -T3 --scan-delay 100ms -p 80,443 192.0.2.10
nmap --max-retries 3 --host-timeout 5m -p 1-1024 192.0.2.10

Measure first, then tune one variable at a time. Repeat with narrower scope or different timing when results are incomplete, inconsistent, or unexpectedly filtered. Record the exact command, Nmap version, time, source network, and relevant environmental conditions. See timing options and probe delays.

Output Formats and Interpretation

Save results so they can be reviewed, compared, reported, and imported into approved tools:

nmap -sV -oA scan-results 192.0.2.10

Read the host summary first, then the port table. For each row, separate the port number, transport, state, service guess, product, version, and confidence. Review script output, MAC address and vendor information where available, and warnings such as incomplete scans or skipped hosts. A MAC vendor is not proof of the host operating system or owner.

Compare saved results over time to identify newly open ports, changed versions, altered filtering, or hosts that disappeared. Use comparable scope, timing, source location, and privileges when possible. Learn more in saving Nmap output.

Frequently Assessed Ports

These are common conventions, not identity guarantees. Always validate the actual service.

Authorized Assessment Workflow

1. Approve scope: Record targets, exclusions, permitted options, timing, contacts, and emergency stop procedures.
2. Establish a baseline: Run host discovery and compare apparent hosts with the expected inventory.
3. Discover focused TCP and UDP exposure: Start with relevant ports, then expand to all TCP ports or selected UDP ports when justified.
4. Identify services: Use -sV on confirmed hosts and record versions, CPE values, and confidence.
5. Gather safe metadata: Use reviewed default, safe, or selected discovery scripts.
6. Validate: Confirm important findings with owners, configuration data, logs, or service-specific tools. A detected version is not proof of a vulnerability.
7. Classify and report: Map each open port to business need, owner, intended exposure, evidence, and risk.
8. Remediate and retest: Repeat a comparable scan after changes and document both intended fixes and regressions.

nmap -sV -iL approved-targets.txt -oA service-inventory

Defensive Interpretation and Remediation

For every open port, ask: What business function requires it? Who owns the system? Should it be reachable from this network? Is the software patched and authenticated? Is the exposure documented?

Possible actions include:

• Disable and uninstall unused services.
• Restrict firewall rules to required source networks and destinations.
• Bind services to an internal interface instead of all interfaces.
• Patch or upgrade outdated software and remove unsupported versions.
• Require strong authentication, encryption, and appropriate access controls.
• Segment sensitive services into protected network zones.
• Document accepted risk when a required service cannot be removed, including owner, justification, controls, and review date.

Closing a port is not always the correct solution. A required web, DNS, or administration service may need to remain available; the goal is intended exposure with appropriate controls. Retest after remediation using the same scope and comparable conditions.

Troubleshooting Common Results

Exam-Relevant Notes

• -sn performs host discovery without the normal port scan; -Pn skips discovery and treats targets as online.
• -sS is a SYN scan and commonly requires elevated privileges; -sT is a full TCP connect scan.
• -sU scans UDP and commonly produces slower, less certain results.
• -sV identifies services and versions; a port number alone does not identify the service reliably.
• -O requests OS fingerprinting, while --traceroute reports path information.
• -A combines several detection features and should not be treated as a harmless default.
• filtered means filtering prevented a conclusion; open|filtered does not confirm an open service.
• XML output is structured and suitable for parsing; protect all output because it describes network exposure.