Running and Interpreting an Example Scan in Zenmap

Learn how to run an authorized Nmap scan in Zenmap, review profiles and commands, interpret port states, and save useful results.

Zenmap is the graphical user interface for Nmap, a tool for discovering hosts, ports, and network services. It gives you form-based controls for choosing a target and scan profile while still showing the Nmap command that will run.

This lesson uses a private lab host, 192.168.5.102. Scan only systems, networks, and lab environments that you own or are explicitly authorized to assess. Scan type and timing can affect target systems and may trigger network monitoring or security tools.

What Zenmap Does

Zenmap provides a visual way to configure, run, review, and save Nmap scans. Instead of composing every option at a shell prompt, you can enter a target, choose a named profile, inspect the generated command, and start the scan from the interface.

The graphical interface does not replace Nmap. A profile is a reusable collection of Nmap options, and the Command field shows the command Zenmap will execute. This makes Zenmap useful for beginners who prefer visual setup, as well as for experienced users who want saved scan history and graphical result views.

Before beginning, it helps to understand an IP address, a hostname, a port, and a network service. An IP address identifies a host or interface, a hostname is a human-readable name that may resolve to an address, and a service is an application such as a web server listening on a port.

Start Zenmap

From the desktop

Open the operating system's application launcher, search for Zenmap, and select it. The exact menu location depends on the operating system and desktop environment.

From a terminal

On systems where Zenmap is installed and available on the command path, run:

zenmap

If the command is unavailable, Zenmap may not be installed, may not be on the system path, or the platform may use a different launch method. Try the desktop application menu and verify the local installation.

Some scan techniques and host-discovery methods require elevated privileges for accurate or complete results. Depending on the operating system and selected profile, Zenmap may request administrator or root privileges. Provide elevation only when authorized and when you understand why the selected scan needs it.

Zenmap's Main Window

The central workflow is: choose a target, choose a profile, review the generated command, and press Scan. The target is the authorized host, hostname, address range, or network being assessed.

Control	Purpose	Typical user action
Target	Specifies the authorized IP address, hostname, range, or network.	Enter `192.168.5.102` for the lab example.
Profile	Selects a predefined collection of Nmap options.	Choose a quick or basic scan for initial discovery.
Command	Shows the Nmap command generated by the target and profile.	Read it before running; edit it only when an approved custom command is needed.
Scan button	Starts the selected Nmap scan.	Select it after checking scope and options.
Nmap Output	Displays familiar textual Nmap output.	Read host status, port rows, service labels, and the summary.
Ports/Hosts	Presents hosts and discovered ports in a structured view.	Filter or inspect findings without reading only the text output.
Topology	Shows a graphical representation of relationships or network paths inferred from scan data.	Use it as a visual aid, remembering that it can be incomplete.
Host Details	Shows host-specific information when available.	Inspect details for a selected host.
Scans	Shows scan status, history, and prior results.	Return to an earlier scan or check whether a scan is still running.

Profile names and available views can vary between Zenmap versions and operating systems. The generated command is therefore more precise than relying on a profile name alone.

Run a Basic Example Scan

Open Zenmap.
In Target, enter the single authorized lab address 192.168.5.102.
Open Profile and choose a quick or basic scan profile appropriate for initial discovery. The exact name depends on the installed version.
Read the generated command in Command. An illustrative quick-scan command might look like this:

nmap -T4 -F 192.168.5.102

The exact command can differ by Zenmap version and profile definition. In this example, -F represents a faster, limited port selection and -T4 requests a faster timing template. Do not assume that a quick scan checks every possible port or provides detailed service information.

Confirm that the target is the intended authorized host and that the options fit the approved scope.
Select Scan.
Wait while the status, textual output, and result views populate. A scan can take longer when the host filters probes, the network is slow, or the profile performs more detailed detection.
Review Nmap Output, then compare it with Ports/Hosts for a structured view.

The important connection is that the Target and Profile determine the generated command, and the command determines what Nmap probes. Changing the target field changes where the command runs; changing options in the command changes how Nmap probes the target.

Choose and Use Scan Profiles

A scan profile is a named, reusable set of Nmap options. Select one according to the question you need to answer:

Quick inventory: quickly identify common exposed ports on a single authorized host.
More detailed port scan: inspect a broader port set when the approved scope requires it.
Operating-system and service detection: gather additional clues about the host and applications, when permitted.

More detailed profiles generally take longer and create more network traffic. Service detection, for example, can probe applications to identify their names and possible versions. An illustrative command is:

nmap -sV 192.168.5.102

Use such commands only against an authorized target. A profile's label is not a guarantee of its exact settings, so inspect the Command field before launching it.

Use a Custom Nmap Command

The Command field can be edited when an approved scan configuration is not represented by the available profiles. This is command customization, not the same thing as changing the target field. The target identifies where to scan; Nmap options specify what type of probes and port coverage to use.

Begin with an authorized single-host target.
Select a nearby predefined profile and inspect its generated command.
Modify only the approved Nmap options in the Command field.
Check the target, port coverage, timing, privileges, and expected traffic before running it.
Run the command and compare the output with the original profile's results.
If the command is approved for repeated use, save it as a clearly named custom profile with a description of its intended scope.

Approach	Best use case	Advantages	Cautions
Predefined Zenmap profile	Common discovery or inventory tasks.	Fast to select and easier for beginners to review.	Name and options vary by version; detailed profiles may be slower.
Edited Command field	An approved configuration requiring options not exposed by the selected profile.	Precise control while retaining Zenmap's interface and output views.	Manual changes can broaden scope, increase traffic, or change findings.
Saved custom profile	A reviewed command needed repeatedly for the same approved purpose.	Consistent reuse and clearer documentation.	Review it when network scope, policy, or Nmap behavior changes.

Read the Nmap Output View

Nmap Output contains the textual output produced by Nmap. Start by locating these sections:

Scanned target: confirms the address or hostname Nmap attempted to scan.
Host status: indicates whether Nmap considers the host up or unreachable.
Port table: lists protocol, port number, state, service label, and sometimes version information.
Scan summary: reports timing, elapsed duration, and the scope or number of hosts examined.

A result row commonly contains a protocol such as TCP or UDP, a numbered port such as 22 or 80, a state, a service label, and optional version information. A service label is an informed guess based on the port and responses. Even version detection is best treated as evidence that should be validated against the authorized host's configuration.

Zenmap may use colors to make open and closed ports easier to distinguish. Colors are interface aids, not the authoritative result. Read the written state column and surrounding text, especially when output is copied into a report or viewed in a different theme.

If Nmap receives no useful response, a port may be reported as filtered rather than absent. A host or service can be hidden by firewalls, routing behavior, packet loss, or scan-method limitations.

Interpret Common Port States

A port is a numbered network endpoint associated with a TCP or UDP service. Its state describes what the selected scan method could determine at that point in time.

State	Meaning	Common cause	Appropriate interpretation
open	A reachable service is accepting connections or packets according to the scan method.	An application is listening and responds to the probe.	Investigate the identified service and confirm it is expected.
closed	The port is reachable, but no service is listening in the tested manner.	The host returns a response indicating that the endpoint is not open.	The host is reachable at that port, but this does not indicate a running service there.
filtered	Nmap cannot determine whether the port is open because filtering or lack of response blocks a conclusive result.	A firewall drops or blocks probes, or packet loss prevents a reply.	Inconclusive; do not treat it as proof that a service is absent.
unfiltered	The port is reachable, but Nmap cannot determine whether it is open or closed with the selected scan.	The scan receives a response but the method does not establish the listening state.	Interpret in the context of the scan type and consider approved validation.
open\|filtered	Nmap cannot distinguish between open and filtered.	No response is received for a scan where either condition is possible.	Neither an accessible service nor filtering has been proven.
closed\|filtered	Nmap cannot distinguish between closed and filtered.	The scan method permits either explanation for the observed response.	Use the result cautiously and examine network controls or another approved method.

Other states and reasons may appear depending on the scan type. Read the state together with the protocol, options, and reason text rather than interpreting a port number in isolation.

Understand Host and Service Findings

Nmap's host-discovery process attempts to decide whether a target appears online. A host reported as up responded in a way consistent with availability. A host reported as down or unreachable did not provide the expected response; this does not always prove that the machine is powered off.

Possible explanations for an apparent down host include an incorrect address or hostname, blocked discovery probes, missing routes, a VPN problem, or local network connectivity failure. Review the profile's discovery behavior and the network path before drawing a conclusion.

Service and version information is also contextual. A row such as TCP port 443 in the open state with an HTTPS-related label suggests a reachable web service, but labels are best-effort identification. Confirm important findings using authorized system configuration, service documentation, or other approved validation.

Every scan is an observation at a particular time. Results can change when firewall rules, routing, service status, host interfaces, or scan options change. A single scan should not be treated as a permanent inventory.

Explore Other Zenmap Result Views

Ports/Hosts: provides a structured presentation of discovered hosts and their ports. It is useful for comparing entries without parsing only the terminal-style text.
Topology: displays a graphical representation inferred from scan data. It may omit relationships or be incomplete, so do not assume it is a complete network map.
Host Details: presents host-specific data when the scan collected it, such as address information, detected services, or other available attributes.
Scans: helps review scan status, history, and prior results within Zenmap.

For the example host, use Nmap Output to read the exact textual states and Ports/Hosts to check the same findings in a structured format. The views are different presentations of scan data, not independent scans.

Save and Document Results

Save results in an appropriate format for later analysis and reporting. Zenmap and Nmap installations may offer different output choices; use the format that preserves the information your team needs. See saving Nmap output for related guidance.

A useful record includes:

Authorization or ticket reference.
Target scope, including addresses, hostnames, or ranges.
Profile name or complete custom command.
Date, time, timezone, and operator.
Relevant Nmap and Zenmap versions.
Notable open, closed, filtered, or other states.
Limitations such as blocked discovery, packet loss, or incomplete topology.

Scan output can reveal host addresses, services, software details, and network structure. Store and share it according to organizational security and data-handling policy.

Troubleshoot Common Problems

Zenmap does not start

Confirm that Zenmap is installed, try the desktop application menu, and check the local installation path or platform documentation. If zenmap fails in a terminal, the executable may not be on the system path.

The host appears down

Verify authorization and the entered address, check name resolution and connectivity, and review whether the selected profile's discovery behavior suits the approved environment. Firewalls can block discovery probes even when a host is online.

Expected services are not open

Confirm that the service is running, that it listens on the expected interface and port, and that the selected profile covers that port. Compare the result with authorized host configuration and firewall rules.

The result is filtered

Treat filtered as inconclusive. A firewall, packet loss, an asymmetric path, or the scan method may have prevented a decisive response. Review permitted firewall and network-path information, and use an approved alternative profile only when necessary.

The scan is slow or appears stalled

Check that practice is limited to one authorized host, inspect the profile and generated command, and allow time for timeout-based results. Broad port coverage, detailed detection, filtering, latency, and packet loss can all increase duration.

Service names or versions are missing

The profile may not include service detection, the application may hide banner information, or Nmap may not identify it confidently. Check the command for version-detection options, then validate important labels against the known lab configuration.

Practical Exercises

Quick scan of one authorized lab host

Open Zenmap and enter 192.168.5.102 in Target.
Choose a quick or basic profile.
Inspect the generated command.
Run the scan.
Find host status and port rows in Nmap Output.
Use Ports/Hosts to locate the service label for an open port.

The goal is to connect the visual fields with the underlying Nmap command and distinguish open, closed, and filtered results.

Compare a profile with a custom command

Use an authorized single-host target.
Select a profile and record its generated command.
Change only approved options in Command.
Run the scan and compare its output with the original.
Save the command as a clearly named profile only if it is approved for reuse.

Interpret three states

If a scan shows one open, one closed, and one filtered port, associate the open entry with a potentially reachable service, the closed entry with a reachable host where that service is not listening, and the filtered entry with an inconclusive result. Do not record filtered as equivalent to absent.

Key Exam Notes

Zenmap is a graphical interface for Nmap; its Command field exposes the underlying Nmap invocation.
The Target field identifies where the authorized scan runs, while the Profile and Command determine how it runs.
Open means a service appears reachable, closed means the port is reachable without a listener, and filtered means the state cannot be determined conclusively.
Host discovery and service detection are different activities and can be affected by firewalls and scan options.
Color highlighting is only a visual aid; the written state and scan context are authoritative.
Results are time-specific observations and must be documented with scope, command or profile, and timestamp.