Getting Started with Nmap: Installation, Basic Scans, and Reading Results

Learn how to verify and install Nmap on Debian-based Linux, run an authorized default scan, and interpret hosts, ports, services, and port states.

Nmap is a command-line tool for network discovery and port scanning. It helps you determine whether a host is reachable and which network ports appear to accept connections.

A command-line interface (CLI) is a text-based interface in which you type commands into a terminal. In Nmap, you provide a target: the host or network selected for an authorized scan. A target can be a hostname, such as scanme.nmap.org, or an IP address, such as 192.168.5.102.

What Nmap Does

Nmap sends network probes to a target and reports what it can determine. A basic scan commonly shows whether the target appears available, selected TCP ports, the state of each displayed port, and a conventional service label.

A port is a numbered communication endpoint associated with a transport protocol. TCP is a transport protocol used by many network services, so Nmap may write a port as 22/tcp. A service is an application or protocol commonly associated with a port, such as SSH or HTTP.

Nmap can support many kinds of discovery and assessment. This first lesson concentrates on verifying the installation, running a default scan, and reading introductory output. For broader context, see What Is Nmap and Nmap.

Check Whether Nmap Is Installed

Open a terminal and run the version command:

nmap --version

If Nmap is installed and available in your command path, the output includes a version banner. The version identifies which Nmap release you are using. Additional lines may describe the operating platform, libraries compiled into the program, and available network input/output engines. You normally do not need to interpret every build detail when starting out; the important first check is that the command runs successfully.

A shell message such as nmap: command not found usually means that Nmap is not installed or that its executable is not available in the current command path.

Install Nmap on Debian-Based Linux

Debian-derived distributions use APT, a package-management system for installing and maintaining software. On an APT-based system, install Nmap with:

sudo apt-get install nmap

The sudo command requests temporary elevated privileges. You normally need an account authorized to install software, and the system may ask for your password or confirmation.

After the package manager finishes, validate the installation:

nmap --version

If permission is denied, use an administrator-authorized account and the approved privilege-elevation method for that system. Do not bypass organizational access controls.

For a focused installation walkthrough, see Install Nmap on Linux.

Commands for Starting with Nmap

Task	Command	When to use it	Expected result
Check the installation	`nmap --version`	Before the first scan or after installation	A version banner and local build information
Install on an APT-based system	`sudo apt-get install nmap`	When the version command is unavailable	Nmap is downloaded and installed, subject to administrator permission
Scan an approved public practice host	`nmap scanme.nmap.org`	For a first authorized external learning scan	A basic report containing resolution, host status, ports, states, and service labels
Scan an authorized private-LAN host	`nmap 192.168.5.102`	For an owned or explicitly permitted internal host; the address is only an example	A report for the specified private address
Open local documentation	`man nmap`	When you need offline command reference material	The locally installed Nmap manual page

Run Your First Default Scan

The basic scan syntax is the nmap command followed by one target hostname or IP address:

nmap TARGET

A scan with a target but no additional options is called a default scan. Nmap chooses its standard introductory behavior rather than a scan type or port range that you specify manually.

Approved public practice target

Use the designated public learning host for an external example:

nmap scanme.nmap.org

This command asks Nmap to resolve the hostname and perform a default scan. Even when a host is intended for practice, follow its stated acceptable-use rules and keep your activity limited to the authorized purpose.

Private-network example

The same command structure works for an internal host:

nmap 192.168.5.102

192.168.5.102 is a documentation placeholder for a private-LAN device. Replace it only with an address belonging to a system you own or have permission to test. Private addresses are commonly used inside local networks and are not, by themselves, permission to scan.

See Private IP Addresses for more context about private addressing.

Read the Basic Scan Report

A typical report has several recognizable sections. The exact wording and visible ports vary with the target, Nmap version, network path, and filtering devices.

Start banner and target resolution

Near the beginning, Nmap prints a start line identifying the program and the time the scan began. It then identifies the target. When you provide a hostname, Nmap may show the relationship between that name and a resolved IP address, for example:

Starting Nmap 7.x
Nmap scan report for scanme.nmap.org (203.0.113.25)

The hostname is a human-readable network name. The IP address is the numeric address used to communicate with a device or interface. A hostname can resolve to one or more IP addresses, and the result can depend on DNS configuration and network conditions. The address above is illustrative output, not a target to scan.

Host status and latency

Nmap may report:

Host is up (0.041s latency).

Host is up means Nmap received enough evidence to consider the target reachable. Latency is the observed time associated with communication to the target. In this example, the reported value is about 0.041 seconds, or 41 milliseconds. Latency changes with distance, congestion, routing, and the target's response behavior.

A host-status message does not mean that every port is open. It only describes reachability based on the probes Nmap used.

The port table

A basic report can include a table like this:

PORT      STATE     SERVICE
22/tcp    open      ssh
80/tcp    open      http
445/tcp   filtered  microsoft-ds

The columns are:

Port: The numeric endpoint and transport protocol, such as 22/tcp. The number 22 and the TCP protocol are distinct from the service name.
State: Nmap's conclusion about whether the port appears open, closed, or filtered.
Service: A conventional name associated with that port number, such as ssh or http.

Service labels are useful starting hints. They are conventional port-to-service associations inferred from the port number and scan response; they do not, by themselves, prove the exact application, product, or version. A service can run on a nonstandard port, and an application can use a port conventionally assigned to something else.

Basic Port States

State	Meaning	What it does not prove
open	Nmap found a service that appears to be listening and accepting connections on the port.	It does not prove which exact product or version is running, or that the service is secure.
closed	The host appears reachable, but no listening service was detected on that port.	It does not prove the host is offline or that the port will remain closed permanently.
filtered	Packet filtering prevents Nmap from determining whether the port is open or closed.	It does not prove that no service exists behind the filter.

An open port appears to accept connections. A closed port is reachable but has no listening service detected. A filtered port is inconclusive because a firewall, access-control device, or other packet filter interferes with the probes.

How to Read Common Entries

Example entry	Port and protocol	State	Service label	Interpretation
`22/tcp open ssh`	TCP port 22	Open	SSH	A service appears to be listening on TCP 22; SSH is the conventional association.
`25/tcp filtered smtp`	TCP port 25	Filtered	SMTP	Filtering prevents a confident open-or-closed conclusion; SMTP is only the conventional label.
`80/tcp open http`	TCP port 80	Open	HTTP	A service appears to accept TCP connections on port 80; it may be an HTTP service, but the label does not identify the exact software.
Several ports not shown; summary reports closed ports	Various scanned TCP ports	Closed	Usually no service label is displayed	The host responded, but those ports had no listening service detected. Nmap commonly summarizes them instead of printing every closed port.

Common service associations include FTP on TCP 21, SSH on TCP 22, DNS or domain services on TCP 53, HTTP on TCP 80, LDAP on TCP 389, and SMB-related services on TCP 445. These are port numbers and protocol associations, not guarantees about the software actually running.

A server can expose several services at once. For example, a report might show SSH and HTTP as open, LDAP as filtered, and many other scanned ports as closed. High-numbered ports can also appear with an unfamiliar or unknown service label when the port is nonstandard or Nmap cannot confidently associate it with a known service.

Why closed ports may be summarized

Nmap does not need to print every closed port individually to communicate the result. A completion summary may say that a number of ports are not shown because they are closed. Read that summary as: those scanned ports responded in a way consistent with no listening service. It is not a statement about every port on the entire host, because the default scan examines a defined set rather than every possible port.

Practical Reading Workflow

Read the start banner and confirm which Nmap command ran.
Check the target name and resolved IP address. Make sure the result is the host you intended to assess.
Read the host-status line and latency. A reachable host can still have all selected ports closed or filtered.
Inspect each displayed port as a combination of number, protocol, state, and service label.
Treat open ports as visible listening points, filtered ports as inconclusive, and closed ports as reachable but not listening at the time of the scan.
Read the completion summary to understand how omitted ports were grouped.

For a deeper treatment of results, continue with Interpret Scan Results and Port States. To investigate the actual service and version later, see Determine Service Version.

Use the Local Manual Page

Nmap includes local documentation that can be opened without an Internet connection:

man nmap

The manual page is command documentation accessed with the man command. Use it to investigate scan options, target syntax, output terminology, and the meaning of additional flags after you are comfortable with the basic scan.

When reading the manual, search for a term by pressing /, entering the term, and pressing Enter. Press q to exit the manual viewer. Local documentation may describe options that are not covered in this introductory lesson.

Troubleshooting First Scans

Nmap is not found

If the shell reports that nmap is not found, Nmap may not be installed or its executable may not be in the current command path. Install it with the appropriate package manager, then run nmap --version again.

Installation reports a permission problem

The account may lack administrator privileges, or the package command may have been run without the required elevation. Use an account authorized to install software and the system's approved administrative method.

The hostname does not resolve

Check the spelling first. A DNS problem or lack of network connectivity can also prevent resolution. Verify network and DNS connectivity, and use a known authorized IP address only when appropriate.

The host appears down or expected ports are missing

The target may be offline or unreachable, a firewall may be affecting probes, or the expected service may not be listening on the assumed port. Confirm that the target is authorized, online, and reachable. Treat filtered results as inconclusive rather than assuming that a service is absent.

A service label is unfamiliar

The port may be nonstandard, or Nmap may not have a confident port-to-service association. Treat the label as an initial hint, not definitive application identification. Consult authorized system documentation or use later service-version discovery material when your assessment permits it.

Key Exam Notes

Nmap is a command-line network discovery and port-scanning tool.
A target can be specified by hostname or IP address.
nmap --version verifies command availability and reports the installed version.
sudo apt-get install nmap installs Nmap on an APT-based Linux system when the user has suitable privileges.
A default scan has a target but no extra scan options.
open means a service appears to be listening; closed means the host is reachable but no service is listening; filtered means filtering prevents a confident conclusion.
A service label is a conventional association, not proof of the exact application or version.
Always limit scans to systems you own or are explicitly authorized to assess.