VMware ESXi and vSphere Cluster Management

Getting Started with Nmap: Installation, Basic Scans, and Reading Results

Learn how to install and verify Nmap, run authorized default scans, and interpret hosts, ports, states, services, latency, and filtered results.

What Nmap Does

Nmap is a command-line network discovery and port-scanning utility. It can help identify reachable hosts, assess TCP port states, and associate ports with likely services.

A target is the hostname or IP address supplied to Nmap. A hostname is a human-readable network name that DNS can resolve to one or more IP addresses. An IP address is a numeric address identifying a host or network interface.

The general command shape is:

nmap [options] target

For example, nmap example-host uses a hostname, while nmap 192.0.2.10 uses an IP address. Commands are entered in a terminal through a shell, such as Bash or another supported command-line environment.

A default scan is a starting point. It is not the same as deeper enumeration, service and version detection, vulnerability testing, or exploitation. Those activities require separate planning, authorization, and interpretation.

Verify That Nmap Is Installed

Run the version command in a terminal:

nmap --version

The output normally identifies the installed Nmap release and may also show the operating system platform, enabled libraries, and available packet input/output engines. These details can differ between distributions and builds.

If the shell reports that nmap is not found, the program may not be installed, or its executable may not be available in the current environment's PATH. Install it using the operating system's package manager, then run the version command again.

Install Nmap on Debian-Based Linux

On Debian-based distributions such as Debian or Ubuntu, refresh package metadata and install the package:

sudo apt update
sudo apt install nmap

sudo requests temporary administrative privileges. Installation generally requires an authorized administrator account. If permission is denied, use the system's approved administrative process rather than attempting to bypass permissions.

Other Linux distributions may use different package managers and package names. Follow the current package-management guidance for that distribution instead of applying Debian or Ubuntu commands unchanged.

Run a First Authorized Default Scan

A default scan is Nmap's standard behavior when you provide only a target and no additional scan options. For a public training target, use:

nmap scanme.nmap.org

Use this target only according to its current published usage rules. Do not add aggressive options or perform additional testing unless those rules explicitly permit it.

Nmap resolves a hostname to an IP address before scanning. A hostname can resolve to multiple addresses, and output may mention additional addresses that were not scanned. Scan duration and findings can change because hosts, services, filtering, DNS records, and network conditions change over time.

Scan a Permitted Local Lab Host

You can apply the same syntax to a private-network machine that you own or that is explicitly included in your authorized scope:

nmap 192.0.2.10

192.0.2.10 is reserved for documentation. When performing the exercise, replace it with the actual address of an owned lab host. A private address alone does not establish authorization; confirm ownership and scope first.

Read the Basic Report

The exact output varies, but a basic report commonly contains a target heading, a host-status line, a port table, an omitted-port summary, and a completion summary. The following is illustrative rather than a guaranteed result:

Starting Nmap 7.XX ( ... )
Nmap scan report for training-host
Host is up (0.012s latency).
Not shown: 997 closed tcp ports
PORT     STATE    SERVICE
22/tcp   open     ssh
80/tcp   open     http
443/tcp  filtered https

Nmap done: 1 IP address (1 host up) scanned in 3.21 seconds

In this example, 22/tcp open ssh means TCP port 22 responded as open and is commonly associated with SSH. It does not prove which SSH implementation is running or identify its exact version.

Output element	Meaning	How a beginner should interpret it
Scan report for	The target name used in the report	Check that it is the intended, authorized target.
Host is up	Nmap received enough responses to consider the host reachable	The device responded to discovery or scan activity.
Latency	Observed network response delay	A small value often indicates a nearby or responsive path; it is not a security rating.
Not shown	Ports omitted from the table because they share a summarized state	For example, closed ports may be counted instead of listed individually.
PORT	The port number and transport protocol	`22/tcp` means TCP port 22.
STATE	Nmap's assessment of the port's condition	Use it with the protocol and target context.
SERVICE	A likely service associated with the port	In a default scan, this is commonly inferred from well-known port assignments, not confirmed product identification.
Scan completion summary	Totals and elapsed time for the scan	Confirm how many addresses and hosts were scanned and how long the operation took.

Ports, Protocols, and Services

A TCP port is a numbered logical endpoint used by TCP applications. A service is an application expected to listen on a port. Nmap's default service labels are useful clues, but they are not proof of the exact application or version. Applications can use nonstandard ports, and multiple services can be configured differently.

The three main port-table columns are:

PORT: the number and transport protocol, such as 22/tcp.
STATE: Nmap's assessment of whether the port is reachable, unreachable, or obscured by filtering.
SERVICE: a likely service association, such as ssh or http.

Common Port States

State	Meaning	Typical implication
open	An application is accepting connections or otherwise responding on the port.	A service appears reachable. Investigate its ownership and configuration only within scope.
closed	The target is reachable, but no service is accepting connections on that port.	The port is accessible enough to return a response, but there is no listener there at the time of the scan.
filtered	A firewall, packet filter, or missing response prevents Nmap from determining whether the port is open.	Do not interpret it as either definitely open or definitely closed.
open\|filtered or unknown	Nmap cannot distinguish an open port from a filtered one with the available response.	Treat it as uncertain and consider the scan method and network controls before drawing conclusions.

An omitted-port line such as Not shown: 997 closed tcp ports is a summary. It means those ports were not printed individually because they had the same closed state. It does not mean that Nmap ignored them.

Use Nmap's Local Documentation

Nmap includes documentation with the installation. Open the detailed manual page with:

man nmap

For a shorter option overview, use:

nmap --help

The manual page is especially useful when an internet connection is unavailable. It explains options, target formats, scan behavior, output, and limitations in the version installed on your system.

Troubleshooting

The Shell Says Nmap Is Not Found

Install Nmap with the appropriate package manager for the operating system, then run nmap --version. If it is installed but still unavailable, check whether the executable is in the current environment's PATH.

Package Installation Is Denied

The current user probably lacks administrative privileges. Use an authorized administrator account or the approved privilege-escalation method for that system.

The Hostname Cannot Be Resolved

Check the spelling, DNS configuration, and network connectivity. You may use a known permitted IP address instead only when doing so remains within the authorized scope.

The Host Appears Down

The device may be offline or unreachable, the address may be wrong, or a firewall may block discovery probes. Verify the address, local routing, and scope through normal administrative channels. A host-down result is not proof that the device does not exist.

Most Ports Are Filtered

A firewall or network filter may be blocking scan traffic, or the target may intentionally avoid revealing port status. Record this as filtering rather than assuming the ports are closed. On a managed lab system, review the firewall policy with the system owner.

The Output Does Not Match an Example

Results vary with service availability, target addresses, filtering rules, Nmap versions, and network latency. Focus on the meaning of each field rather than expecting an identical port list.

Safe Next Steps

Repeat default scans in an isolated lab or against approved training systems. Keep service and version detection as a separate, authorized follow-up subject; a basic default scan does not establish exact software identity.

For reproducibility, record the authorized target scope, command used, date and time, Nmap version, and important findings. This makes it easier to compare changes without confusing a changing network with a scanning error.

Task	Command	What it does	Notes
Check installed version	`nmap --version`	Displays release and build information.	Use it to confirm the command is available.
Install on Debian-based Linux	`sudo apt update` `sudo apt install nmap`	Refreshes package metadata and installs Nmap.	Administrative privileges are generally required.
Scan an approved hostname	`nmap scanme.nmap.org`	Runs a default scan of an approved training target.	Follow the target's published rules.
Scan an owned lab IP	`nmap 192.0.2.10`	Illustrates scanning a permitted private-network host.	The address is documentation-only; replace it with an authorized lab address.
Open the manual page	`man nmap`	Opens detailed local documentation.	Useful without internet access.
Show command help	`nmap --help`	Displays concise command-line help.	Useful for a quick option overview.