Unit

Getting Started with Nmap

Learn to install Nmap, run safe basic scans, interpret port states, identify services, save results, and build a permission-based scanning workflow.

What Nmap Is

Nmap is a network discovery and security-auditing tool. It sends carefully selected network probes to authorized targets and reports information such as reachable hosts, accessible ports, and likely services.

Legitimate uses include building an asset inventory, identifying exposed services, checking firewall behavior, verifying network changes, and confirming that a server exposes only its intended interfaces.

This lesson uses 192.0.2.10 as documentation-only example space. Replace it with an address assigned to your authorized lab or owned system.

Prerequisites and Core Terms

You should be comfortable with a terminal or command prompt, IP addresses, subnet masks, private networks, basic TCP/IP concepts, and common services such as web servers and SSH. Review computer networking fundamentals and TCP and UDP ports if these topics are new.

• Target: The IP address, hostname, subnet, or target file supplied to Nmap.
• Host: A device or system with an IP address, such as a server, workstation, router, or virtual machine.
• Hostname: A human-readable name that resolves to an IP address.
• Port: A numbered endpoint associated with network communication. A port may be listening for a service, closed, or blocked by filtering.
• Service: An application that listens on a port, such as an HTTPS server on TCP 443.
• Protocol: The communication method used by the traffic. TCP and UDP are the main transport protocols considered in introductory Nmap work.
• Host discovery: Probing to determine which targets appear reachable before port scanning.
• Port scanning: Testing selected ports to determine their states.
• Scan type: The probing method, such as a SYN scan or TCP connect scan.
• Version detection: Probing an open service to estimate its product and version.
• OS detection: Comparing network responses with fingerprints to estimate the target's operating system.

A TCP scan examines connection-oriented TCP ports. A UDP scan examines connectionless UDP services and is often slower because responses may be limited or absent. UDP scanning is introduced in more depth in UDP scanning.

A SYN scan sends an initial TCP connection request and analyzes the response without normally completing the connection. A TCP connect scan completes the operating system's connection process and is useful when a SYN scan is unavailable. Privileges, operating-system support, routing, firewalls, packet filtering, host availability, and network conditions can all change results.

Installing and Verifying Nmap

Use the package or installer method supported by your operating system. Administrative permission may be required.

• Debian or Ubuntu: sudo apt update, followed by sudo apt install nmap. See APT command basics for package-management context.
• Fedora or another DNF-based Linux system: sudo dnf install nmap.
• Arch Linux: sudo pacman -S nmap.
• macOS with Homebrew: brew install nmap.
• Windows: Install Nmap using its official Windows installer, then open a new PowerShell or Command Prompt session.

Verify that the executable is available:

nmap --version

If the shell reports that Nmap is not recognized or not found, install it using the supported operating-system method, check that its executable directory is in the system PATH, reopen the terminal, and run the version command again.

Zenmap and other graphical front ends can help visualize commands and results, but command-line Nmap is the primary interface for repeatable lessons, scripts, and documented assessments.

Choosing Targets Safely

Start with your own computer or a deliberately isolated lab. localhost and 127.0.0.1 refer to the local computer. A private lab address refers to a system inside an authorized private network. An approved remote target may be outside your local network, but it still requires explicit permission.

Target format — Example — Meaning — Scope caution

Single IP — 192.0.2.10 — One IPv4 host — Confirm that the address belongs to the approved system.

Hostname — server01.example.test — Resolve and scan a named host — Check DNS resolution so an unexpected address is not scanned.

Local subnet range — 192.0.2.1-20 — A bounded sequence of addresses — Keep the range small and documented.

CIDR notation — 192.0.2.0/28 — A subnet containing 16 IPv4 addresses, including network and broadcast addresses — Confirm the exact subnet boundary before scanning.

Input file — targets.txt — One authorized hostname or address per line — Review the file before running it.

CIDR notation describes an address and prefix length. For example, /28 represents a small block of 16 IPv4 addresses. Do not casually replace a small lab range with a large public range.

nmap -iL targets.txt

Basic Host and Port Scans

A default scan against one target examines a common set of TCP ports and reports the states Nmap can determine.

nmap localhost
nmap 192.0.2.10

To check one known application port, specify it with -p. To inspect a bounded range, provide the first and last port:

nmap -p 22 192.0.2.10
nmap -p 1-1024 192.0.2.10

Host discovery can identify responsive systems in a small authorized lab subnet without performing a normal port scan:

nmap -sn 192.0.2.0/28

The option -sn requests a ping-style host-discovery scan. A host can appear down even when it is operating if firewalls block discovery probes, routing is unavailable, or the address is incorrect. Skipping host discovery can sometimes be appropriate, but only after verifying scope and authorization and understanding the impact.

Goal — Command — What it does — When to use it

Verify installation — nmap --version — Displays the installed version — After installation or when troubleshooting PATH issues.

Scan localhost — nmap localhost — Runs a basic scan of the local computer — In a personal lab to find common listening TCP services.

Scan one host — nmap 192.0.2.10 — Runs a default scan of one authorized host — For an initial view of a known server.

Check one port — nmap -p 22 192.0.2.10 — Tests TCP port 22 — To check whether an expected SSH endpoint is reachable.

Scan a range — nmap -p 1-1024 192.0.2.10 — Tests ports 1 through 1024 — When a defined port scope is required.

Discover lab hosts — nmap -sn 192.0.2.0/28 — Performs host discovery — To inventory responsive systems in an approved small subnet.

Detect services — nmap -sV 192.0.2.10 — Probes open ports for product and version information — For authorized inventory and patch verification.

Reading Port States and Output

A typical result includes a target summary, a latency estimate, an open-port table, service information, and scan completion details. Latency is the approximate time required for traffic to travel to the target and return. It can vary with distance, congestion, wireless conditions, and filtering.

Port state — Meaning — Typical cause — Recommended next step

open — A reachable application is accepting traffic on the port — A listening service responded — Identify and validate the service; remember that open does not automatically mean vulnerable.

closed — The host responded, but no service is listening — The port is reachable but unused — Compare with the intended configuration.

filtered — Nmap cannot determine whether the port is open because probes are blocked or dropped — A firewall or packet filter silently drops traffic — Check approved firewall and routing records; do not assume the service is absent.

unfiltered — The port is reachable, but the scan method cannot determine whether it is open or closed — A response passed through a filter — Use an appropriate authorized scan method for clarification.

open|filtered — Either a service is listening or filtering prevented a decision — Common with probes that may receive no response — Validate through service configuration or another approved method.

closed|filtered — Either the port is closed or filtering prevented a decision — Some UDP-related responses and unusual network conditions — Treat the result as uncertain and corroborate it.

An open port means that a reachable service is listening. It does not, by itself, prove that the service is vulnerable, misconfigured, or unauthorized. Interpret the result alongside service ownership, configuration, authentication controls, patch records, and firewall policy.

Service and Version Detection

Use -sV to request service detection and version probing:

nmap -sV 192.0.2.10

Nmap may report a service name, product, and version. This supports asset inventory and defensive checks such as comparing an exposed web server with the organization's approved software and patch level. Fingerprints are estimates: banners may be hidden, a proxy or load balancer may answer on behalf of another system, and multiple products may look similar. Validate important findings against authorized service configuration, package records, administrative consoles, or owner confirmation.

The Nmap Scripting Engine (NSE) can extend discovery and auditing with scripts. Treat scripts as a separate capability: understand what a script sends and what impact it may have, obtain authorization for the specific activity, and avoid intrusive scripts while learning basic scanning.

Operating-System and Network Information

OS detection uses network-response characteristics to estimate the target's operating system:

sudo nmap -O 192.0.2.10

This is optional and permission-sensitive. Elevated privileges may enable more informative scan methods and improve OS detection. The result is an estimate, not a guarantee. Firewalls, virtual machines, network address translation, proxies, unusual TCP/IP stacks, and limited responses can reduce accuracy.

Saving and Comparing Results

Save results when you need to compare a system before and after a network change or create an audit record.

nmap -sV -oN scan.txt -oX scan.xml 192.0.2.10

Format — Option — Best use — Notes

Normal output — -oN scan.txt — Human review — Easy to read and suitable for a basic evidence record.

XML output — -oX scan.xml — Tools, reports, and structured processing — Convenient for importing into compatible systems.

Grepable-style output — -oG scan.gnmap — Simple text filtering and older automation workflows — Use only where supported by your workflow; XML is generally better for structured processing.

Record the scan date and time, target scope, exact command, authorization context, network location, relevant findings, and any limitations. When comparing scans, keep the command and scope consistent; otherwise, a changed result may simply reflect different scan coverage.

Safe Scan Rate and Timing

Scanning creates traffic. Large host lists, broad port ranges, packet loss, high latency, and fragile devices can make a scan slow or disruptive. Monitoring systems may correctly generate alerts when scan-like traffic is observed.

Nmap timing templates provide broad speed and caution settings. For a sensitive authorized environment, a conservative template such as -T2 can reduce scan aggressiveness:

nmap -T2 192.0.2.10

Timing is not a permission substitute. Begin with a small target and narrow port scope, coordinate the scan window with the responsible team, and avoid aggressive tuning or intrusive scripts until you understand authorization, impact, and interpretation. See timing options for related command-line concepts.

Beginner Nmap Workflow

1. Confirm scope and authorization. Write down the approved hosts, networks, ports, time window, and permitted scan methods.
2. Confirm reachability. Check the address or hostname, then perform authorized host discovery when working with a small lab subnet.
3. Run a basic TCP scan. Start with one host or localhost rather than a broad range.
4. Adjust port scope. Check a known port or a defined range based on the assessment question.
5. Identify relevant services. Use -sV on approved open ports or hosts.
6. Use OS detection only when justified. Obtain the needed privilege and treat the result as an estimate.
7. Save the output. Keep normal output for review and XML for tooling or reports.
8. Validate important findings. Compare results with approved firewall rules, service configuration, package records, and asset documentation.
9. Record limitations. Note filtering, unreachable paths, uncertain fingerprints, scan timing, and any monitoring alerts.

Troubleshooting Common Results

Nmap Is Not Found

The software may not be installed, its executable may not be in PATH, or the terminal may need to be reopened. Install Nmap using the supported operating-system method and verify with nmap --version.

A Host Appears Down

Discovery probes may be blocked, the target may be on another network segment, or the address or hostname may be wrong. Verify scope and connectivity. Only skip host discovery when appropriate and explicitly permitted.

Most Ports Are Filtered

A firewall may silently drop probes, security controls may filter scan traffic, or the selected path may not reach the target. Treat filtering as an observation about network controls, and validate it with approved firewall and routing records rather than concluding that no service exists.

Service or OS Detection Is Incomplete

Limited banners, proxies, load balancers, firewalls, insufficient privileges, or insufficient response data can reduce accuracy. Treat results as hypotheses and confirm them through authorized administrative or service-level checks.

The Scan Is Slow or Causes Alerts

Reduce the host and port scope, use conservative timing, coordinate with the responsible team, and record the scan window. Never respond to an alert by expanding the scan or increasing speed without renewed authorization.

Key Exam Notes

• Nmap is used for network discovery and security auditing, not as automatic proof of a vulnerability.
• An open port identifies a reachable listening service; it does not automatically identify a security flaw.
• Filtered means Nmap cannot determine the port state because filtering prevents a clear response.
• TCP and UDP use different transport behaviors, so their scan results and timing differ.
• Version and OS detection produce fingerprints and estimates that require validation.
• Firewalls, routing, privileges, host availability, and packet loss can change scan results.
• Authorization and scope must be established before generating scan traffic.
• Normal output is convenient for people; XML output is useful for structured tools and reports.

For follow-up practice, connect Nmap findings with scan-result interpretation, port-range selection, OS detection, and packet capture with tcpdump.