1. Tool Introduction
Nmap (“Network Mapper”) is a free, open-source utility for network discovery and security auditing, originally released by Gordon Lyon (Fyodor) in 1997. It is the single most widely used reconnaissance tool in the security industry and comes pre-installed on Kali Linux. Nmap uses raw IP packets to determine which hosts are available on a network, what services (application name and version) those hosts are offering, what operating systems they are running, what type of packet filters/firewalls are in use, and dozens of other characteristics. It supports a scripting engine (NSE) that extends its capability to vulnerability detection, malware detection, and advanced discovery.
2. Installation
Nmap ships by default on Kali Linux. If it is missing or you want to upgrade it:
sudo apt update
sudo apt install nmap -y
Verify installation:
nmap --version
Expected output:
Nmap version 7.94 ( https://nmap.org )
Platform: x86_64-pc-linux-gnu
Compiled with: liblua-5.4.6 openssl-3.0.11 libssh2-1.11.0 libz-1.3 libpcre2-10.42 ...
3. Syntax
nmap [Scan Type(s)] [Options] {target specification}
Target specification can be a single IP, hostname, CIDR range, IP range, or a file of targets.
4. Command-Line Options (Full Reference)
Target Specification
-iL <file>— Input from list of hosts/networks-iR <num>— Choose random targets--exclude <host1,host2,...>— Exclude hosts/networks--excludefile <file>— Exclude list from file
Host Discovery
-sL— List Scan (simply list targets)-sn— Ping Scan (disable port scan, host discovery only)-Pn— Treat all hosts as online, skip discovery-PS<port list>— TCP SYN discovery-PA<port list>— TCP ACK discovery-PU<port list>— UDP discovery-PY<port list>— SCTP discovery-PE,-PP,-PM— ICMP echo, timestamp, netmask discovery-PO[protocol list]— IP protocol ping-n— No DNS resolution-R— Resolve DNS for all targets--dns-servers <serv1,serv2,...>— Specify custom DNS servers--traceroute— Trace path to host
Scan Techniques
-sS— TCP SYN scan (stealth/half-open)-sT— TCP connect scan-sA— TCP ACK scan-sW— TCP Window scan-sM— TCP Maimon scan-sU— UDP scan-sN,-sF,-sX— TCP Null, FIN, Xmas scans-sY,-sZ— SCTP INIT/COOKIE-ECHO scans--scanflags <flags>— Custom TCP flags-sI <zombie host>— Idle scan-sO— IP protocol scan-b <FTP relay host>— FTP bounce scan
Port Specification
-p <port ranges>— Only scan specified ports (e.g.-p 22,80,443or-p 1-1000)-p-— Scan all 65535 ports--exclude-ports <port ranges>— Exclude specified ports-F— Fast mode (fewer ports)-r— Scan ports sequentially, don’t randomize--top-ports <n>— Scan n most common ports--port-ratio <ratio>— Scan ports more common than ratio
Service/Version Detection
-sV— Probe open ports for service/version info--version-intensity <0-9>— Set version scan intensity--version-light/--version-all— Alias for intensity 2/9--version-trace— Show detailed version scan activity
Script Scan
-sC— Run default NSE scripts--script= <s-cript list>— Run specified scripts--script-args=<args>— Provide arguments to scripts--script-args-file=<file>— Provide args in a file--script-trace— Show all sent/received data--script-updatedb— Update script database
OS Detection
-O— Enable OS detection--osscan-limit— Limit OS detection to promising targets--osscan-guess— Guess OS more aggressively
Timing and Performance
-T0to-T5— Timing templates (Paranoid to Insane)--min-hostgroup/max-hostgroup <size>— Parallel host scan group sizes--min-parallelism/max-parallelism <numprobes>— Probe parallelization--min-rtt-timeout/max-rtt-timeout/initial-rtt-timeout <time>— RTT timeouts--max-retries <tries>— Max port scan probe retransmissions--host-timeout <time>— Give up on target after this long--scan-delay/--max-scan-delay <time>— Probe delay--min-rate <number>— Send packets no slower than this rate--max-rate <number>— Send packets no faster than this rate
Firewall/IDS Evasion and Spoofing
-f— Fragment packets--mtu <val>— Set custom MTU-D <decoy1,decoy2[,ME],...>— Cloak scan with decoys-S <IP_Address>— Spoof source address-e <iface>— Use specified interface-g/--source-port <portnum>— Use given source port--proxies <url1,[url2],...>— Relay connections through proxies--data <hex string>— Append custom binary data--data-string <string>— Append custom ASCII string--data-length <num>— Append random data to packets--ip-options <options>— Send with specified IP options--ttl <val>— Set IP time-to-live--spoof-mac <mac/prefix/vendor>— Spoof MAC address--badsum— Send packets with bogus checksum
Output
-oN <file>— Normal output-oX <file>— XML output-oS <file>— ScRipT KIdd|3 output-oG <file>— Grepable output-oA <basename>— Output in all formats at once-v/-vv— Increase verbosity-d/-dd— Increase debugging level--reason— Show reason for port state--open— Only show open (or possibly open) ports--packet-trace— Show all packets sent/received--iflist— Show host interfaces and routes--append-output— Append to output files--resume <file>— Resume aborted scan--stylesheet <path/URL>— XSL stylesheet for XML--webxml— Reference stylesheet from Nmap.org--no-stylesheet— Omit XSL stylesheet from XML
Misc
-6— Enable IPv6 scanning-A— Enable OS detection, version detection, script scanning, and traceroute--datadir <dirname>— Specify custom Nmap data file location--send-eth/--send-ip— Send using raw ethernet frames or IP packets--privileged— Assume privileged--unprivileged— Assume unprivileged-V— Print version number-h— Print help summary
5. Basic Usage
nmap 192.168.1.1
Expected output:
Starting Nmap 7.94 ( https://nmap.org ) at 2026-07-19 10:12 PKT
Nmap scan report for 192.168.1.1
Host is up (0.0021s latency).
Not shown: 996 closed tcp ports (reset)
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
443/tcp open https
8080/tcp open http-proxy
Nmap done: 1 IP address (1 host up) scanned in 2.14 seconds
6. Practical Examples
Example 1 — Ping sweep of a subnet (host discovery only)
nmap -sn 192.168.1.0/24
Nmap scan report for 192.168.1.1
Host is up (0.0011s latency).
Nmap scan report for 192.168.1.15
Host is up (0.045s latency).
Nmap done: 256 IP addresses (2 hosts up) scanned in 3.21 seconds
Why it’s useful: this is almost always the very first command run against a new subnet during an internal engagement — it tells you what’s alive before you spend time port-scanning dead space.
Example 2 — Full TCP SYN scan of all 65,535 ports
sudo nmap -sS -p- 10.10.10.5
PORT STATE SERVICE
21/tcp open ftp
22/tcp open ssh
139/tcp open netbios-ssn
445/tcp open microsoft-ds
Nmap done: 1 IP address (1 host up) scanned in 18.32 seconds
Why it’s useful: the default -F/top-1000 scan misses services on non-standard ports; a full-range scan is the only way to be sure you’ve found everything before moving to exploitation.
Example 3 — Service/version detection with default scripts
nmap -sC -sV 10.10.10.5
PORT STATE SERVICE VERSION
21/tcp open ftp vsftpd 3.0.3
22/tcp open ssh OpenSSH 8.9p1 Ubuntu
80/tcp open http Apache httpd 2.4.52
| http-title: Welcome
Why it’s useful: exact version strings are what you feed into searchsploit or CVE databases to identify known exploits.
Example 4 — Aggressive scan with OS detection and traceroute
sudo nmap -A 10.10.10.5
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.9p1
Device type: general purpose
Running: Linux 5.X
OS details: Linux 5.4 - 5.15
TRACEROUTE
HOP RTT ADDRESS
1 0.42 ms 10.10.10.1
2 1.11 ms 10.10.10.5
Why it’s useful: one command gets you OS fingerprint, service versions, default scripts, and path info — a fast way to build a full picture of a single high-value target.
Example 5 — UDP scan of top 100 ports
sudo nmap -sU --top-ports 100 10.10.10.5
PORT STATE SERVICE
53/udp open domain
68/udp open|filtered dhcpc
161/udp open snmp
Why it’s useful: UDP services (DNS, SNMP, NTP) are frequently missed because engineers only run TCP scans, yet SNMP with a default community string is a classic quick win.
Example 6 — Scan with vulnerability detection scripts
nmap --script vuln 10.10.10.5
80/tcp open http
| http-vuln-cve2017-5638:
| VULNERABLE:
| Apache Struts Remote Code Execution
Why it’s useful: automatically flags well-known CVEs against detected services without needing a separate vulnerability scanner.
Example 7 — Output to all formats simultaneously
nmap -sV -oA scan_results 10.10.10.5
[creates scan_results.nmap, scan_results.xml, scan_results.gnmap]
Why it’s useful: the XML output can be imported into report-generation tools, dashboards, or other scanners (e.g., Metasploit’s db_import), while .nmap stays human-readable.
Example 8 — Firewall evasion with fragmented packets and decoys
sudo nmap -f -D RND:10 10.10.10.5
Nmap scan report for 10.10.10.5
Host is up (0.03s latency).
PORT STATE SERVICE
22/tcp open ssh
Why it’s useful: splits probes across fragments and hides your real IP among 10 randomly-generated decoys in IDS logs — useful when testing detection capability during a red team exercise.
Example 9 — Scan multiple targets from a file
nmap -iL targets.txt -oN results.txt
Nmap scan report for 192.168.1.10
Nmap scan report for 192.168.1.11
...
Why it’s useful: lets you re-run the exact same target list repeatedly (e.g., daily audits) without retyping IPs.
Example 10 — Scan specific ports with the reason flag
nmap -p 22,80,443 --reason 10.10.10.5
PORT STATE SERVICE REASON
22/tcp open ssh syn-ack
80/tcp open http syn-ack
443/tcp closed https reset
Why it’s useful: --reason shows exactly which packet caused Nmap’s state decision, invaluable when a firewall is behaving unexpectedly.
Example 11 — Exclude specific hosts from a subnet scan
nmap -sn 192.168.1.0/24 --exclude 192.168.1.1,192.168.1.254
Nmap scan report for 192.168.1.10
Host is up (0.002s latency).
Nmap scan report for 192.168.1.15
Host is up (0.045s latency).
Nmap done: 254 IP addresses (2 hosts up) scanned in 2.9 seconds
Why it’s useful: protects out-of-scope infrastructure (e.g., a client’s gateway or a production firewall) that the rules of engagement say must not be touched.
Example 12 — Scan skipping host discovery (for hosts that block ping)
sudo nmap -Pn -p 1-1000 10.10.10.8
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
Nmap done: 1 IP address (1 host up) scanned in 6.7 seconds
Why it’s useful: many hardened hosts drop ICMP entirely; without -Pn Nmap would wrongly mark the host as down and skip it completely.
Example 13 — Compare two scans over time to spot new/changed ports
nmap -oX scan_day1.xml 10.10.10.0/24
# ... a week later ...
nmap -oX scan_day2.xml 10.10.10.0/24
ndiff scan_day1.xml scan_day2.xml
-Nmap scan report for 10.10.10.15
-Host is up
+Nmap scan report for 10.10.10.15
+Host is up
+3389/tcp open ms-wbt-server
Why it’s useful: ndiff (bundled with Nmap) is the standard way to detect newly opened ports/services across periodic security audits — here it flags that RDP was unexpectedly opened.
Example 14 — Grab an HTTP title and detect a specific CVE with a targeted script
nmap -p80 --script http-title,http-vuln-cve2021-41773 10.10.10.5
PORT STATE SERVICE
80/tcp open http
| http-title: Apache2 Ubuntu Default Page
| http-vuln-cve2021-41773:
| VULNERABLE:
| Apache path traversal and RCE
Why it’s useful: targeted single-CVE scripts are faster and quieter than the full vuln category when you already suspect one specific issue (e.g., from a banner).
Example 15 — Enumerate SMB shares and users on a Windows host
sudo nmap -p445 --script smb-enum-shares,smb-enum-users 10.10.10.20
445/tcp open microsoft-ds
| smb-enum-shares:
| ADMIN$: Remote Admin
| C$: Default share
| Users:
| smb-enum-users:
| Administrator
| Guest
| svc_backup
Why it’s useful: one of the highest-value SMB enumeration commands in an internal Windows domain assessment — often reveals service accounts worth targeting.
Example 16 — Rate-limited scan to avoid tripping an IDS/IPS
sudo nmap -sS -T2 --scan-delay 1s -p 1-1000 10.10.10.5
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
Nmap done: 1 IP address (1 host up) scanned in 512.44 seconds
Why it’s useful: a slow, deliberate scan is far less likely to trigger threshold-based intrusion detection alerts during a stealthy assessment.
Example 17 — Scan through a SOCKS proxy chain (e.g., pivoting through a compromised host)
nmap -sT -Pn --proxies socks4://127.0.0.1:1080 -p 22,80,445 10.20.30.5
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
445/tcp open microsoft-ds
Why it’s useful: essential for lateral movement scenarios where you’ve established a proxy pivot (e.g., via Metasploit or Chisel) into a segmented internal network.
Example 18 — Only display open ports, suppressing closed/filtered noise
nmap --open -p1-1000 10.10.10.0/28
Nmap scan report for 10.10.10.5
22/tcp open ssh
80/tcp open http
Nmap scan report for 10.10.10.9
445/tcp open microsoft-ds
Why it’s useful: dramatically shortens output when scanning many hosts, so you can eyeball results quickly instead of scrolling past hundreds of closed-port lines.
Example 19 — Grepable output piped directly into awk for a live host/port list
nmap -p 80,443 --open -oG - 10.10.10.0/24 | awk '/open/{print $2}'
10.10.10.5
10.10.10.12
10.10.10.30
Why it’s useful: a one-liner that produces a clean list of web servers, ready to pipe straight into a screenshot tool like eyewitness or gowitness.
Example 20 — Detect firewall/router ACK filtering behavior
sudo nmap -sA -p 1-1000 10.10.10.1
PORT STATE SERVICE
22/tcp unfiltered ssh
80/tcp unfiltered http
443/tcp filtered https
Why it’s useful: ACK scans don’t reveal open/closed state but do reveal which ports a stateful firewall is actively filtering — useful for mapping firewall rulesets from the outside.
Example 21 — Idle (zombie) scan to hide your real source IP entirely
sudo nmap -sI 10.10.10.99 -p 1-1000 10.10.10.5
Idle scan using zombie 10.10.10.99 (10.10.10.99:80); Class: incremental
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
Why it’s useful: the most covert Nmap scan technique available — the target’s logs will show the “zombie” host as the scanner, never your real IP (requires a suitable zombie with predictable IP ID sequencing).
Example 22 — Resume a large scan that was interrupted
nmap -p- --max-retries 2 -oN bigscan.txt 10.0.0.0/16
# ... interrupted with Ctrl+C ...
nmap --resume bigscan.txt
Resuming aborted scan against 10.0.34.0/24 (partial)
Nmap scan report for 10.0.34.5
Why it’s useful: saves hours of re-scanning on very large ranges after a dropped SSH session or an accidental Ctrl+C.
Example 23 — Fingerprint a load balancer/CDN by checking for multiple back-end IPs
nmap -p80,443 --script http-ip-geolocation,http-server-header example-target.com
80/tcp open http
| http-server-header: cloudflare
443/tcp open https
Why it’s useful: quickly reveals whether a target is sitting behind a CDN/WAF (e.g., Cloudflare), which changes your entire attack approach — you’d need to find the origin IP rather than attacking the CDN edge.
Example 24 — Bandwidth-friendly scan tuned for a slow/unstable VPN link
nmap -p 1-1000 --max-rate 50 --max-retries 1 --host-timeout 5m 10.10.10.5
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
Nmap done: 1 IP address (1 host up) scanned in 41.02 seconds
Why it’s useful: prevents Nmap from saturating a low-bandwidth or high-latency link (common when scanning over a VPN into a client’s environment), avoiding false “filtered” results caused by dropped probes.
Example 25 — Combine host discovery + full scan + all output formats into one findable command
sudo nmap -sn 10.10.10.0/24 -oG - | awk '/Up$/{print $2}' > live.txt
sudo nmap -sC -sV -p- -iL live.txt -oA full_scan
Nmap scan report for 10.10.10.5
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.9p1
80/tcp open http Apache httpd 2.4.52
...
Nmap done: 12 IP addresses (12 hosts up) scanned in 340.11 seconds
Why it’s useful: this two-stage “discover then deep-scan” pattern is the single most common real-world Nmap workflow used in professional engagements — fast triage first, thorough detail second.
7. Common Use Cases
- Initial host discovery on a target network during penetration test scoping, to establish the live-host list before deeper work begins.
- Full port enumeration (
-p-) prior to service exploitation, since default scans only cover the 1,000 most common ports and can miss custom/non-standard services. - Service/version fingerprinting (
-sV) to identify exact software versions for cross-referencing against exploit databases such assearchsploitor the NVD. - Vulnerability scanning via NSE
vulnand CVE-specific scripts as a lightweight substitute for (or complement to) a dedicated vulnerability scanner like Nessus/OpenVAS. - SMB/NetBIOS enumeration on Windows environments to identify shares, users, and domain information during internal assessments.
- Firewall/IDS rule testing and evasion technique validation (fragmentation, decoys, timing) during red team and detection-engineering exercises.
- Network inventory, asset discovery, and periodic change-detection audits (via
ndiff) for blue teams and system administrators. - OS fingerprinting (
-O) to tailor exploit and payload selection to the correct target platform. - Scanning through pivots/proxies during lateral movement in a segmented internal network.
- Identifying whether a public-facing target sits behind a CDN/WAF, which changes attack strategy toward origin-IP discovery.
8. Automation with Bash
#!/bin/bash
# scan_subnet.sh - discover live hosts then run a full scan on each
SUBNET="192.168.1.0/24"
OUTDIR="./nmap_results"
mkdir -p "$OUTDIR"
echo "[*] Discovering live hosts on $SUBNET..."
nmap -sn "$SUBNET" -oG - | awk '/Up$/{print $2}' > "$OUTDIR/live_hosts.txt"
while read -r host; do
echo "[*] Scanning $host..."
nmap -sC -sV -p- -oA "$OUTDIR/$host" "$host"
done < "$OUTDIR/live_hosts.txt"
echo "[+] Done. Results saved in $OUTDIR"
9. Tips and Best Practices
- Always run port scans with
sudowhen using-sS(raw sockets require root). - Use
-T4for a good balance of speed and accuracy on reliable networks; avoid-T5on production networks, and drop to-T2/-T1with--scan-delaywhen stealth matters more than speed. - Follow the two-stage workflow: a fast
-sndiscovery scan first, then a targeted-sC -sV -p-(or-A) deep scan only against confirmed live hosts — this saves enormous amounts of time on large ranges. - Save output in all formats (
-oA) so results can be grepped, parsed, or imported into other tools (Metasploit, dashboards,ndiff). - Respect scope and rules of engagement — unauthorized scanning is illegal in most jurisdictions; always use
--exclude/--excludefileto protect out-of-scope hosts. - Use
--reasonwhen troubleshooting unexpected filtered/closed results, and--packet-tracefor a deeper look at exactly what’s sent and received. - Always run
-Pnagainst hosts you already know are alive but that block ICMP — otherwise Nmap may skip them entirely. - For very large ranges, keep
-oXXML output going so a scan can be resumed with--resumeif interrupted, and diffed withndiffon future runs to catch new/changed ports. - When scanning through a proxy or pivot, remember most raw-packet scan types (
-sS,-O) won’t work — use-sT(TCP connect) instead.
10. Troubleshooting
- “Failed to resolve” errors: check DNS with
-nto skip resolution or specify--dns-servers. - All ports show filtered: a firewall may be dropping probes; try
-Pnto skip host discovery, or-sAto test ACK filtering. - Scan is too slow: raise timing template (
-T4), reduce port range, or use--min-rate. - “You requested a scan type which requires root privileges”: re-run with
sudo. - No response from target inside NAT/VPN: verify routing and interface with
-e <iface>and--iflist.
11. References
- Official documentation: https://nmap.org/book/man.html
- Nmap Scripting Engine documentation: https://nmap.org/book/nse.html
- Gordon Lyon, Nmap Network Scanning (official book)
- Kali Linux tool page: https://www.kali.org/tools/nmap/
