Offensive Security Researcher & Quantum Cryptography Analyst

nmap: Network mapping and port scanning tool

Abdul Wahab Junaid
nmap: Network mapping and port scanning tool

1. Tool Introduction

Nmap (“Network Mapper”) is a free, open-source utility for network discovery and security auditing, originally released by Gordon Lyon (Fyodor) in 1997. It is the single most widely used reconnaissance tool in the security industry and comes pre-installed on Kali Linux. Nmap uses raw IP packets to determine which hosts are available on a network, what services (application name and version) those hosts are offering, what operating systems they are running, what type of packet filters/firewalls are in use, and dozens of other characteristics. It supports a scripting engine (NSE) that extends its capability to vulnerability detection, malware detection, and advanced discovery.

2. Installation

Nmap ships by default on Kali Linux. If it is missing or you want to upgrade it:

sudo apt update
sudo apt install nmap -y

Verify installation:

nmap --version

Expected output:

Nmap version 7.94 ( https://nmap.org )
Platform: x86_64-pc-linux-gnu
Compiled with: liblua-5.4.6 openssl-3.0.11 libssh2-1.11.0 libz-1.3 libpcre2-10.42 ...

3. Syntax

nmap [Scan Type(s)] [Options] {target specification}

Target specification can be a single IP, hostname, CIDR range, IP range, or a file of targets.

4. Command-Line Options (Full Reference)

Target Specification

Host Discovery

Scan Techniques

Port Specification

Service/Version Detection

Script Scan

OS Detection

Timing and Performance

Firewall/IDS Evasion and Spoofing

Output

Misc

5. Basic Usage

nmap 192.168.1.1

Expected output:

Starting Nmap 7.94 ( https://nmap.org ) at 2026-07-19 10:12 PKT
Nmap scan report for 192.168.1.1
Host is up (0.0021s latency).
Not shown: 996 closed tcp ports (reset)
PORT     STATE SERVICE
22/tcp   open  ssh
80/tcp   open  http
443/tcp  open  https
8080/tcp open  http-proxy

Nmap done: 1 IP address (1 host up) scanned in 2.14 seconds

6. Practical Examples

Example 1 — Ping sweep of a subnet (host discovery only)

nmap -sn 192.168.1.0/24

Nmap scan report for 192.168.1.1
Host is up (0.0011s latency).
Nmap scan report for 192.168.1.15
Host is up (0.045s latency).
Nmap done: 256 IP addresses (2 hosts up) scanned in 3.21 seconds

Why it’s useful: this is almost always the very first command run against a new subnet during an internal engagement — it tells you what’s alive before you spend time port-scanning dead space.

Example 2 — Full TCP SYN scan of all 65,535 ports

sudo nmap -sS -p- 10.10.10.5

PORT      STATE SERVICE
21/tcp    open  ftp
22/tcp    open  ssh
139/tcp   open  netbios-ssn
445/tcp   open  microsoft-ds
Nmap done: 1 IP address (1 host up) scanned in 18.32 seconds

Why it’s useful: the default -F/top-1000 scan misses services on non-standard ports; a full-range scan is the only way to be sure you’ve found everything before moving to exploitation.

Example 3 — Service/version detection with default scripts

nmap -sC -sV 10.10.10.5

PORT    STATE SERVICE VERSION
21/tcp  open  ftp     vsftpd 3.0.3
22/tcp  open  ssh     OpenSSH 8.9p1 Ubuntu
80/tcp  open  http    Apache httpd 2.4.52
| http-title: Welcome

Why it’s useful: exact version strings are what you feed into searchsploit or CVE databases to identify known exploits.

Example 4 — Aggressive scan with OS detection and traceroute

sudo nmap -A 10.10.10.5

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.9p1
Device type: general purpose
Running: Linux 5.X
OS details: Linux 5.4 - 5.15
TRACEROUTE
HOP RTT     ADDRESS
1   0.42 ms 10.10.10.1
2   1.11 ms 10.10.10.5

Why it’s useful: one command gets you OS fingerprint, service versions, default scripts, and path info — a fast way to build a full picture of a single high-value target.

Example 5 — UDP scan of top 100 ports

sudo nmap -sU --top-ports 100 10.10.10.5

PORT    STATE         SERVICE
53/udp  open          domain
68/udp  open|filtered dhcpc
161/udp open          snmp

Why it’s useful: UDP services (DNS, SNMP, NTP) are frequently missed because engineers only run TCP scans, yet SNMP with a default community string is a classic quick win.

Example 6 — Scan with vulnerability detection scripts

nmap --script vuln 10.10.10.5

80/tcp open  http
| http-vuln-cve2017-5638: 
|   VULNERABLE:
|   Apache Struts Remote Code Execution

Why it’s useful: automatically flags well-known CVEs against detected services without needing a separate vulnerability scanner.

Example 7 — Output to all formats simultaneously

nmap -sV -oA scan_results 10.10.10.5

[creates scan_results.nmap, scan_results.xml, scan_results.gnmap]

Why it’s useful: the XML output can be imported into report-generation tools, dashboards, or other scanners (e.g., Metasploit’s db_import), while .nmap stays human-readable.

Example 8 — Firewall evasion with fragmented packets and decoys

sudo nmap -f -D RND:10 10.10.10.5

Nmap scan report for 10.10.10.5
Host is up (0.03s latency).
PORT   STATE SERVICE
22/tcp open  ssh

Why it’s useful: splits probes across fragments and hides your real IP among 10 randomly-generated decoys in IDS logs — useful when testing detection capability during a red team exercise.

Example 9 — Scan multiple targets from a file

nmap -iL targets.txt -oN results.txt

Nmap scan report for 192.168.1.10
Nmap scan report for 192.168.1.11
...

Why it’s useful: lets you re-run the exact same target list repeatedly (e.g., daily audits) without retyping IPs.

Example 10 — Scan specific ports with the reason flag

nmap -p 22,80,443 --reason 10.10.10.5

PORT    STATE SERVICE REASON
22/tcp  open  ssh     syn-ack
80/tcp  open  http    syn-ack
443/tcp closed https  reset

Why it’s useful: --reason shows exactly which packet caused Nmap’s state decision, invaluable when a firewall is behaving unexpectedly.

Example 11 — Exclude specific hosts from a subnet scan

nmap -sn 192.168.1.0/24 --exclude 192.168.1.1,192.168.1.254

Nmap scan report for 192.168.1.10
Host is up (0.002s latency).
Nmap scan report for 192.168.1.15
Host is up (0.045s latency).
Nmap done: 254 IP addresses (2 hosts up) scanned in 2.9 seconds

Why it’s useful: protects out-of-scope infrastructure (e.g., a client’s gateway or a production firewall) that the rules of engagement say must not be touched.

Example 12 — Scan skipping host discovery (for hosts that block ping)

sudo nmap -Pn -p 1-1000 10.10.10.8

PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http
Nmap done: 1 IP address (1 host up) scanned in 6.7 seconds

Why it’s useful: many hardened hosts drop ICMP entirely; without -Pn Nmap would wrongly mark the host as down and skip it completely.

Example 13 — Compare two scans over time to spot new/changed ports

nmap -oX scan_day1.xml 10.10.10.0/24
# ... a week later ...
nmap -oX scan_day2.xml 10.10.10.0/24
ndiff scan_day1.xml scan_day2.xml

-Nmap scan report for 10.10.10.15
-Host is up
+Nmap scan report for 10.10.10.15
+Host is up
+3389/tcp open  ms-wbt-server

Why it’s useful: ndiff (bundled with Nmap) is the standard way to detect newly opened ports/services across periodic security audits — here it flags that RDP was unexpectedly opened.

Example 14 — Grab an HTTP title and detect a specific CVE with a targeted script

nmap -p80 --script http-title,http-vuln-cve2021-41773 10.10.10.5

PORT   STATE SERVICE
80/tcp open  http
| http-title: Apache2 Ubuntu Default Page
| http-vuln-cve2021-41773:
|   VULNERABLE:
|   Apache path traversal and RCE

Why it’s useful: targeted single-CVE scripts are faster and quieter than the full vuln category when you already suspect one specific issue (e.g., from a banner).

Example 15 — Enumerate SMB shares and users on a Windows host

sudo nmap -p445 --script smb-enum-shares,smb-enum-users 10.10.10.20

445/tcp open  microsoft-ds
| smb-enum-shares:
|   ADMIN$: Remote Admin
|   C$: Default share
|   Users: 
| smb-enum-users:
|   Administrator
|   Guest
|   svc_backup

Why it’s useful: one of the highest-value SMB enumeration commands in an internal Windows domain assessment — often reveals service accounts worth targeting.

Example 16 — Rate-limited scan to avoid tripping an IDS/IPS

sudo nmap -sS -T2 --scan-delay 1s -p 1-1000 10.10.10.5

PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http
Nmap done: 1 IP address (1 host up) scanned in 512.44 seconds

Why it’s useful: a slow, deliberate scan is far less likely to trigger threshold-based intrusion detection alerts during a stealthy assessment.

Example 17 — Scan through a SOCKS proxy chain (e.g., pivoting through a compromised host)

nmap -sT -Pn --proxies socks4://127.0.0.1:1080 -p 22,80,445 10.20.30.5

PORT    STATE SERVICE
22/tcp  open  ssh
80/tcp  open  http
445/tcp open  microsoft-ds

Why it’s useful: essential for lateral movement scenarios where you’ve established a proxy pivot (e.g., via Metasploit or Chisel) into a segmented internal network.

Example 18 — Only display open ports, suppressing closed/filtered noise

nmap --open -p1-1000 10.10.10.0/28

Nmap scan report for 10.10.10.5
22/tcp open ssh
80/tcp open http

Nmap scan report for 10.10.10.9
445/tcp open microsoft-ds

Why it’s useful: dramatically shortens output when scanning many hosts, so you can eyeball results quickly instead of scrolling past hundreds of closed-port lines.

Example 19 — Grepable output piped directly into awk for a live host/port list

nmap -p 80,443 --open -oG - 10.10.10.0/24 | awk '/open/{print $2}'

10.10.10.5
10.10.10.12
10.10.10.30

Why it’s useful: a one-liner that produces a clean list of web servers, ready to pipe straight into a screenshot tool like eyewitness or gowitness.

Example 20 — Detect firewall/router ACK filtering behavior

sudo nmap -sA -p 1-1000 10.10.10.1

PORT    STATE      SERVICE
22/tcp  unfiltered ssh
80/tcp  unfiltered http
443/tcp filtered   https

Why it’s useful: ACK scans don’t reveal open/closed state but do reveal which ports a stateful firewall is actively filtering — useful for mapping firewall rulesets from the outside.

Example 21 — Idle (zombie) scan to hide your real source IP entirely

sudo nmap -sI 10.10.10.99 -p 1-1000 10.10.10.5

Idle scan using zombie 10.10.10.99 (10.10.10.99:80); Class: incremental
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http

Why it’s useful: the most covert Nmap scan technique available — the target’s logs will show the “zombie” host as the scanner, never your real IP (requires a suitable zombie with predictable IP ID sequencing).

Example 22 — Resume a large scan that was interrupted

nmap -p- --max-retries 2 -oN bigscan.txt 10.0.0.0/16
# ... interrupted with Ctrl+C ...
nmap --resume bigscan.txt

Resuming aborted scan against 10.0.34.0/24 (partial)
Nmap scan report for 10.0.34.5

Why it’s useful: saves hours of re-scanning on very large ranges after a dropped SSH session or an accidental Ctrl+C.

Example 23 — Fingerprint a load balancer/CDN by checking for multiple back-end IPs

nmap -p80,443 --script http-ip-geolocation,http-server-header example-target.com

80/tcp  open  http
| http-server-header: cloudflare
443/tcp open  https

Why it’s useful: quickly reveals whether a target is sitting behind a CDN/WAF (e.g., Cloudflare), which changes your entire attack approach — you’d need to find the origin IP rather than attacking the CDN edge.

Example 24 — Bandwidth-friendly scan tuned for a slow/unstable VPN link

nmap -p 1-1000 --max-rate 50 --max-retries 1 --host-timeout 5m 10.10.10.5

PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http
Nmap done: 1 IP address (1 host up) scanned in 41.02 seconds

Why it’s useful: prevents Nmap from saturating a low-bandwidth or high-latency link (common when scanning over a VPN into a client’s environment), avoiding false “filtered” results caused by dropped probes.

Example 25 — Combine host discovery + full scan + all output formats into one findable command

sudo nmap -sn 10.10.10.0/24 -oG - | awk '/Up$/{print $2}' > live.txt
sudo nmap -sC -sV -p- -iL live.txt -oA full_scan

Nmap scan report for 10.10.10.5
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.9p1
80/tcp open  http    Apache httpd 2.4.52
...
Nmap done: 12 IP addresses (12 hosts up) scanned in 340.11 seconds

Why it’s useful: this two-stage “discover then deep-scan” pattern is the single most common real-world Nmap workflow used in professional engagements — fast triage first, thorough detail second.

7. Common Use Cases

8. Automation with Bash

#!/bin/bash
# scan_subnet.sh - discover live hosts then run a full scan on each
SUBNET="192.168.1.0/24"
OUTDIR="./nmap_results"
mkdir -p "$OUTDIR"

echo "[*] Discovering live hosts on $SUBNET..."
nmap -sn "$SUBNET" -oG - | awk '/Up$/{print $2}' > "$OUTDIR/live_hosts.txt"

while read -r host; do
    echo "[*] Scanning $host..."
    nmap -sC -sV -p- -oA "$OUTDIR/$host" "$host"
done < "$OUTDIR/live_hosts.txt"

echo "[+] Done. Results saved in $OUTDIR"

9. Tips and Best Practices

10. Troubleshooting

11. References

Exit mobile version