How to run Nmap scan
How to run Nmap scan :
Introduction
Nmap (Network Mapper) is a free and open-source tool for network discovery and security auditing. It sends specially crafted packets to a target and analyses the replies to find out which hosts are up, which ports are open, which services (and versions) are running and which operating system is used.
Important: scan only systems that you own or have written permission to scan. For practice, the Nmap
project provides the host scanme.nmap.org, which may be scanned in moderation.
Installation
# Ubuntu / Debian
sudo apt update
sudo apt install nmap
# check the installed version
nmap --version
# Windows / macOS: download the installer from https://nmap.org/download.html
Port states
| State | Meaning |
|---|---|
| open | An application is accepting connections on the port. |
| closed | The port is reachable but no application is listening. |
| filtered | A firewall or filter blocks the probe, so Nmap cannot tell whether the port is open. |
| unfiltered | The port is reachable but Nmap cannot determine whether it is open or closed. |
| open|filtered | Nmap cannot decide between open and filtered. |
How to run an Nmap scan
1. Basic scan of one host
nmap scanme.nmap.org
Starting Nmap 7.94 ( https://nmap.org ) at 2025-01-10 10:30 IST Nmap scan report for scanme.nmap.org (45.33.32.156) Host is up (0.25s latency). Not shown: 996 closed tcp ports (conn-refused) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http 9929/tcp open nping-echo 31337/tcp open Elite Nmap done: 1 IP address (1 host up) scanned in 3.90 seconds
The output above is only an example; the hosts, ports and timings on your network will be different.
2. Common scan options
| Command | Purpose |
|---|---|
nmap 192.168.1.1 | Scan one host (the 1000 most common TCP ports) |
nmap 192.168.1.1 192.168.1.5 | Scan several hosts |
nmap 192.168.1.1-50 | Scan a range of addresses |
nmap 192.168.1.0/24 | Scan a whole subnet |
nmap -sn 192.168.1.0/24 | Ping scan: find which hosts are up, without port scanning |
nmap -p 80,443 host | Scan only the given ports |
nmap -p 1-1000 host | Scan a range of ports |
nmap -p- host | Scan all 65535 ports |
nmap -F host | Fast scan (the 100 most common ports) |
nmap -sT host | TCP connect scan (works without root privileges) |
sudo nmap -sS host | TCP SYN ("half-open") scan (needs root privileges) |
sudo nmap -sU host | UDP scan |
nmap -sV host | Detect the version of the services running on open ports |
nmap -v host | Verbose output |
nmap -oN result.txt host | Save the output to a text file |
3. Service version detection
nmap -sV -p 22,80 scanme.nmap.org
PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 6.6.1p1 Ubuntu 2ubuntu2.13 (Ubuntu Linux; protocol 2.0) 80/tcp open http Apache httpd 2.4.7 ((Ubuntu)) Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Sample output; the versions will depend on the target.
4. Discover the hosts of your own network (ping scan)
# find your own address and subnet first
ip addr # (Linux) ipconfig (Windows)
# then list the live hosts of the subnet
nmap -sn 192.168.1.0/24
Observation
Record the command used, the list of open ports with their services, and the time taken for each type of scan
(-sT, -sS and -F). Explain why a SYN scan is called a "half-open" scan.