Scanning Networks · Module 03
Nmap
Scan hosts to find open ports, running services and their versions.
Safe to try on your own machine. Spin up your Kali Linux lab and practice away — on any system you own or have permission to test. That’s exactly how the pros learn.
Definition
Nmap (Network Mapper) is an open-source network scanning and security auditing tool.
Discover hosts, identify open ports, detect services, and gather information about network systems.
Network discovery, security auditing, asset identification, and authorized penetration testing.
Key features
Identifies active hosts on a network.
Finds which TCP/UDP ports are open, closed or filtered.
Identifies services and their versions on open ports.
Attempts to identify a target's operating system.
The Nmap Scripting Engine automates discovery and selected checks.
Important commands
nmap <target>Default scan of the target.
nmap -sn <target>Host discovery without a port scan.
nmap -p- <target>Scan all 65,535 TCP ports.
nmap -sS <target>TCP SYN scan (usually needs elevated privileges).
nmap -sV <target>Detect service versions.
nmap -O <target>Attempt OS detection.
nmap -A <target>OS + version detection, scripts and traceroute.
nmap -oN scan.txt <target>Save results to a normal text file.
Practical examples
nmap 192.168.1.10
Purpose Scans common TCP ports on the host.
nmap -sn 192.168.1.0/24
Purpose Host discovery across the subnet without a port scan.
nmap -sV 192.168.1.10
Purpose Identifies services and versions on open ports.
nmap -p- 192.168.1.10
Purpose Scans ports 1-65535 to find extra exposed services.
Important points
- Open / Closed / Filtered: Open = an app is listening; Closed = reachable but nothing listening; Filtered = a firewall blocks the view.
- TCP vs UDP: UDP scans use a different method, are slower, and can be ambiguous.
- Privileges: SYN scans and OS detection work best with elevated privileges.
- Accuracy: Firewalls, filtering and latency can affect results.
- NSE safety: Some scripts are intrusive — understand a script before running it.
- Authorization: Scan only systems and networks you own or are permitted to assess.
Common use cases
Identify active devices and hosts.
Find exposed ports and unnecessary services.
Identify running services and versions.
Help teams find exposed services.
Support recon and enumeration in authorized tests.
This tool is taught in Module 03
Read the full written notes, with diagrams, defense and detection.