BeginnerTools

Network Scanning with Nmap for Beginners

A beginner-friendly guide to network scanning with Nmap covering host discovery, port scanning techniques, service detection, and practical scanning examples.

#Nmap#Network Scanning#Port Scanning#Network Discovery#Penetration Testing

Why Network Scanning Matters

You need to discover every device, open port, and running service on a target network. Network scanning is the first active step in reconnaissance — it reveals the attack surface. Nmap (Network Mapper) is the industry standard for this task.

Understanding Networks and IP Addresses

Before scanning, understand the basics. Every device on a network has an IP address. A subnet mask determines which part of the address identifies the network and which identifies the host.

IP Address:    192.168.1.100
Subnet Mask:   255.255.255.0  (/24)
Network:       192.168.1.0
Host Range:    192.168.1.1 - 192.168.1.254
Broadcast:     192.168.1.255

Installing Nmap

Nmap comes pre-installed on Kali Linux. For other systems:

**Windows**: Download the installer from nmap.org

**macOS**: `brew install nmap`

**Debian/Ubuntu**: `sudo apt install nmap`

**RHEL/CentOS**: `sudo yum install nmap`

Your First Scan

Let's start with a basic scan to discover live hosts on your local network:

nmap -sn 192.168.1.0/24

The -sn flag tells Nmap to perform a ping scan (host discovery) without port scanning. This sends ICMP echo requests, TCP SYN to port 443, and TCP ACK to port 80.

Port Scanning Basics

Ports are virtual endpoints for network communication. Common ports include:

| Port | Service | Protocol |

|------|-----------|----------|

| 22 | SSH | TCP |

| 80 | HTTP | TCP |

| 443 | HTTPS | TCP |

| 53 | DNS | UDP/TCP |

| 3306 | MySQL | TCP |

TCP SYN Scan (Default, Requires Root)

nmap -sS 192.168.1.1

Sends SYN packets and analyzes responses. SYN/ACK means open, RST means closed, no response means filtered. This is fast and stealthy.

TCP Connect Scan

nmap -sT 192.168.1.1

Completes the full TCP handshake. Used when you lack root privileges. More detectable than SYN scan.

UDP Scan

nmap -sU 192.168.1.1

Scans UDP ports. Slower than TCP because UDP is connectionless and requires waiting for responses or timeouts.

Selecting Ports to Scan

nmap -p 22,80,443 192.168.1.1      # Specific ports
nmap -p 1-1000 192.168.1.1          # Port range
nmap -p- 192.168.1.1                # All 65535 ports
nmap --top-ports 100 192.168.1.1    # Most common 100 ports

Scanning all 65535 ports takes time. Use top-ports for quick assessments.

Service Version Detection

Identify exactly which software is running on open ports:

nmap -sV 192.168.1.1

This reveals version information like "OpenSSH 8.9p1 Ubuntu 3ubuntu0.6" which helps identify vulnerable software versions.

Operating System Detection

nmap -O 192.168.1.1

Uses TCP/IP fingerprinting to identify the operating system. Requires root privileges. Results are best guesses, not guarantees.

Output Formats

nmap -oN scan.txt 192.168.1.1      # Normal output
nmap -oX scan.xml 192.168.1.1      # XML (parsable)
nmap -oG scan.grep 192.168.1.1     # Greppable format
nmap -oA scan 192.168.1.1          # All formats

Practical Scanning Examples

Scan Your Local Network

nmap -sn 192.168.1.0/24

Comprehensive Scan of a Target

nmap -sS -sV -O -p- 192.168.1.1

Scan with Default NSE Scripts

nmap -sC 192.168.1.1

Scan for Common Vulnerabilities

nmap --script vuln 192.168.1.1

Legal and Ethical Considerations

Only scan networks and systems you own or have explicit written permission to test. Network scanning without authorization is illegal in many jurisdictions under computer misuse laws. Always practice in your own lab environment using virtual machines.

Start with local network discovery, practice on your own VMs, and build your skills before any real-world engagement.

Frequently Asked Questions

What is Nmap used for?

Nmap (Network Mapper) is a free, open-source tool for network discovery and port scanning. It identifies live hosts, open ports, running services, operating system versions, and potential vulnerabilities on a network. It is the industry standard for network reconnaissance.

What is the difference between -sS and -sT scans?

The -sS (SYN scan) sends SYN packets without completing the TCP handshake, making it faster and stealthier — it requires root privileges. The -sT (Connect scan) completes the full handshake and works without root but is more easily logged by intrusion detection systems.

How do I scan all 65535 ports with Nmap?

Use the command nmap -p- target to scan all TCP ports. For a faster assessment, use --top-ports 1000 to scan only the most common ports. Scanning all ports takes significantly longer but may reveal services running on non-standard ports.

Why is my Nmap UDP scan so slow?

UDP scanning is inherently slower because UDP is connectionless — Nmap must wait for ICMP port-unreachable responses or timeouts for each port. Use --min-rate to speed up scans, limit to specific ports with -p, or scan only the top UDP ports with --top-ports.

What does the -sV flag do in Nmap?

The -sV flag enables service version detection, probing open ports to determine exactly which software and version is running (e.g., OpenSSH 8.9p1). This information helps identify vulnerable software versions that may need patching.

Can I get in legal trouble for running Nmap?

Yes — scanning networks or systems you do not own or have explicit written permission to test is illegal under computer misuse laws in most jurisdictions. Always practice on your own lab VMs or authorized platforms like TryHackMe and Hack The Box.

What is Nmap Scripting Engine (NSE)?

NSE extends Nmap's capabilities with Lua scripts for tasks like vulnerability detection, brute-force testing, and information gathering. Use --script vuln for vulnerability scanning or -sC to run default discovery scripts during a scan.

How do I save Nmap scan results?

Use -oN for normal text output, -oX for XML (parsable by other tools), -oG for greppable format, or -oA to save in all formats simultaneously. For example: nmap -oA scan_results 192.168.1.1 saves results in all three formats.

What is the difference between host discovery and port scanning?

Host discovery (nmap -sn) identifies which IPs are alive on a network using ping sweeps without scanning ports. Port scanning (default) goes further by probing specific ports on live hosts to find open services. Run -sn first to map the network, then scan individual hosts.

How do I scan a specific port with Nmap?

Use -p followed by the port number: nmap -p 80 target scans only port 80. You can specify multiple ports with commas (nmap -p 22,80,443 target) or ranges (nmap -p 1-1000 target).