Nmap

A SYN scan (-sS) sends SYN packets without completing the TCP handshake, making it faster and stealthier — it is the default when running as root. A TCP connect scan (-sT) completes the full three-way handshake using the OS connect() call, which is more reliable but slower and fully logged by the target. Use -sS for stealthy authorized engagements; use -sT only when -sS is unavailable (non-root).

A default scan of the top 1000 ports on a single host completes in 1-5 seconds. A full port scan (-p-) covering all 65535 ports takes 2-10 minutes per host depending on the timing template (-T0 through -T5) and network conditions. Aggressive timing (-T5) is faster but more likely to miss ports or trigger IDS alerts.

Yes. Use nmap -O [target] for OS detection. Nmap analyzes TCP/IP stack responses, TCP window sizes, IP ID sequences, and other fingerprinting techniques to determine the target's operating system and version with high accuracy. OS detection requires at least one open and one closed port on the target.

NSE is a Lua-based framework that extends Nmap's scanning capabilities with over 700 scripts. Scripts automate vulnerability detection (vuln category), brute-force testing (brute category), network discovery (discovery category), and more. Run scripts with nmap --script [category or script name] [target]. Categories include auth, broadcast, brute, default, discovery, dos, exploit, external, fuzzer, intrusive, malware, safe, version, and vuln.

Nmap itself is legal software. However, scanning networks or systems without explicit written permission from the owner is illegal in most jurisdictions. Unauthorized scanning violates laws like the CFAA (US), Computer Misuse Act (UK), and similar legislation worldwide. Always obtain proper authorization before performing any network scans.

Yes, but with limitations. Nmap can use fragmentation (-f), decoys (-D), source port spoofing (--source-port), and idle scans (-sI) to bypass some firewall rules. However, stateful firewalls that track connections will block many evasion techniques. Use nmap -sN (Null scan) or -sF (FIN scan) to bypass stateless packet filters.

nmap -sS (SYN scan) sends SYN packets without completing the TCP handshake — it is faster, stealthier, and the default scan when running as root. nmap -sT (TCP connect scan) completes the full three-way handshake using the OS connect() call, making it more reliable but slower and fully logged by the target. Use -sS for stealth; use -sT only when -sS is unavailable (non-root).

Yes. Use nmap -6 [target] to scan IPv6 addresses. Nmap supports IPv6 scanning for most scan types including SYN, connect, and UDP scans. IPv6 scanning is especially useful in modern enterprise networks and cloud environments that use dual-stack or IPv6-only configurations.

Nmap (Network Mapper) is a free, open-source network scanner used for host discovery, port scanning, service detection, and OS fingerprinting. Created by Gordon Lyon in 1997, it sends raw IP packets to identify active devices, open ports, and running services on any TCP/IP network.

Nmap is used for five primary tasks: host discovery (finding live devices), port scanning (identifying open ports), service detection (fingerprinting applications and versions), OS detection (determining operating systems), and vulnerability scanning via NSE scripts. Network administrators use it for security audits, while penetration testers use it to map attack surfaces before exploitation with tools like Metasploit.

Install Nmap using your package manager (apt-get install nmap on Kali Linux), then run nmap followed by a target IP address or hostname. Start with a basic scan: nmap 192.168.1.1. Add flags like -sV for service detection, -O for OS detection, and -A for aggressive scanning. For subnet scans, use CIDR notation: nmap -sn 192.168.1.0/24. Practice in a lab environment before scanning live networks.

Nmap itself is legal software. However, scanning networks or systems without explicit written permission from the owner is illegal in most jurisdictions. Unauthorized scanning violates laws like the CFAA (US), Computer Misuse Act (UK), and similar legislation worldwide. Always obtain proper authorization before performing any network scans. Nmap is designed for legitimate security testing, network administration, and educational purposes.

Nmap is the foundation of network reconnaissance in cybersecurity. It helps professionals discover assets, detect vulnerabilities, and assess security posture. The Nmap Scripting Engine (NSE) enables automated vulnerability detection, and results integrate seamlessly with exploitation frameworks like Metasploit. Both offensive (penetration testing) and defensive (security monitoring) teams depend on Nmap for network visibility.

Essential Nmap commands include: nmap [target] for basic scanning, nmap -sV [target] for service detection, nmap -sn [target] for host discovery, nmap -O [target] for OS detection, nmap -A [target] for aggressive scanning, and nmap -p- [target] to scan all 65535 ports. For vulnerability scanning, use nmap --script vuln [target]. Save results with -oA for all formats or -oN for normal output.

Yes, Nmap runs on Windows, Linux, and macOS. The Windows installer from nmap.org includes both the command-line tool and Zenmap, a graphical user interface for visualization and comparison. Nmap for Windows provides identical functionality to the Linux version. Android users can run Nmap through Termux. All platforms support the full Nmap Scripting Engine.

Yes, Nmap is completely free and open source under the GNU General Public License (GPL). Download it from nmap.org without any cost. The Nmap Scripting Engine, Zenmap GUI, and all 700+ NSE scripts are included. Nmap is maintained by an active community of developers and security researchers, ensuring continuous updates and comprehensive documentation.

While web-based Nmap alternatives exist (such as online port scanners), they cannot replace Nmap's full capabilities. Online tools are limited to basic port scanning from their server's IP and cannot perform OS detection, NSE scripts, or stealth scans. For serious penetration testing, install Nmap locally using apt-get install nmap on Kali Linux or download from nmap.org. Practice in lab environments like HackTheBox or TryHackMe to learn safely.

Yes. Use nmap -O [target] for OS detection. Nmap analyzes TCP/IP stack responses, TCP window sizes, IP ID sequences, and other fingerprinting techniques to determine the target's operating system and version with high accuracy.

Nmap Scripting Engine (NSE) is a Lua-based framework that extends Nmap's scanning capabilities with over 700 scripts. NSE scripts automate vulnerability detection (vuln category), brute-force testing (brute category), network discovery (discovery category), and more. Scripts are organized into categories: auth, broadcast, brute, default, discovery, dos, exploit, external, fuzzer, intrusive, malware, safe, version, and vuln. Run scripts with nmap --script [category or script name] [target].

Nmap speed depends on the timing template used (-T0 through -T5). T0 (Paranoid) takes hours per host; T3 (Normal) is the default; T5 (Insane) scans as fast as possible but may miss ports. A basic scan of 1000 ports on a single host typically completes in 1-5 seconds. Full port scans (-p-) take 2-10 minutes per host depending on timing and network conditions.

Yes, but with limitations. Nmap can use fragmentation (-f), decoys (-D), source port spoofing (--source-port), and idle scans (-sI) to bypass some firewall rules. However, stateful firewalls that track connections will block many evasion techniques. Use nmap -sN (Null scan) or -sF (FIN scan) to bypass stateless packet filters. Stateful inspection firewalls require more advanced techniques or direct network access.

nmap -sS (SYN scan) sends SYN packets without completing the TCP handshake — it's faster, stealthier, and the default scan when running as root. nmap -sT (TCP connect scan) completes the full three-way handshake using the OS's connect() call, making it more reliable but slower and fully logged by the target. Use -sS for stealth; use -sT only when -sS isn't available (non-root).

Yes. Use nmap -6 [target] to scan IPv6 addresses. Nmap supports IPv6 scanning for most scan types including SYN, connect, and UDP scans. IPv6 scanning is especially useful in modern enterprise networks and cloud environments that use dual-stack or IPv6-only configurations.

Nmap supports four output formats: -oN (normal text), -oX (XML for import into Metasploit and other tools), -oG (greppable format for scripting), and -oA (all three formats simultaneously). XML output (-oX) is the most versatile for automated processing. Use -oA to save all formats at once for maximum flexibility in post-scan analysis.

Use -p [port number] to scan a specific port: nmap -p 80 192.168.1.1 scans only port 80. For multiple ports: nmap -p 80,443,8080 [target]. For port ranges: nmap -p 1-1024 [target]. For all ports: nmap -p- [target]. You can also use port names: nmap -p http [target].

An idle scan (nmap -sI zombie_host [target]) uses a third-party 'zombie' host to scan the target. The scan appears to come from the zombie rather than your IP, making it truly anonymous. The technique exploits predictable IP ID sequences on the zombie to determine port states. Find suitable zombies with nmap -O -sI [potential_zombie] [target].

Nmap XML output (-oX) can be imported directly into Metasploit using the db_import command or db_nmap command. This allows Metasploit to automatically create hosts, services, and vulnerabilities from Nmap results. Workflow: nmap -sV -oX scan.xml [target] → msfconsole → db_import scan.xml → hosts → services → vulns.

Nmap has limited proxy support. For HTTP CONNECT proxies, use --proxies. For SOCKS4/SOCKS5 proxies, use --proxies socks4:// or socks5://. However, proxy scanning significantly limits available scan types — stealth scans, OS detection, and most NSE scripts won't work through proxies. Direct scanning is always preferred when possible.