nmap

Where nc checks one port, nmap checks many. Its three states map onto what a firewall does: open (something accepted), closed (the device answered with a reset: nothing listens, nothing blocks), filtered (no answer at all: something dropped the probe). -sn finds which hosts on a network are up without scanning ports. Scan only networks you are allowed to: in netlab, the lab's own.

nmap command usage

nmap [-Pn] [-p PORTS] [-sS | -sT | -sA | -sU] [-sn] [-sV] [-O] [-A] [--script NAME] [-T0-5] [-oA NAME] TARGET

Options

-p 22,80,443

these ports (-p- for all 65535)

-Pn

skip the ping check: scan even if the host ignores ping

-sn

host discovery only: which addresses are up

--reason

say which answer made nmap call a host up or a port open

-sU

UDP ports instead of TCP

--top-ports 100

only that many of the most common ports

-p-

every port, 1 to 65535

--open

list only the open ports

-sS

SYN (half-open) scan: knock, read the answer, hang up with a reset; the default as root

-sT

connect scan: full TCP connections through the system; the default without root

-sV

ask each open port what program and version answers, instead of guessing from its number

-O

guess the operating system from how its network code answers (a near match, needs root)

-A

all at once: -sV, -O, the default scripts (-sC) and a traceroute

--script http-title

run a named script (or a category, such as default or safe) on the ports it is for

--script-help http-title

say what a script does and its categories, without scanning

-oA before

save the results as before.nmap, before.xml and before.gnmap (-oN, -oX, -oG: one each)

-sA

ACK scan: map which ports a firewall filters (unfiltered vs filtered), not open/closed

-T5

fastest timing template (-T0 slowest; -T4 the usual balance)

-T2

polite timing: space probes out to go gently on the host and network

--max-retries 0

how many times to re-send a probe that got no reply (0 = send once)

--scan-delay 400ms

wait at least this long between probes, pacing under a rate limit

--min-rate 100

send at least this many packets per second (--max-rate caps it)

--host-timeout 5m

give up on a host taking longer than this, leaving its ports untested

--help

list every option, one line each, and scan nothing

nmap examples

nmap -Pn -p 22,53,80,443 10.0.2.10

Checks four common ports on 10.0.2.10 and reports each as open, closed or filtered.

nmap -sn 10.0.1.0/24

Finds which addresses on 10.0.1.0/24 answer, without scanning ports.

nmap -sn --reason 10.0.2.0/24

Finds the live hosts and says why each counts as up: an ARP reply on your own network, a ping reply or a TCP reset across a router.

Nmap scan report for fileServer (10.0.2.10)
Host is up, received echo-reply ttl 63 (0.00026s latency).

nmap -sU -p 53,67 10.0.1.2

Checks two UDP ports, DNS and DHCP, on the router.

nmap 10.0.2.10

Scans the 1000 most common TCP ports and lists the open ones.

nmap -p- 10.0.2.10

Scans all 65535 TCP ports, finding services on unusual ports.

nmap -F 10.0.2.0/24

Scans only the 100 most common ports on every address of the network: a fast first look.

nmap --top-ports 20 --open 10.0.2.0/24

Scans the 20 most common ports and shows only the hosts and ports that are open.

nmap -sV -p 22,80,443 10.0.2.10

Asks each open port what answers on it and prints the program and version.

PORT    STATE SERVICE  VERSION
22/tcp  open  ssh      OpenSSH 9.6 (protocol 2.0)
80/tcp  open  http     nginx 1.26.2
443/tcp open  ssl/http nginx 1.26.2

nmap -O 10.0.2.10

Guesses the operating system from how its TCP/IP stack answers (needs root).

nmap -A 10.0.2.10

Runs version detection, OS detection, the default scripts and traceroute together.

nmap -sT -p 22,80 10.0.2.10

Makes full TCP connections, the scan you get without root; as root nmap sends half-open SYN probes (-sS).

nmap --script ssl-cert -p 443 bank.lab

Prints the server's certificate: its name, issuer and dates.

nmap -T4 -oA office-scan 10.0.1.0/24

Scans faster and saves the results in normal, XML and grepable files named office-scan.

nmap -iL hosts.txt -p 22

Checks SSH on every address listed in hosts.txt, one per line.

nmap -6 -p 22,80 fd00::10

Scans an IPv6 address.

Reading the output

$ nmap -Pn -p 22,53,80,7 10.0.2.10
Nmap scan report for 10.0.2.10
Host is up (0.000051s latency).

PORT   STATE  SERVICE
7/tcp  open   echo
22/tcp closed ssh
53/tcp closed domain
80/tcp open   http

• open: a program accepted the connection.
• closed: the device answered "nothing here" (a reset): reachable, not listening.
• filtered (not in this sample): no answer at all. A firewall dropped the probe.

Pitfalls

• SERVICE is a guess from the port number, not what really runs there.

Run it on real machines