Nmap: Network Scanning & Security Analysis
Discover hosts, open ports, and running services on a network — the standard first step in most security assessments.
⚠️ Legal Notice: Only scan networks, devices, or websites that you own or have explicit written permission to test. Scanning systems without authorization may violate the Computer Fraud and Abuse Act (US), the Computer Misuse Act (UK), and similar laws elsewhere — even with default or "safe" scan types.
What is Nmap?
Nmap (Network Mapper) is a free and open-source network scanning tool used to discover hosts and services on a computer network. It's widely used for network auditing, penetration testing, and security assessments.
With Nmap, you can identify live systems, detect open ports, determine running services, and even guess operating systems used by devices.
Why Nmap Matters for Cybersecurity
- Identify open ports and services
- Detect unauthorized devices on a network
- Perform vulnerability assessments
- Strengthen network security posture
- Build an accurate inventory of connected assets
- Verify firewall rules are working as intended
Basic Nmap Commands
The examples below use private network addresses (192.168.x.x) and IANA's reserved documentation domain — safe for learning. Only run these against your own devices or a lab environment.
Scan a Single IP
Scans a single device and shows open ports.
Scan a Range of IPs
Scan a Website
example.com is reserved by IANA for documentation and testing — never run this against a live site you don't own.
Service Version Detection
Scan Specific Ports
Scan All 65,535 Ports
Understanding Nmap Output
- Open Ports: Ports accepting connections
- Service: Application running on that port
- State: Open, closed, or filtered
- Protocol: TCP or UDP
A "filtered" state usually means a firewall is blocking probes; "closed" means the port is reachable but nothing's listening.
Advanced Nmap Features
These scans are more invasive — stealth scanning in particular is designed to evade detection. Only use against systems you own or a lab environment.
OS Detection
Aggressive Scan
Stealth Scan
Nmap Scripting Engine (NSE)
Extends functionality with community scripts grouped into categories like default, discovery, safe, and vuln. Beginners should stick to "safe" scripts.
Nmap Timing Templates
Timing templates control scan speed, numbered T0 (slowest, stealthiest) to T5 (fastest, most aggressive).
| Template | Speed | Typical Use |
|---|---|---|
| -T0 | Paranoid | Extremely slow, avoids detection |
| -T1 | Sneaky | Slow, IDS evasion |
| -T2 | Polite | Reduces network load |
| -T3 | Normal | Default speed |
| -T4 | Aggressive | Faster, stable networks |
| -T5 | Insane | Fastest, may lose accuracy |
Saving and Exporting Results
- -oN scan.txt — human-readable output
- -oX scan.xml — XML, feeds into other tools
- -oG scan.gnmap — grepable format
- -oA scan — saves all three formats at once
Real-World Use Cases
- Network inventory audits: Confirming which devices are connected
- Firewall rule verification: Testing rules from outside and inside
- Penetration testing: Mapping scope before deeper testing
- Incident response: Checking for unexpected open ports post-breach
- Compliance checks: Confirming no unauthorized services are exposed
Nmap is often the first tool used in a security assessment. Once you've mapped open ports and services, the next step is usually deeper analysis — Wireshark for inspecting the actual traffic those services generate, or Metasploit if you've identified a service with a known vulnerability worth testing further. If Nmap turns up a login service like SSH or FTP, Hydra is the natural next step for authorized authentication testing.
Nmap vs. Other Scanning Tools
| Tool | Primary Use | Best For |
|---|---|---|
| Nmap | Port and network scanning | General-purpose discovery and auditing |
| Masscan | High-speed port scanning | Scanning very large IP ranges quickly |
| Nessus | Vulnerability scanning | In-depth vulnerability identification |
| Zenmap | GUI for Nmap | Beginners preferring a visual interface |
Frequently Asked Questions
Is Nmap legal to use?
Yes. What matters is what you scan — unauthorized targets can be illegal regardless of the tool.
Is Nmap free?
Yes, free and open-source for Windows, Linux, and macOS.
Do I need Linux to use Nmap?
No — it runs natively on Windows and macOS too.
Can Nmap detect all vulnerabilities?
No — it's a discovery/mapping tool, typically paired with a dedicated scanner like Nessus.
What's the difference between Nmap and Zenmap?
Zenmap is Nmap's official GUI — same engine, visual results.
Conclusion
Nmap is essential for anyone interested in networking or cybersecurity, always used with proper authorization.