Nmap Tutorial

Nmap ("Network Mapper") is an open-source tool for network discovery and security auditing, and arguably the best port scanner ever written. Created by Gordon Lyon (Fyodor), it lets you map hosts and services, fingerprint operating systems, and probe the security posture of a network. This tutorial covers the flags you will actually use, organised by task, with practical examples.

Install

sudo apt install nmap      # Debian/Ubuntu
sudo dnf install nmap      # Fedora/RHEL
nmap --version

Basic syntax

nmap [scan type(s)] [options] {target specification}

Target specification

Targets can be hostnames, IPs, CIDR ranges or octet ranges:

nmap scanme.nmap.org 192.168.0.0/24 10.0.0-255.1-254
nmap -iL targets.txt        # read targets from a file
nmap -iR 100               # 100 random hosts
nmap --exclude 192.168.0.1  # skip a host

Host discovery

• -sn — ping sweep only, no port scan (find live hosts).
• -Pn — treat all hosts as online, skip discovery (useful when ICMP is blocked).
• -PS/-PA/-PU [ports] — TCP SYN, TCP ACK or UDP discovery probes.
• -n / -R — never / always do DNS resolution.

nmap -sn 192.168.0.0/24    # who is alive on my LAN?

Scan techniques

• -sS — TCP SYN ("half-open") scan. Fast and the default when run as root.
• -sT — full TCP connect scan (no root needed).
• -sU — UDP scan.
• -sA — ACK scan, handy for mapping firewall rulesets.
• -sN/-sF/-sX — Null, FIN and Xmas scans for stealth/evasion.

Ports, service and OS detection

• -p — choose ports: -p 22,80,443, -p 1-1024, or -p- for all 65535.
• -sV — probe open ports to determine service/version.
• -O — OS fingerprinting (requires root).
• -A — aggressive: -sV -O plus traceroute and default scripts.

sudo nmap -sS -sV -O -p- scanme.nmap.org

The Nmap Scripting Engine (NSE)

NSE is what turned Nmap into a full vulnerability scanner. Scripts live in categories like default, safe, vuln and discovery:

nmap -sC target                     # run the default script set
nmap --script vuln target           # known-vulnerability checks
nmap --script http-title -p80 target

Timing and output

Use -T0 (paranoid) through -T5 (insane) to trade speed for stealth, and save results in every format at once with -oA:

nmap -T4 -oA scan_results 192.168.0.0/24
# writes scan_results.nmap / .xml / .gnmap

Handy example scans

nmap -v scanme.nmap.org                 # verbose scan of common ports
sudo nmap -sS -O 192.168.0.0/24         # stealth SYN + OS detect on a /24
nmap -sV -p 22,53,80,110,143 10.0.0.0/24 # version-detect selected services
nmap -Pn -p80 --open 192.168.0.0/16     # find web servers, skip host discovery

This only scratches the surface. For the complete reference, read the official Nmap Reference Guide and the free online Nmap Network Scanning book.