Network Scanning with Nmap: A Practical Guide

What Is Nmap and Why Does It Matter?

Nmap (Network Mapper) is a free, open-source tool that has been the cornerstone of network reconnaissance since 1997. It sends crafted packets to target hosts and analyzes the responses to determine which hosts are online, which ports are open, what services are running, and often which operating system is in use. Security professionals use it for vulnerability assessments, penetration tests, and network inventory. Attackers use it to find entry points before launching an attack. Understanding what Nmap reveals about your systems is the first step to defending them.

Always get written authorization before scanning any network you don't own. Unauthorized scanning is illegal in most jurisdictions.

Host Discovery

Before scanning ports, you need to know which hosts are alive. Nmap's default behavior pings hosts before probing them:

# Ping sweep — discover live hosts in a subnet
nmap -sn 192.168.1.0/24

The -sn flag (no port scan) sends ICMP echo requests, TCP SYN to port 443, TCP ACK to port 80, and ICMP timestamp requests. On a local network this is usually sufficient. Against hardened hosts or firewalls that block ICMP, you may need to skip host discovery entirely:

# Treat all hosts as online — useful when ICMP is blocked
nmap -Pn 10.0.0.5

Port Scanning Techniques

Nmap supports many scan types. The most important ones are:

TCP SYN Scan (Stealth Scan)

nmap -sS 192.168.1.10

This is the default scan when run as root. It sends a SYN packet; if the port is open the target replies SYN/ACK, and Nmap immediately sends RST rather than completing the handshake. Because no full connection is established, many older IDS systems and application logs don't record it — hence the name "stealth scan." It is fast and accurate.

TCP Connect Scan

nmap -sT 192.168.1.10

Used when you don't have raw socket privileges. Nmap completes the full TCP handshake. This is noisier and slower but works without root. Application logs will record these connections.

UDP Scan

nmap -sU 192.168.1.10

UDP scanning is slow because closed UDP ports typically return ICMP port-unreachable messages while open ports often return nothing at all. Rate-limiting by the OS makes this scan take minutes per host. Target only specific UDP ports when possible:

nmap -sU -p 53,161,500 192.168.1.10

Service and Version Detection

Knowing a port is open is useful; knowing what is running on it is essential:

nmap -sV 192.168.1.10

Nmap sends a series of probes and compares responses against a database of over 11,000 service signatures. You'll get output like 80/tcp open http Apache httpd 2.4.51. The --version-intensity flag (0–9) controls how aggressively Nmap probes — higher values detect more obscure services but take longer.

OS Detection

nmap -O 192.168.1.10

Nmap analyzes TCP/IP stack behavior (TTL values, window sizes, IP flags, etc.) to fingerprint the operating system. Combine with -sV for a comprehensive picture:

nmap -A 192.168.1.10

The -A flag enables OS detection, version detection, script scanning, and traceroute in one shot.

Nmap Scripting Engine (NSE)

Nmap's most powerful feature is its scripting engine, which allows automated interaction with services using Lua scripts:

# Run default safe scripts
nmap -sC 192.168.1.10

# Check for specific vulnerabilities
nmap --script vuln 192.168.1.10

# Enumerate HTTP headers
nmap --script http-headers 192.168.1.10

Scripts are categorized as safe, intrusive, exploit, brute, and more. Be cautious with intrusive and exploit categories — they may disrupt services or trigger alerts.

Output Formats

For professional engagements, save results in machine-readable formats:

# Normal output
nmap -oN scan.txt 192.168.1.0/24

# XML output (importable into Metasploit, vulnerability scanners)
nmap -oX scan.xml 192.168.1.0/24

# All formats at once
nmap -oA scan_results 192.168.1.0/24

Tools like Zenmap provide a GUI for result visualization, and Metasploit can directly import Nmap XML to populate its host database.

Evading Detection

Attackers use various techniques to avoid triggering IDS/IPS alerts:

• Slow scan: -T0 or -T1 dramatically reduces packet rate
• Decoys: -D RND:10 sends packets from 10 random decoy IPs alongside the real source
• Fragmentation: -f splits packets into 8-byte fragments
• Source port spoofing: --source-port 53 mimics DNS traffic

Understanding these techniques helps you tune your detection systems to spot them.

Building a Baseline for Your Network

Run Nmap regularly against your own infrastructure and diff the results. Unexpected open ports, new services, or unknown hosts are red flags. A simple workflow:

1. Perform an authorized full-port scan: nmap -p- -sV -oX baseline.xml 192.168.1.0/24
2. Schedule weekly scans and compare XML output with ndiff
3. Investigate any delta — a new open port could mean a misconfiguration or a compromised host

Nmap is not a vulnerability scanner, but it tells you what's exposed. Pair it with tools like OpenVAS or Nessus for a complete picture of your attack surface.