Nmap Quick Guide: Scanning & Security Tips

Nmap (Network Mapper) is one of the most powerful and flexible tools for network discovery, service identification, and security scanning. Whether you're a sysadmin auditing your infrastructure or an authorized penetration tester mapping an engagement scope, Nmap helps you find open ports, identify running services, and spot potential weaknesses.

Important legal note: Only scan systems you own or have explicit, written permission to test. Unauthorized scanning can be illegal and disruptive.

Basic host discovery & port scanning - essential commands 🧰​

Here’s a quick cheat sheet of the most useful Nmap commands and what they do. Use them as building blocks for customized scans.

# Basic host discovery & port scan (default TCP top ports)
nmap 10.10.10.10

# Service/version detection
nmap -sV 10.10.10.10

# Scan specific ports (e.g., 80 and 443)
nmap -p 80,443 10.10.10.10

# Scan all TCP ports (1-65535)
nmap -p- 10.10.10.10

# Default scripts + service detection
nmap -sC -sV 10.10.10.10

# Run vulnerability-related NSE scripts
nmap --script=vuln 10.10.10.10

# UDP scan (slower, needs root)
nmap -sU 10.10.10.10

# Treat host as up (skip ping discovery)
nmap -Pn 10.10.10.10

# Faster timing (use with care) for a whole subnet
nmap -T4 10.53.0.0/24

# Read targets from file
nmap -iL hosts.txt

# Save output to a normal text file
nmap -oN results.txt 10.10.10.10

---

What the common flags mean (quick reference) 🏷️​

• -sS - SYN (stealth) scan. Fast and common; needs root on Unix.
• -sT - TCP connect scan (no raw sockets). Slower but works for non-root.
• -sU - UDP scan. Important but much slower; requires patience.
• -sV - Service/version detection. Tries to probe services to get software name/version.
• -sC - Runs default NSE scripts (useful quick checks).
• -p - Ports to scan (single, list, ranges, or -p- for all).
• -T<0-5> - Timing template (0 slowest, 5 fastest). -T4 is aggressive but efficient.
• -Pn - Skip host discovery (assume host is up). Useful when ICMP blocked.
• -iL <file> - Input list of targets.
• -oN/-oX/-oG - Output formats: normal, XML, Grepable.
• --script=<name> - Run specific NSE script or category (e.g., --script=vuln).

---

Interpreting scan results - what to look for 🔎​

A typical Nmap port line looks like:

PORT    STATE  SERVICE VERSION
22/tcp  open   ssh     OpenSSH 8.2p1 (protocol 2.0)
80/tcp  open   http    Apache httpd 2.4.41

• PORT - port number/protocol.
• STATE - open, closed, or filtered.
  • open = service responding.
  • filtered = firewall or no response - probe inconclusive.
  • closed = reachable but no service listening.
• SERVICE - common service name guess.
• VERSION - what -sV discovered (useful to identify vulnerable versions).

Look for unexpected open ports (RDP, SMB, database ports) or outdated versions reported by -sV / --script=vuln.

---

Using Nmap Scripting Engine (NSE) - powerful but careful 🧩​

Nmap includes the NSE, a library of scripts to automate discovery and vulnerability checks.

• -sC runs a safe, default set of checks.
• --script=vuln runs known vulnerability scripts (be careful; some may be intrusive).
• You can target an individual script: --script http-title 10.10.10.10.

Tip: Test NSE scripts in a lab before running against production - some scripts may cause crashes or large server responses.

---

UDP scanning - patience required ⏳​

UDP scans (-sU) are useful because many services (DNS, SNMP, NTP) use UDP. Downsides:

• Slower: UDP does not use TCP handshakes - you may need timeouts and retries.
• False negatives: Firewalls can drop UDP probes silently (open|filtered confusion).
• Root privileges: Often requires root/administrator to craft UDP packets.

Combine UDP and TCP scans for a complete view: nmap -sS -sU -p U:53,161,T:22,80 target.

---

Timing & stealth trade-offs - -T templates 🕒​

• -T0 / -T1 - paranoid/sneaky: very slow, good for stealth.
• -T3 - default, balanced.
• -T4 - faster, good on LANs or permitted tests.
• -T5 - insane: very aggressive, can overwhelm networks and trigger IDS/IPS.

Rule of thumb: Use -T4 on your own networks; use slower timing when scanning targets across the internet or in sensitive environments.

---

Output formats & reporting 📑​

Nmap supports several output options:

• -oN file - normal readable output.
• -oX file - XML (useful for automated tools).
• -oG file - grepable (legacy).
• -oA basename - save in all formats (basename.nmap, basename.xml, basename.gnmap).

Save results for audit, correlation, and to feed into other tools (e.g., parsing with xsltproc or importing into a SIEM).

---

Scanning a subnet / multiple hosts efficiently 🧭​

• Scan a whole subnet with nmap -T4 -p- 10.53.0.0/24 (use responsibly).
• Use -iL hosts.txt to read many targets from a file.
• Consider splitting large scans into chunks, and stagger timing to avoid flood detection.

Practical scan workflow (safe & effective) ✅​

1. Host discovery: nmap -sn 10.10.10.0/24 to see live hosts.
2. Port & service scan: nmap -sS -sV -p- 10.10.10.10 for deeper look.
3. Script checks: nmap -sC --script vuln 10.10.10.10 in a test environment.
4. UDP checks: nmap -sU -p 53,161 10.10.10.10 (slow).
5. Document & share: Save with -oA and include findings in your report.

Always notify stakeholders and schedule scanning windows (especially for noisy scans).

Common troubleshooting tips 🛠️​

• If Nmap reports all ports filtered, check your network path and local firewall.
• To avoid DNS resolution slowdowns, add -n to disable reverse-DNS lookups.
• Increase verbosity (-v, -vv) for more detail during scans.
• Use --reason to show why a port has a given state (useful for diagnostics).

Safety, permissions, and ethics - non-negotiable rules ⚖️​

• Get written authorization before scanning any network you do not own.
• Avoid intrusive NSE scripts against production unless explicitly allowed.
• Respect rate limits and maintenance windows.
• If you find a critical vulnerability, follow responsible disclosure or your engagement’s rules.

Want more? Useful next steps 🚀​

• Build a lab (virtual machines) to practice -sV, --script, and -sU safely.
• Parse Nmap XML output to generate dashboards or import into a PR/issue tracker.
• Combine Nmap with ncat, grep, and automation scripts for repeatable audits.

Final takeaway - Nmap is powerful; use it responsibly 🔐​

Nmap is an indispensable tool for discovery and security testing. Its flexibility - from simple host pings to complex NSE-driven audits - makes it ideal for network admins and authorized security testers. Learn flags and workflows, test in labs, save and interpret results, and always act ethically with proper authorization.