nmap documentation Complete Commands with Examples
Nmap, short for Network Mapper, is one of the most widely used tools for network discovery and security auditing. It helps cybersecurity professionals, network administrators, and ethical hackers discover devices on a network, identify open ports, detect running services, and gather information about systems.
Nmap is available for Linux, Windows, and macOS and is commonly included in cybersecurity distributions such as Kali Linux.
Important: Only scan networks, computers, and systems that you own or have explicit permission to test. Unauthorized scanning can violate policies, terms of service, or applicable laws.
Table of Contents
What Is Nmap?
Nmap is an open-source network scanning tool originally developed by Gordon Lyon (Fyodor). It is primarily used to examine hosts and services on a network.
For example, suppose a company has 20 computers, several servers, printers, and network devices. The administrator may need to determine:
- Which devices are currently online?
- Which ports are open?
- What services are running?
- Which operating systems are being used?
- Are unexpected services exposed?
- Which systems require further security investigation?
Nmap can help answer these questions.
How Does Nmap Work?
When you run an Nmap scan, the tool sends specially crafted network packets to a target host or network and analyzes the responses.
A simplified process looks like this:
Target → Nmap sends probes → Host responds → Nmap analyzes response → Scan results
The results can include information such as:
- Host availability
- Open, closed, or filtered ports
- Service names
- Service versions
- Possible operating system information
- Network characteristics
The exact information Nmap can determine depends on the scan type, target configuration, firewall rules, and network conditions.
Installing Nmap
Ubuntu/Debian/Kali Linux
Nmap can usually be installed with:
sudo apt update
sudo apt install nmap
Check the installation:
nmap –version
Windows
Download Nmap from the official Nmap website and install it using the Windows installer.
After installation, open Command Prompt or PowerShell and run:
nmap –version
Basic Nmap Syntax
The basic syntax is:
nmap [options] target
For example, if you have permission to scan a laboratory machine at 192.168.1.10:
nmap 192.168.1.10
This performs a basic scan of the target.
Understanding Nmap Ports
Ports are logical communication endpoints used by network applications.
Some commonly encountered ports include:
| Port | Common Service |
| 21 | FTP |
| 22 | SSH |
| 25 | SMTP |
| 53 | DNS |
| 80 | HTTP |
| 110 | POP3 |
| 143 | IMAP |
| 443 | HTTPS |
| 3306 | MySQL |
| 3389 | RDP |
An open port does not automatically mean that a system is vulnerable. It means that a service is accepting connections on that port.
Security professionals use this information to determine whether exposed services are expected and properly secured.
Common Nmap Commands
1. Basic Host Scan
nmap 192.168.1.10
This is one of the simplest Nmap scans.
It can report ports that Nmap identifies as open, closed, or filtered.
2. Scan a Specific Port
You can scan a particular port using:
nmap -p 80 192.168.1.10
Here:
- -p specifies the port.
- 80 is the port being tested.
- 192.168.1.10 is the authorized target.
You can also specify multiple ports:
nmap -p 22,80,443 192.168.1.10
3. Scan a Range of Ports
For example:
nmap -p 1-1000 192.168.1.10
This checks ports from 1 through 1000.
4. Detect Service Versions
One useful Nmap feature is service-version detection:
nmap -sV 192.168.1.10
Instead of simply showing an open port, Nmap attempts to determine the service and version associated with it.
For example, you might see information similar to:
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH
80/tcp open http Apache httpd
The exact output depends on the target.
5. Operating System Detection
With appropriate permissions and network conditions, Nmap can attempt OS detection:
sudo nmap -O 192.168.1.10
The -O option enables operating system detection.
OS detection is not guaranteed to be accurate, particularly when firewalls, virtual machines, or unusual network configurations are involved.
6. Scan a Local Network
If you are testing your own home or lab network, you can discover active hosts.
For example:
nmap -sn 192.168.1.0/24
The -sn option performs host discovery without performing a traditional port scan.
A result might look conceptually like:
Nmap scan report for 192.168.1.1
Host is up
Nmap scan report for 192.168.1.5
Host is up
Nmap scan report for 192.168.1.10
Host is up
This can help an administrator understand which devices are responding on an authorized network.
Example: Checking a Small Office Network
Imagine a small company has an internal network containing:
- 10 employee computers
- 1 web server
- 1 file server
- 2 network printers
- 1 router
The network administrator wants to identify devices and check whether unexpected network services are exposed.
The administrator has authorization to scan the network.
Step 1: Discover Active Devices
They run:
nmap -sn 192.168.10.0/24
Suppose the results show several active addresses:
192.168.10.1
192.168.10.10
192.168.10.11
192.168.10.20
192.168.10.30
The administrator now has a basic inventory of responding hosts.
Step 2: Check an Internal Server
The administrator identifies 192.168.10.20 as the company’s internal server and runs:
nmap -sV 192.168.10.20
Suppose the scan reports:
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
443/tcp open https
3306/tcp open mysql
Step 3: Analyze the Results
The administrator knows that:
- SSH is required for administration.
- HTTP and HTTPS are required for the internal web application.
- MySQL is required by the application.
However, the administrator notices that MySQL is listening on the network when it should only be accessible locally or from a restricted application server.
This becomes a security finding.
Step 4: Correct the Configuration
The administrator can then:
- Review the MySQL configuration.
- Restrict which interfaces MySQL listens on.
- Configure firewall rules.
- Allow access only from authorized systems.
- Review authentication settings.
- Update the database software where appropriate.
- Perform another authorized scan.
The second scan can confirm whether the unwanted exposure has been reduced.
This demonstrates an important point:
Nmap does not automatically mean “hacking.”
It is primarily a visibility and assessment tool. The security value comes from using its results to understand and improve the network.
Nmap Scan Types
Nmap provides many different scanning techniques.
TCP Connect Scan
nmap -sT 192.168.1.10
This performs a TCP connection-based scan.
SYN Scan
sudo nmap -sS 192.168.1.10
The SYN scan is commonly used for TCP port discovery and generally requires elevated privileges on many systems.
UDP Scan
sudo nmap -sU 192.168.1.10
UDP scanning can identify UDP services, although it can be considerably slower than TCP scanning.
Service Detection
nmap -sV 192.168.1.10
Attempts to identify services and versions.
OS Detection
sudo nmap -O 192.168.1.10
Attempts to identify the target operating system.
Combined Scan
For an authorized lab target, several discovery features can be combined:
sudo nmap -sS -sV -O 192.168.1.10
This combines SYN scanning, service detection, and OS detection.
Nmap Output Explained
Consider an example result:
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
443/tcp open https
3306/tcp filtered mysql
PORT
Shows the network port and protocol.
For example:
22/tcp
means TCP port 22.
STATE
Shows Nmap’s assessment of the port.
Common states include:
Open: A service is listening and accepting connections.
Closed: The port is reachable but no service is currently listening.
Filtered: A firewall or other network control prevents Nmap from determining the port’s exact state.
SERVICE
Shows the service Nmap associates with the port.
For example:
22/tcp → ssh
80/tcp → http
443/tcp → https
Why Is Nmap Important in Cybersecurity?
Nmap provides network visibility, which is an important part of security management.
Organizations can use it to:
- Inventory network devices
- Identify exposed services
- Verify firewall configurations
- Troubleshoot connectivity
- Audit authorized systems
- Support vulnerability assessments
- Check whether expected services are available
- Detect unexpected network exposure
It can also be useful during penetration testing when used within an explicitly authorized scope.
Nmap vs Vulnerability Scanner
Nmap and vulnerability scanners are related but not identical.
Nmap primarily focuses on network discovery, ports, hosts, and services. With scripts and additional functionality, it can also perform certain security checks.
A dedicated vulnerability scanner is generally designed to perform deeper vulnerability assessment against software and configurations.
For example:
Nmap → “What is exposed?”
Vulnerability scanner → “What known security weaknesses may exist in the exposed software?”
In professional security assessments, multiple tools may be used together.
Nmap NSE
Nmap also includes the Nmap Scripting Engine (NSE).
NSE allows scripts to extend Nmap’s functionality.
For example:
nmap –script <script-name> 192.168.1.10
NSE scripts can support tasks such as:
- Service discovery
- Configuration checks
- Authentication-related checks
- Network discovery
- Security auditing
Only use scripts against systems for which you have explicit authorization.
Nmap in a Kali Linux Lab
Nmap is particularly useful when learning cybersecurity in a controlled laboratory.
A safe beginner lab could contain:
Your Kali Linux
|
| Private Lab Network
|
+————-+
| Test Server |
+————-+
For example, you can create a virtual machine specifically for security training and assign it a private IP address.
Then scan only that machine:
nmap -sV <YOUR-LAB-IP>
This allows you to practice network enumeration without scanning systems that you do not control.
Best Practices When Using Nmap
Follow these principles when using Nmap:
- Get authorization before scanning.
- Scan only the IP addresses and systems included in your approved scope.
- Start with less intrusive discovery techniques.
- Avoid aggressive scans against production systems unless explicitly authorized.
- Keep records of scan results.
- Investigate unexpected open ports.
- Protect scan output because it may contain sensitive infrastructure information.
- Verify findings rather than assuming every detected service is vulnerable.
- Use a dedicated cybersecurity lab when learning.
- Follow your organization’s security policies and applicable laws.
Conclusion
Nmap is a powerful network discovery and security auditing tool that helps users understand what is connected to a network and which services are exposed.
For beginners, the most important commands to learn first are:
nmap <target>
nmap -sn <network>
nmap -p <port> <target>
nmap -sV <target>
sudo nmap -O <target>
The real value of Nmap is not simply finding open ports. It is using that information to build an accurate understanding of a network, identify unexpected exposure, and improve security.
If you are learning ethical hacking or cybersecurity, practice Nmap in a private lab or on systems where you have explicit permission to test.
