Nmap 7.991

Nmap has been the standard network scanner since 1997. It discovers hosts, enumerates open ports, identifies services and their versions, fingerprints operating systems, and runs scripted checks through NSE.

Legal reality first

Scan networks you own or have written permission to scan. Port scanning third-party infrastructure is, depending on jurisdiction, somewhere between a terms-of-service violation and a criminal offence, and “I was just looking” has not historically been a successful defence.

For practice, the Nmap project maintains scanme.nmap.org explicitly for this purpose.

The scans people actually run

# What is alive on this subnet, no port scan
nmap -sn 192.168.1.0/24

# Default scan: top 1000 TCP ports
nmap 192.168.1.10

# Service and version detection, OS fingerprint, default scripts
nmap -sV -O -sC 192.168.1.10

# All 65535 TCP ports, faster timing, on a network you control
nmap -p- -T4 192.168.1.10

# UDP is slow and worth it occasionally
sudo nmap -sU --top-ports 20 192.168.1.10

Version detection with -sV is where Nmap earns its reputation. Knowing a port is open tells you little; knowing it is running a specific version of a specific service tells you whether it needs patching.

NSE

The Nmap Scripting Engine is what turns a port scanner into an auditing tool. Scripts cover service enumeration, default credential checks, and known vulnerability detection.

# What TLS ciphers does this server accept
nmap --script ssl-enum-ciphers -p 443 example.com

# HTTP header and method checks
nmap --script http-headers,http-methods -p 80,443 example.com

Auditing your own machines

The most useful application for most people is checking what their own systems expose. It is common to discover a service listening on all interfaces that was supposed to be bound to localhost.

# From another machine on the network
nmap -sV yourserver.local

# Compare against what the host thinks it is listening on
ss -tlnp

A discrepancy between those two is worth investigating. Our guide to checking open ports on Linux covers the local side, and Linux firewall basics covers closing what you find.

Verify Your Download

Nmap releases are signed, with detached signatures and checksums published on the download page.