Introduction
Nmap, short for Network Mapper, is a robust, open-source utility. Network Mapper is a sophisticated program for network discovery, security auditing, and service upgrade management. Network administrators and security professionals use it to scan systems, discover hosts, detect open ports, and locate networked services. Mastering nmap can help you diagnose network faults and improve network security.
This tutorial will walk you through the fundamentals, advanced capabilities, and best practices of using nmap on Linux.
Installation of Nmap
Most Linux distributions include nmap in their official repositories. To install it, use:
- Debian/Ubuntu: sudo apt update sudo apt install nmap
- CentOS/RHEL: sudo yum install nmap
- Fedora/OEL: sudo dnf install nmap
Basic Usage
a. Scanning a Single Host
nmap <target>
Example:
nmap 192.168.100.10 Starting Nmap 7.92 ( https://nmap.org ) Nmap scan report for 192.168.100.10 Host is up (0.000013s latency). Not shown: 999 closed tcp ports (reset) PORT STATE SERVICE 22/tcp open ssh Nmap done: 1 IP address (1 host up) scanned in 0.23 seconds nmap 8.8.8.8 Starting Nmap 7.92 ( https://nmap.org ) Nmap scan report for dns.google (8.8.8.8) Host is up (0.040s latency). Not shown: 997 filtered tcp ports (no-response), 1 filtered tcp ports (net-unreach) PORT STATE SERVICE 53/tcp open domain 443/tcp open https Nmap done: 1 IP address (1 host up) scanned in 4.98 seconds
This command scans the default 1,000 ports on the target.
b. Scanning Multiple Hosts
nmap 192.168.1.1 192.168.1.2 nmap 192.168.1.1-10 nmap 192.168.1.* nmap 8.8.8.8 8.8.4.4 Starting Nmap 7.92 ( https://nmap.org ) Nmap scan report for dns.google (8.8.8.8) Host is up (0.056s latency). Not shown: 997 filtered tcp ports (no-response), 1 filtered tcp ports (net-unreach) PORT STATE SERVICE 53/tcp open domain 443/tcp open https Nmap scan report for dns.google (8.8.4.4) Host is up (0.056s latency). Not shown: 998 filtered tcp ports (no-response) PORT STATE SERVICE 53/tcp open domain 443/tcp open https Nmap done: 2 IP addresses (2 hosts up) scanned in 18.76 seconds
c. Scanning a Range of IP Addresses
nmap 192.168.1.1-20
or
nmap 192.168.1.0/24 nmap 192.168.10.0/24 Starting Nmap 7.92 ( https://nmap.org ) Nmap scan report for 192.168.10.1 Host is up (0.014s latency). Not shown: 995 closed tcp ports (reset) PORT STATE SERVICE 21/tcp filtered ftp 22/tcp filtered ssh 23/tcp filtered telnet 53/tcp open domain 80/tcp open http MAC Address: (New Technologies) Nmap scan report for 192.168.10.50 Host is up (0.00070s latency). Not shown: 998 filtered tcp ports (no-response) PORT STATE SERVICE 135/tcp open msrpc 2179/tcp open vmrdp MAC Address: Nmap scan report for 192.168.10.60 Host is up (0.00070s latency). All 1000 scanned ports on 192.168.10.60 are in ignored states. Not shown: 1000 closed tcp ports (reset) MAC Address: Nmap scan report for 192.168.10.70 Host is up (0.0000090s latency). Not shown: 999 closed tcp ports (reset) PORT STATE SERVICE 22/tcp open ssh Nmap done: 256 IP addresses (4 hosts up) scanned in 22.36 seconds
Port Scanning Techniques
a. Scan Specific Ports
nmap -p 22,80,443 192.168.10.1 Starting Nmap 7.92 ( https://nmap.org ) Nmap scan report for 192.168.10.1 Host is up (0.0016s latency). PORT STATE SERVICE 22/tcp filtered ssh 80/tcp open http 443/tcp closed https MAC Address: (New Technologies) Nmap done: 1 IP address (1 host up) scanned in 1.39 seconds
b. Full Port Scan (1-65535)
nmap -p- 192.168.10.1 Starting Nmap 7.92 ( https://nmap.org ) Nmap scan report for 192.168.10.1 Host is up (0.020s latency). Not shown: 65527 closed tcp ports (reset) PORT STATE SERVICE 21/tcp filtered ftp 22/tcp filtered ssh 23/tcp filtered telnet 80/tcp open http 17998/tcp open unknown 37443/tcp open unknown 37444/tcp open unknown Nmap done: 1 IP address (1 host up) scanned in 13.07 seconds
c. Fast Scan
Scan only the top 100 common ports:
nmap -F 192.168.10.1
Service and Version Detection
To detect running services and their versions:
nmap -sV 192.168.10.1 Starting Nmap 7.92 ( https://nmap.org ) Nmap scan report for 192.168.10.1 Host is up (0.0097s latency). Not shown: 995 closed tcp ports (reset) PORT STATE SERVICE VERSION 21/tcp filtered ftp 22/tcp filtered ssh 23/tcp filtered telnet 80/tcp open ssl/http SF-Port53-TCP:V=7.92%I=7%D=1 SF:(DNSVersionBindReqTCP,44vers SF:ion\x04bind\0\0\x10\0 SF:0\x0c\0\x02\0\x03\0\0 Service detection performed. Nmap done: 1 IP address (1 host up) scanned in 18.15 seconds
Operating System Detection
Try to identify the target’s operating system:
nmap -O 192.168.10.1 Starting Nmap 7.92 ( https://nmap.org ) Nmap scan report for 192.168.10.1 Host is up (0.0012s latency). Not shown: 999 closed tcp ports (reset) PORT STATE SERVICE 22/tcp open ssh Device type: general purpose Running: Linux 4.X|5.X OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 OS details: Linux 4.15 - 5.6 Network Distance: 1 hop OS detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 1.79 seconds
Combine service and OS detection:
nmap -A 192.168.10.1 Starting Nmap 7.92 ( https://nmap.org ) Nmap scan report for 192.168.10.1 Host is up (0.00056s latency). Not shown: 999 closed tcp ports (reset) PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 9.6p1 Ubuntu 3ubuntu13.11 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 256 9f:90:98:f:1f:87:96:b3:73:e3:f1:8a:ee (ECDSA) |_ 256 35:55:ef:e:af:32:b2:c1:51:69:e4:30:e5 (ED25519) Device type: general purpose Running: Linux 4.X|5.X OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 OS details: Linux 4.15 - 5.6 Network Distance: 1 hop Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel TRACEROUTE HOP RTT ADDRESS 1 0.56 ms 192.168.10.1 OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 2.56 seconds
Advanced Scanning Options
a. Stealth Scan (SYN Scan)
sudo nmap -sS 192.168.1.1
b. UDP Scan
sudo nmap -sU 192.168.1.1 Starting Nmap 7.92 ( https://nmap.org ) Nmap scan report for 192.168.1.1 Host is up (0.000018s latency). Not shown: 999 closed udp ports (port-unreach) PORT STATE SERVICE 5353/udp open|filtered zeroconf Nmap done: 1 IP address (1 host up) scanned in 1.34 seconds
c. Aggressive Scan
nmap -A 192.168.1.1 Starting Nmap 7.92 ( https://nmap.org ) Nmap scan report for 192.168.1.1 Host is up (0.000058s latency). Not shown: 999 closed tcp ports (reset) PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.7 (protocol 2.0) | ssh-hostkey: | 256 5c:c4:66:2b:70:e3:11:8b:13:14:03:88 (ECDSA) |_ 256 a0:80:d6:53:32:6c:c3:a8:25:e3:be:40 (ED25519) Device type: general purpose Running: Linux 2.6.X OS CPE: cpe:/o:linux:linux_kernel:2.6.32 OS details: Linux 2.6.32 Network Distance: 0 hops OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 2.40 seconds
This enables OS detection, version detection, script scanning, and traceroute.
d. Using Nmap Scripts
Nmap has a powerful scripting engine (NSE):
nmap --script=default 192.168.1.1
Or use a specific script:
nmap --script=http-enum 192.168.1.1
Output Formats
- Normal Output: (default)
- Grepable Output: nmap -oG output.txt 192.168.1.1
- XML Output: nmap -oX output.xml 192.168.1.1
- All Formats: nmap -oA output 192.168.1.1
List of files
ls
output.gnmap output.nmap output.txt output.xml
Tips for Mastering Nmap
- Practice Regularly: Try different scan types and options on test networks.
- Read the Documentation: man nmap and the official Nmap documentation are invaluable.
- Explore NSE Scripts: There are hundreds of scripts for various tasks—enumeration, vulnerability detection, brute force, etc.
- Stay Legal: Only scan networks you own or have explicit permission to test.
Useful Nmap Examples
- Scan all devices on your subnet: nmap -sn 192.168.1.0/24
- Detect firewall rules: nmap -sA 192.168.1.1
- Scan for vulnerabilities: nmap –script vuln 192.168.1.1
Conclusion
When it comes to auditing network security and exploring networks, Nmap is a strong and flexible tool. Gaining expertise requires consistent effort and a thirst for knowledge. You may quickly and easily map out networks, identify weaknesses, and protect your infrastructure if you are familiar with its many features and possibilities.
Always use Nmap in a responsible and ethical manner.
