How to Use and Master the Nmap Command in Linux

Asif Khan |

Introduction

Nmap, short for Network Mapper, is a robust, open-source utility. Network Mapper is a sophisticated program for network discovery, security auditing, and service upgrade management. Network administrators and security professionals use it to scan systems, discover hosts, detect open ports, and locate networked services. Mastering nmap can help you diagnose network faults and improve network security.

This tutorial will walk you through the fundamentals, advanced capabilities, and best practices of using nmap on Linux.

Installation of Nmap

Most Linux distributions include nmap in their official repositories. To install it, use:

  • Debian/Ubuntu: sudo apt update sudo apt install nmap
  • CentOS/RHEL: sudo yum install nmap
  • Fedora/OEL: sudo dnf install nmap

Basic Usage

a. Scanning a Single Host


nmap <target>

Example:


nmap 192.168.100.10
Starting Nmap 7.92 ( https://nmap.org )
Nmap scan report for 192.168.100.10
Host is up (0.000013s latency).
Not shown: 999 closed tcp ports (reset)
PORT   STATE SERVICE
22/tcp open  ssh
Nmap done: 1 IP address (1 host up) scanned in 0.23 seconds

nmap 8.8.8.8
Starting Nmap 7.92 ( https://nmap.org )
Nmap scan report for dns.google (8.8.8.8)
Host is up (0.040s latency).
Not shown: 997 filtered tcp ports (no-response), 1 filtered tcp ports (net-unreach)
PORT    STATE SERVICE
53/tcp  open  domain
443/tcp open  https
Nmap done: 1 IP address (1 host up) scanned in 4.98 seconds

This command scans the default 1,000 ports on the target.

b. Scanning Multiple Hosts


nmap 192.168.1.1 192.168.1.2
nmap 192.168.1.1-10
nmap 192.168.1.*

nmap 8.8.8.8 8.8.4.4
Starting Nmap 7.92 ( https://nmap.org )
Nmap scan report for dns.google (8.8.8.8)
Host is up (0.056s latency).
Not shown: 997 filtered tcp ports (no-response), 1 filtered tcp ports (net-unreach)
PORT    STATE SERVICE
53/tcp  open  domain
443/tcp open  https

Nmap scan report for dns.google (8.8.4.4)
Host is up (0.056s latency).
Not shown: 998 filtered tcp ports (no-response)
PORT    STATE SERVICE
53/tcp  open  domain
443/tcp open  https
Nmap done: 2 IP addresses (2 hosts up) scanned in 18.76 seconds

c. Scanning a Range of IP Addresses


nmap 192.168.1.1-20

or


nmap 192.168.1.0/24

nmap 192.168.10.0/24
Starting Nmap 7.92 ( https://nmap.org )
Nmap scan report for 192.168.10.1
Host is up (0.014s latency).
Not shown: 995 closed tcp ports (reset)
PORT   STATE    SERVICE
21/tcp filtered ftp
22/tcp filtered ssh
23/tcp filtered telnet
53/tcp open     domain
80/tcp open     http
MAC Address: (New Technologies)

Nmap scan report for 192.168.10.50
Host is up (0.00070s latency).
Not shown: 998 filtered tcp ports (no-response)
PORT     STATE SERVICE
135/tcp  open  msrpc
2179/tcp open  vmrdp
MAC Address:

Nmap scan report for 192.168.10.60
Host is up (0.00070s latency).
All 1000 scanned ports on 192.168.10.60 are in ignored states.
Not shown: 1000 closed tcp ports (reset)
MAC Address:

Nmap scan report for 192.168.10.70
Host is up (0.0000090s latency).
Not shown: 999 closed tcp ports (reset)
PORT   STATE SERVICE
22/tcp open  ssh

Nmap done: 256 IP addresses (4 hosts up) scanned in 22.36 seconds

Port Scanning Techniques

a. Scan Specific Ports


nmap -p 22,80,443 192.168.10.1

Starting Nmap 7.92 ( https://nmap.org )
Nmap scan report for 192.168.10.1
Host is up (0.0016s latency).

PORT    STATE    SERVICE
22/tcp  filtered ssh
80/tcp  open     http
443/tcp closed   https
MAC Address: (New Technologies)

Nmap done: 1 IP address (1 host up) scanned in 1.39 seconds

b. Full Port Scan (1-65535)


nmap -p- 192.168.10.1
Starting Nmap 7.92 ( https://nmap.org )
Nmap scan report for 192.168.10.1
Host is up (0.020s latency).
Not shown: 65527 closed tcp ports (reset)
PORT      STATE    SERVICE
21/tcp    filtered ftp
22/tcp    filtered ssh
23/tcp    filtered telnet
80/tcp    open     http
17998/tcp open     unknown
37443/tcp open     unknown
37444/tcp open     unknown
Nmap done: 1 IP address (1 host up) scanned in 13.07 seconds

c. Fast Scan

Scan only the top 100 common ports:


nmap -F 192.168.10.1

Service and Version Detection

To detect running services and their versions:


nmap -sV 192.168.10.1
Starting Nmap 7.92 ( https://nmap.org )
Nmap scan report for 192.168.10.1
Host is up (0.0097s latency).
Not shown: 995 closed tcp ports (reset)
PORT   STATE    SERVICE  VERSION
21/tcp filtered ftp
22/tcp filtered ssh
23/tcp filtered telnet
80/tcp open     ssl/http
SF-Port53-TCP:V=7.92%I=7%D=1
SF:(DNSVersionBindReqTCP,44vers
SF:ion\x04bind\0\0\x10\0
SF:0\x0c\0\x02\0\x03\0\0
Service detection performed.
Nmap done: 1 IP address (1 host up) scanned in 18.15 seconds

Operating System Detection

Try to identify the target’s operating system:


nmap -O 192.168.10.1
Starting Nmap 7.92 ( https://nmap.org )
Nmap scan report for 192.168.10.1
Host is up (0.0012s latency).
Not shown: 999 closed tcp ports (reset)
PORT   STATE SERVICE
22/tcp open  ssh
Device type: general purpose
Running: Linux 4.X|5.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5
OS details: Linux 4.15 - 5.6
Network Distance: 1 hop
OS detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 1.79 seconds

Combine service and OS detection:


nmap -A 192.168.10.1
Starting Nmap 7.92 ( https://nmap.org )
Nmap scan report for 192.168.10.1
Host is up (0.00056s latency).
Not shown: 999 closed tcp ports (reset)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 9.6p1 Ubuntu 3ubuntu13.11 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   256 9f:90:98:f:1f:87:96:b3:73:e3:f1:8a:ee (ECDSA)
|_  256 35:55:ef:e:af:32:b2:c1:51:69:e4:30:e5 (ED25519)
Device type: general purpose
Running: Linux 4.X|5.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5
OS details: Linux 4.15 - 5.6
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
TRACEROUTE
HOP RTT     ADDRESS
1   0.56 ms 192.168.10.1
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 2.56 seconds

Advanced Scanning Options

a. Stealth Scan (SYN Scan)


sudo nmap -sS 192.168.1.1

b. UDP Scan


sudo nmap -sU 192.168.1.1
Starting Nmap 7.92 ( https://nmap.org )
Nmap scan report for 192.168.1.1
Host is up (0.000018s latency).
Not shown: 999 closed udp ports (port-unreach)
PORT     STATE         SERVICE
5353/udp open|filtered zeroconf
Nmap done: 1 IP address (1 host up) scanned in 1.34 seconds

c. Aggressive Scan


nmap -A 192.168.1.1
Starting Nmap 7.92 ( https://nmap.org )
Nmap scan report for 192.168.1.1
Host is up (0.000058s latency).
Not shown: 999 closed tcp ports (reset)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.7 (protocol 2.0)
| ssh-hostkey:
|   256 5c:c4:66:2b:70:e3:11:8b:13:14:03:88 (ECDSA)
|_  256 a0:80:d6:53:32:6c:c3:a8:25:e3:be:40 (ED25519)
Device type: general purpose
Running: Linux 2.6.X
OS CPE: cpe:/o:linux:linux_kernel:2.6.32
OS details: Linux 2.6.32
Network Distance: 0 hops
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 2.40 seconds

This enables OS detection, version detection, script scanning, and traceroute.

d. Using Nmap Scripts

Nmap has a powerful scripting engine (NSE):


nmap --script=default 192.168.1.1

Or use a specific script:


nmap --script=http-enum 192.168.1.1

Output Formats

  • Normal Output: (default)
  • Grepable Output: nmap -oG output.txt 192.168.1.1
  • XML Output: nmap -oX output.xml 192.168.1.1
  • All Formats: nmap -oA output 192.168.1.1
    List of files
    ls
    output.gnmap  output.nmap  output.txt  output.xml

Tips for Mastering Nmap

  • Practice Regularly: Try different scan types and options on test networks.
  • Read the Documentation: man nmap and the official Nmap documentation are invaluable.
  • Explore NSE Scripts: There are hundreds of scripts for various tasks—enumeration, vulnerability detection, brute force, etc.
  • Stay Legal: Only scan networks you own or have explicit permission to test.

Useful Nmap Examples

  • Scan all devices on your subnet: nmap -sn 192.168.1.0/24
  • Detect firewall rules: nmap -sA 192.168.1.1
  • Scan for vulnerabilities: nmap –script vuln 192.168.1.1

Conclusion

When it comes to auditing network security and exploring networks, Nmap is a strong and flexible tool. Gaining expertise requires consistent effort and a thirst for knowledge. You may quickly and easily map out networks, identify weaknesses, and protect your infrastructure if you are familiar with its many features and possibilities.

Always use Nmap in a responsible and ethical manner.

Asif Khan, author of LinuxPathfinder.com

Asif Khan

DevOps, Linux, and Cloud engineer with 10+ years building infrastructure that stays up, and automation so I do not have to fix it at 2am. My focus is automation, security, and systems built to survive failure, using Infrastructure as Code, CI/CD, containers, monitoring, and cloud platforms instead of manual fixes. This blog is where I write down what worked, and just as often what didn't the first time around. Real tutorials you can run yourself, troubleshooting notes pulled from actual outages, and the kind of detail you only get once you've hit the problem firsthand. If you're trying to get Linux, DevOps, and cloud infrastructure to behave, that's what you'll find here: reproducible solutions you can understand, test, and apply in your own environment.

Related Posts

getfacl output showing an ACL entry clipped by the mask, with the effective permissions annotation highlighted

Linux ACLs: setfacl, getfacl and the Mask Explained

Terminal showing curl output with X-Real-IP and X-Forwarded-Proto headers confirming nginx reverse proxy forwards the real client

How to Set Up Nginx as a Reverse Proxy (Ubuntu & RHEL)

Understanding the free Command in Linux

Understanding the free Command in Linux