Nmap (Network Mapper) is the world's most widely used open-source network scanner. Created by Gordon Lyon (Fyodor) in 1997, it has become an essential tool for network administrators, security engineers, and penetration testers. Whether you need to map a network, discover running services, detect operating systems, or run vulnerability scripts — Nmap does it all.
This guide covers every major Nmap technique with real command examples you can run right now. We start with installation and basic host discovery, then move through all scan types, service detection, NSE scripting, evasion, and finish with professional pentest workflows. All scanning must be performed only on systems and networks you own or have explicit written authorization to test.
◈ Table of Contents
01 — WHAT IS NMAP & WHY IT MATTERS
BEGINNERNmap sends crafted packets to target hosts and analyzes responses to determine what is running and how. It operates at the network and transport layers, giving you visibility into host status, open ports, running services, software versions, and operating systems — all from a single tool.
Network Discovery
Map every live host on a subnet, identify devices, and build a complete network inventory.
Port Auditing
Identify open, filtered, and closed TCP/UDP ports across thousands of hosts simultaneously.
Service Detection
Detect exact software versions (Apache 2.4.54, OpenSSH 9.2) running on every open port.
OS Fingerprinting
Identify the underlying OS and kernel version of remote targets using TCP/IP stack analysis.
Vulnerability Scanning
Run NSE scripts to check for known CVEs, misconfigurations, and exposed services.
Compliance Auditing
Verify that only authorized ports and services are exposed across production networks.
Nmap scanning without authorization violates computer crime laws in most jurisdictions including the Computer Fraud and Abuse Act (US), Computer Misuse Act (UK), and equivalent legislation worldwide. Always obtain written permission before scanning any network or host you do not own.
02 — INSTALLATION ON ALL PLATFORMS
BEGINNERNmap comes pre-installed on Kali Linux. On Debian/Ubuntu-based systems, install it from the official repositories. Always verify the installed version — features vary significantly between releases.
Nmap runs natively on macOS via Homebrew or the official installer, and on Windows via the official binary installer from nmap.org which includes the Zenmap GUI and Npcap packet capture driver.
On Windows, always run Nmap from an elevated Command Prompt (Run as Administrator). Without admin rights, raw socket scanning (-sS, -sN, -sF, -sX) won't work — Nmap falls back to TCP Connect scans (-sT) automatically.
03 — HOST DISCOVERY & PING SWEEPS
BEGINNERBefore port scanning, you need to know which hosts are alive. Nmap provides several host discovery methods — each with different detection rates and noise profiles. Understanding these is critical for effective network reconnaissance.
Nmap accepts multiple target formats. You can specify single IPs, ranges, CIDR subnets, and hostname lists — or combine them in a single command.
By default, Nmap sends ICMP echo requests, TCP SYN to port 443, TCP ACK to port 80, and ICMP timestamp requests. You can customize this per-environment for better results.
-sn— Ping scan only, no port scan (fast subnet sweep)-Pn— Skip host discovery, treat all targets as alive-PE— ICMP echo request (standard ping)-PS[ports]— TCP SYN ping to specified ports-PA[ports]— TCP ACK ping (firewall bypass)-PR— ARP ping (LAN only, most reliable)-n— Never do DNS resolution (speeds up scanning)
04 — PORT SCANNING TECHNIQUES
INTERMEDIATEPort scanning is Nmap's core function. Each scan type uses different packet crafting to determine port state. Choosing the right scan type impacts stealth, accuracy, and what information you receive from targets.
The TCP SYN scan (half-open scan) is Nmap's default scan type when run as root/administrator. It sends a SYN packet and waits for a response. An SYN-ACK means open; RST means closed; no response means filtered. Because Nmap never completes the three-way handshake, many older firewalls and IDS systems miss these connections.
The TCP Connect scan completes the full three-way handshake. It doesn't require root privileges because it uses the OS's connect() system call. It's less stealthy than SYN scans (connections are fully logged), but it's the only option when raw socket access is unavailable.
UDP scanning is slower than TCP but critical — many high-value services run on UDP: DNS (53), SNMP (161/162), DHCP (67/68), NTP (123), TFTP (69). A host may have no TCP vulnerabilities but be wide open on UDP.
UDP scans are slow because Nmap waits for ICMP "port unreachable" responses. Add --min-rate 5000 to speed up large UDP sweeps, but accept less accuracy on congested networks.
These scans exploit an RFC 793 TCP specification: ports that receive packets with no matching connection should respond to unexpected flags with RST (closed) or not respond at all (open/filtered). They can evade non-stateful packet filters but don't work against Windows targets.
NULL, FIN, and Xmas scans return open|filtered for open ports — you can't distinguish between them. Use with service detection (-sV) or follow up with -sS/-sT to confirm open ports.
Precise port targeting is essential for efficient scanning. Nmap gives you multiple ways to specify which ports to scan.
Nmap reports 6 different port states. Understanding what each means is critical for accurate interpretation of scan results.
| State | Meaning | Action |
|---|---|---|
| open | Service is actively accepting connections | Investigate further — identify service/version |
| closed | Port is accessible but no service is listening | May become open in future — worth re-scanning |
| filtered | Firewall/filter is blocking probe packets | Can't determine open/closed — try other probes |
| unfiltered | Port is accessible, state unknown (ACK scan only) | Use SYN/Connect scan to determine open/closed |
| open|filtered | Can't determine if open or filtered | Occurs with UDP, NULL, FIN, Xmas scans |
| closed|filtered | Can't determine if closed or filtered | Rare — occurs with IP ID Idle scan |
05 — SERVICE & OS DETECTION
INTERMEDIATEService detection probes open ports with a series of banner grabs and protocol-specific handshakes, then compares responses against a database of 11,000+ service fingerprints. This reveals exact software names and versions — essential for vulnerability assessment.
The version string from -sV directly tells you what CVEs apply. Copy it into a vulnerability database search (NIST NVD, Vulners, Exploit-DB) to find known issues with that exact software version.
OS detection analyzes subtle TCP/IP stack implementation differences (window size, TTL, TCP options ordering, etc.) and compares them against Nmap's OS fingerprint database. It requires at least one open and one closed TCP port to work accurately.
The -A flag enables OS detection (-O), version detection (-sV), script scanning (-sC), and traceroute (--traceroute) all at once. It's the most information-dense single command in Nmap — ideal when you want comprehensive results quickly on a target you're authorized to scan.
-A generates significantly more traffic than basic scans. Modern IDS/IPS systems will detect and alert on aggressive scans. Use carefully in authorized environments and never in time-sensitive stealth operations.
06 — NMAP SCRIPTING ENGINE (NSE)
INTERMEDIATE → ADVANCEDThe Nmap Scripting Engine (NSE) lets you run Lua scripts against targets to automate network discovery and vulnerability checking. Nmap ships with 600+ scripts covering everything from banner grabbing to exploit verification.
NSE scripts are organized into categories. You can run scripts by name, category, or pattern. The default script scan (-sC) runs all scripts in the "default" category, which includes safe and useful discovery scripts.
| Category | Description | Risk Level |
|---|---|---|
| default | Safe scripts for common service enumeration | Low |
| discovery | Active network and service discovery | Low |
| safe | Scripts unlikely to crash services | Very Low |
| vuln | Check for known vulnerabilities | Medium |
| auth | Test authentication mechanisms | Medium |
| brute | Credential brute-forcing | High |
| exploit | Actively exploit vulnerabilities | Critical |
| intrusive | May crash or impact services | High |
These are the most valuable NSE scripts for security assessments, organized by service. Each targets a common attack surface and produces actionable intelligence.
The vulners NSE script requires internet access to query the Vulners.com CVE database. Run it after service detection (-sV) for best results — it maps detected version strings directly to known CVEs with CVSS scores.
Many scripts accept arguments to customize behavior — credentials, URIs, wordlists, and more.
07 — TIMING TEMPLATES & EVASION
INTERMEDIATE → ADVANCEDNmap's timing templates control how aggressively it scans. Faster scans are louder and more easily detected. Slower scans evade rate-based detection but take significantly longer to complete.
| Template | Name | Description | Best For |
|---|---|---|---|
| -T0 | Paranoid | 5 minute inter-probe delay, serial scanning. Near-undetectable by rate-based IDS. | Extreme stealth |
| -T1 | Sneaky | 15 second delay between probes. Very slow, avoids most IDS detection. | High stealth |
| -T2 | Polite | 0.4 second delay. Slow scan that minimizes network impact. | Low bandwidth targets |
| -T3 | Normal | Default timing. Parallel scanning, no artificial delays. | General use |
| -T4 | Aggressive | Faster scan, assumes fast/reliable network. Recommended for LAN pentests. | Fast internal scans |
| -T5 | Insane | Maximum speed, sacrifices accuracy. May miss open ports on busy targets. | CTF / home labs only |
For precision control beyond templates, use individual timing parameters. These let you define exact rates, timeouts, and parallelism levels independent of the template presets.
Modern firewalls and IDS systems can detect standard Nmap scans. These techniques make scanning harder to attribute and detect — all for use in authorized engagements only.
IP spoofing (-S) without proper routing makes Nmap blind to responses — only use it with decoys (-D) that don't include ME, or in combination with a sniffer on the network. Source port spoofing (--source-port 53) is effective against misconfigured firewalls but obvious to modern IDS.
08 — OUTPUT FORMATS & REPORTING
BEGINNERAlways save Nmap output during authorized assessments. Different formats serve different downstream tools — XML for automation, grepable for shell scripting, normal for reading.
Control how much information Nmap prints during scanning. Verbosity is useful for long scans where you want real-time feedback.
09 — PROFESSIONAL PENTEST WORKFLOW
ADVANCEDIn a real penetration test, scanning is structured in phases. Rushing to an aggressive -A scan immediately wastes time and generates unnecessary noise. Follow this reconnaissance workflow for efficient, methodical coverage.
Start by mapping which hosts are alive. Never skip this — scanning dead IPs wastes time and the noise from port scanning offline hosts can look suspicious.
Scan the most common 1000 ports across all live hosts first. This gives broad coverage fast and identifies low-hanging fruit before deeper inspection.
After identifying interesting targets from the survey, run a full 65535-port scan on those specific hosts to find non-standard services hiding on unusual ports.
Now that you know which ports are open, get exact versions. This feeds directly into CVE lookup and exploit selection.
With services identified, run targeted scripts. Use the vulners script and service-specific scripts to check for known CVEs and misconfigurations.
10 — COMPLETE FLAG CHEAT SHEET
QUICK REFERENCE| Flag | Name | Notes |
|---|---|---|
| -sS | TCP SYN | Default (root). Half-open, stealthy. |
| -sT | TCP Connect | Full connection. No root needed. |
| -sU | UDP | Slow. Requires root. |
| -sN | NULL | No TCP flags. Bypasses stateless filters. |
| -sF | FIN | Only FIN flag. Same use as NULL. |
| -sX | Xmas | FIN+PSH+URG. Doesn't work on Windows. |
| -sA | ACK | Maps firewall rules, not port state. |
| -sn | Ping Only | Host discovery, no port scan. |
| Flag | Description |
|---|---|
| -sV | Service/version detection |
| -O | OS fingerprinting (root) |
| -A | Aggressive: -O -sV -sC --traceroute |
| -sC | Default NSE scripts |
| --script=NAME | Run specific NSE script(s) |
| --script-args KEY=VAL | Pass arguments to scripts |
| --script-help NAME | Get help for a script |
| Flag | Description |
|---|---|
| -p 80,443 | Specific ports |
| -p 1-1024 | Port range |
| -p- | All 65535 ports |
| --top-ports N | Top N most common ports |
| -p T:80,U:53 | Protocol-prefixed ports |
| --open | Show only open ports |
| Flag | Description |
|---|---|
| -T0 to -T5 | Timing template (T0=slowest, T5=fastest) |
| --min-rate N | Send at least N packets/sec |
| --max-rate N | Don't exceed N packets/sec |
| --max-retries N | Cap retransmissions |
| --host-timeout N | Give up on host after N seconds |
| Flag | Description |
|---|---|
| -f | Fragment packets (8 bytes) |
| --mtu N | Custom fragment size (multiple of 8) |
| -D IP1,IP2,ME | Decoy scan — blend into fake IPs |
| -D RND:N | N random decoy IPs |
| --source-port N | Spoof source port |
| --spoof-mac 0 | Random MAC address |
| --randomize-hosts | Randomize host scan order |
| --data-length N | Append N random bytes to packets |
| Flag | Description |
|---|---|
| -oN FILE | Normal (human readable) |
| -oX FILE | XML (tool integration) |
| -oG FILE | Grepable (grep/awk processing) |
| -oA BASENAME | All three formats simultaneously |
| -v / -vv | Verbose / extra verbose |
| --reason | Show reason for port state |
| --open | Only show open ports |
All scanning techniques covered in this tutorial must only be used on systems and networks you own or have explicit written permission to test. Unauthorized scanning violates computer crime laws in most jurisdictions. CyberHawk Threat Intel and the author accept no responsibility for unauthorized use of these techniques.
- Metasploit Framework — turn Nmap findings into exploitation
- Masscan — ultra-fast alternative for large-scale surveys
- Nessus / OpenVAS — dedicated vulnerability scanner for deeper CVE coverage
- CyberHawk Threat Intel SOPs — structured incident response for when findings escalate
◈ Stay Connected
Follow CyberHawk Threat Intel for threat intelligence, penetration testing tutorials, and hands-on SOC tooling content.
"They can't exploit you if you are the Exploit."