Techzone/Nmap - Network Mapper

Nmap - Network Mapper

2 min readArticle

Nmap is the de facto standard for network discovery and security auditing. It discovers hosts, scans ports, detects services and OS versions, and can run scripted checks against targets. Every security professional uses it constantly.

Installation

bash 
sudo apt install nmap     # Debian/Kali
brew install nmap         # macOS
# Windows: download installer from nmap.org

Basic Scans

bash 
# Ping sweep (host discovery, no port scan)
nmap -sn 192.168.1.0/24

# Fast scan (top 100 ports)
nmap -F 192.168.1.1

# Default scan (top 1000 ports, SYN scan)
sudo nmap 192.168.1.1

# Scan specific ports
nmap -p 22,80,443,3389 192.168.1.1

# Scan all 65535 ports
nmap -p- 192.168.1.1

# Scan a range
nmap -p 1-1024 192.168.1.1

Scan Types

bash 
# SYN scan (stealth, doesn't complete handshake) — requires root
sudo nmap -sS 192.168.1.1

# TCP Connect scan (completes handshake, more detectable)
nmap -sT 192.168.1.1

# UDP scan (slow but important for DNS, SNMP, DHCP)
sudo nmap -sU 192.168.1.1

# Combine TCP and UDP
sudo nmap -sSU 192.168.1.1

Service and OS Detection

bash 
# Service version detection
nmap -sV 192.168.1.1

# OS detection
sudo nmap -O 192.168.1.1

# Aggressive scan (OS + version + scripts + traceroute)
sudo nmap -A 192.168.1.1

# Intensity of version detection (0-9)
nmap -sV --version-intensity 5 192.168.1.1

Nmap Scripts (NSE)

bash 
# Run default scripts
nmap -sC 192.168.1.1

# Specific script
nmap --script=http-title 192.168.1.1

# Run all vuln scripts
nmap --script=vuln 192.168.1.1

# SMB enumeration
nmap --script=smb-enum-shares,smb-enum-users 192.168.1.1

# HTTP enumeration
nmap --script=http-enum 192.168.1.1

# Check for EternalBlue (MS17-010)
nmap --script=smb-vuln-ms17-010 192.168.1.1

Output Formats

bash 
# Normal output
nmap -oN output.txt 192.168.1.0/24

# XML output (for tools)
nmap -oX output.xml 192.168.1.0/24

# Grepable format
nmap -oG output.gnmap 192.168.1.0/24

# All formats at once
nmap -oA scan_results 192.168.1.0/24

Timing and Evasion

bash 
# Timing templates T0 (paranoid) to T5 (insane)
nmap -T4 192.168.1.0/24   # Fast, common choice
nmap -T1 192.168.1.1       # Slow/stealthy

# Fragmented packets (evasion)
sudo nmap -f 192.168.1.1

# Decoy scan
sudo nmap -D RND:10 192.168.1.1

# Spoof source IP
sudo nmap -S 192.168.1.254 192.168.1.1

WiFi/Wireless Context

In wireless pen testing, Nmap is used after gaining access to the network to enumerate what's actually on it. Run a ping sweep first, then targeted port scans.

bash 
# Quick recon after joining target network
sudo nmap -sn 192.168.0.0/24           # Find live hosts
sudo nmap -sS -sV -T4 192.168.0.1     # Scan the router
sudo nmap -A --script=vuln 192.168.0.0/24  # Full vuln scan

See Also

  • scapy-packet-crafting - Lower-level packet crafting
  • netdiscover - ARP-based host discovery
  • tcpdump-packet-capture - Packet capture
techzonesite.comUnlock Your IT Potential