Nmap (Network Mapper) is a powerful, open-source tool for network discovery and security auditing. It helps system administrators and security professionals identify active hosts, discover open ports, detect running services, estimate operating systems, and investigate potential security weaknesses.

Nmap can be used for legitimate security assessments or malicious reconnaissance. Only scan networks and systems you own or have explicit permission to test. Unauthorized scanning can violate organizational policies, service agreements, or applicable laws, depending on the circumstances and jurisdiction.

In this guide, we'll cover 15 useful Nmap commands, from basic host discovery to more advanced scanning and reporting techniques.

Before You Start

Install Nmap if it isn't already available on your system:

# Ubuntu/Debian
sudo apt update && sudo apt install nmap

# macOS with Homebrew
brew install nmap

Some scans require elevated privileges to send and inspect raw network packets. Running Nmap with sudo on Linux or macOS enables features such as TCP SYN scanning and OS detection. However, not every Nmap command requires root privileges. Without the necessary privileges, Nmap may use alternative scanning methods. Nmap

A basic understanding of TCP/IP, ports, routing, and firewalls will help you interpret the results.

For the examples below, 192.168.1.0/24 represents a sample local subnet. Replace it with your authorized target.

1. Discover Active Hosts on a Network

To identify devices responding to host-discovery probes on a subnet, use:

$ sudo nmap -sn 192.168.1.0/24

The -sn option performs host discovery without a subsequent port scan. Nmap attempts to identify which hosts are reachable using probes appropriate to the network and privileges available.

On a typical local Ethernet network, Nmap can use ARP requests for IPv4 host discovery.

Important: A host that does not respond may still be online. Firewalls, network filtering, and disabled discovery responses can prevent Nmap from detecting a device. Nmap

Disable DNS Resolution

To avoid reverse DNS lookups and potentially speed up scanning, add -n:

$ sudo nmap -sn -n 192.168.1.0/24

The -n option disables DNS resolution. It does not change the purpose of the host-discovery scan.

Note: -sP is the legacy name for -sn. Use -sn in new commands.

2. Scan for Open Ports

To scan a subnet for common TCP ports, run:

$ sudo nmap 192.168.1.0/24

By default, Nmap performs host discovery and scans the 1,000 most common TCP ports on hosts it considers online. When privileges allow, it normally uses a TCP SYN scan; otherwise, it may use a TCP connect scan. Nmap

Example output:

Nmap scan report for 192.168.1.109
Host is up.

PORT      STATE SERVICE
3283/tcp  open  netassistant
3689/tcp  open  rendezvous
5000/tcp  open  upnp
7000/tcp  open  afs3-fileserver
49153/tcp open  unknown

The output identifies ports Nmap found interesting, along with their states and its best-known service-name mappings.

A port listed as open indicates that an application is accepting connections or otherwise responding in a way consistent with an active service. The service name is an initial identification, not necessarily a verified application or version.

3. List Target IP Addresses and Resolve Hostnames

To list the targets in a subnet and attempt to resolve their hostnames, use:

$ nmap -sL 192.168.1.0/24

The -sL option performs a list scan. It lists the target addresses without performing host discovery or a port scan. By default, Nmap attempts reverse DNS resolution to find associated hostnames. Nmap

Example:

Nmap scan report for 192.168.1.1
Nmap scan report for sun (192.168.1.110)
Nmap scan report for pipe (192.168.1.185)
Nmap scan report for pluto (192.168.1.212)

Hostnames can provide useful clues about a network's structure, device roles, and naming conventions.

However, a listed hostname does not prove that the corresponding host is online. This command lists targets rather than discovering active devices.

4. Detect the Operating System

Nmap can estimate a target's operating system by analyzing how its network stack responds to particular probes.

$ sudo nmap -O 192.168.1.152

The -O option enables OS detection.

Example output:

OS details: Apple macOS or iOS
Network Distance: 1 hop

The actual output depends on the target and the evidence Nmap collects.

OS detection is not always accurate. Results depend on factors such as available ports, network conditions, filtering, and how closely the target's TCP/IP behavior matches known fingerprints.

Use this option only on systems you are authorized to assess.

5. Show Only Open or Potentially Open Ports

To suppress most closed and filtered ports from the results, use:

$ sudo nmap --open 192.168.1.107

You can also scan an authorized hostname:

$ sudo nmap --open example.com

The --open option limits the displayed port results to open ports and certain potentially open states, including open|filtered and unfiltered.

This is useful when auditing a system with many scanned ports and you want to focus on potentially relevant findings.

Remember that a port reported as potentially open is not necessarily confirmed to be open.

6. Scan TCP and UDP Ports

TCP and UDP are different transport protocols, so checking one does not cover the other.

To scan common ports using both protocols, run:

$ sudo nmap -sS -sU -Pn 192.168.1.107

This command combines three options:

• -sS: Performs a TCP SYN scan.
• -sU: Performs a UDP scan.
• -Pn: Skips host discovery and treats the target as online for scanning purposes.

UDP scanning can take considerably longer than TCP scanning because many UDP services do not respond to empty or unexpected probes. A lack of response may cause Nmap to report a port as open|filtered rather than confirm that it is open. nmap.org

Why scan both protocols? Services such as HTTPS commonly use TCP, while services such as NTP use UDP. An assessment that ignores UDP can miss services that matter to network security.

7. Scan All TCP and UDP Ports

By default, Nmap does not scan every port. To scan the full port range for both TCP and UDP, use:

$ sudo nmap -sS -sU -Pn -p 1-65535 192.168.1.107

The -p 1-65535 option specifies ports 1 through 65535 for each selected transport protocol.

For a TCP-only scan, the shorter equivalent is:

$ sudo nmap -sS -Pn -p- 192.168.1.107

A full scan can take considerably longer than a default scan, particularly when UDP is included or firewalls silently drop probes.

Tip: Start with common ports and expand the scan range when your assessment requires broader coverage.

8. Perform a TCP Connect Scan

To perform a TCP connect scan, use:

$ nmap -sT 192.168.1.222

The -sT option asks the operating system to establish TCP connections using its normal networking interface.

Unlike a SYN scan, which can examine a connection attempt without completing the full TCP handshake, a connect scan completes the handshake when a port is open.

This method is useful when raw-packet scanning is unavailable. However, it may generate more connection activity and take longer than a SYN scan. Neither method is guaranteed to go unnoticed. Nmap

9. Perform an Aggressive Scan

For a more comprehensive initial assessment of an authorized target, use:

$ sudo nmap -T4 -A 192.168.1.107

The -A option enables several features:

• OS detection
• Service and version detection
• Default script scanning
• Traceroute

The -T4 option selects a faster timing profile suitable for many reliable networks.

Nmap's timing templates range from -T0 (slowest) through -T5 (fastest). Faster settings can increase the chance of missed results on congested or unreliable networks. Nmap

Important: Aggressive scanning generates additional probes and can be more noticeable to monitoring systems. It is not a guarantee of complete vulnerability detection.

10. Detect Service Versions

To identify the services and versions associated with open ports, use:

$ sudo nmap -sV 192.168.1.117

Example output:

PORT    STATE SERVICE VERSION
22/tcp  open  ssh     OpenSSH
25/tcp  open  smtp    Postfix
80/tcp  open  http    nginx
443/tcp open  https   nginx

The -sV option enables service and version detection. Nmap sends additional probes to open ports and analyzes the responses to identify the software providing each service.

This information is useful during security audits because it helps administrators identify outdated or unsupported software.

However, version detection is not infallible. Services may hide or misreport version information, and the version alone does not establish whether a system is vulnerable.

Use verified software versions, vendor security advisories, and reliable vulnerability databases to assess potential risks. Nmap's version detection is an information-gathering step, not a complete vulnerability assessment.

11. Perform a Fast Scan

To scan a smaller set of commonly used ports, use:

$ nmap -F example.com

The -F option enables fast mode, reducing the number of ports scanned to the 100 most common ports in Nmap's port-frequency database.

For an authorized IPv6 target:

$ nmap -6 -F 2001:db8::10

Replace the example IPv6 address with your actual target.

Fast scans are useful for quick checks, but they do not examine every port. A service running on an uncommon port may be missed.

12. Understand Decoy Scanning

Nmap supports decoy scanning through the -D option. This causes a target to see scan traffic that appears to originate from multiple source addresses.

For example, an authorized lab test could use:

$ sudo nmap -D 192.0.2.10,192.0.2.20,ME 192.0.2.100

Here, ME represents the real scanning system, while the other addresses are specified as decoys. The addresses above belong to documentation ranges and are illustrative, not operational targets.

Decoy scanning does not guarantee anonymity or prevent attribution. Network operators may be able to identify the real scanner through traffic analysis, routing information, or other evidence. Decoy traffic can also affect systems whose addresses are used without their owners' involvement.

For routine security auditing, standard scans with clear authorization and identifiable source addresses are generally easier to investigate and document.

13. Increase Verbosity

To see more information about a scan as it runs, add -v or -vv:

$ sudo nmap -vv -Pn -F 192.168.1.107

• -v: Increases the amount of information displayed.
• -vv: Enables a higher verbosity level.
• -Pn: Skips host discovery.
• -F: Scans the 100 most common ports.

Verbose output can provide additional details about scan progress, discovered ports, and estimated completion times.

It is especially useful when troubleshooting slow scans or investigating why a target is not responding as expected. Nmap

14. Save Scan Results in Multiple Formats

To save scan results in several formats, use:

$ sudo nmap -p- -oA logs/network-scan 192.168.1.107

The -oA option saves the results in three formats:

The logs/ directory must already exist, or you should create it first:

$ mkdir -p logs

Saving results makes it easier to compare scans over time, document security assessments, and investigate changes in exposed services. XML is particularly useful when another tool needs to process the results. Nmap

15. Scan Specific Ports

You do not always need to scan every port. To check a selected group of ports or a specific range, use -p.

For example:

$ sudo nmap -sV -p 22,80,443,8000-8100 192.168.1.107

This command:

• Checks TCP ports 22, 80, and 443.
• Scans TCP ports 8000 through 8100.
• Uses -sV to identify the services and versions detected on open ports.

You can also scan a specific UDP port:

$ sudo nmap -sU -p 53 192.168.1.107

This checks UDP port 53, commonly used for DNS.

Specifying ports allows you to focus on services relevant to your audit and avoid spending time scanning unrelated ports.

Understanding Nmap Port States

Nmap uses several states to describe what it can determine about a port. These states reflect the responses received from the target or intervening network devices; they do not always reveal the complete situation on the target system. Nmap

These distinctions matter when interpreting results. For example, filtered does not mean a port is closed, and open|filtered does not confirm that an application is listening.

Nmap simplifies network discovery and security auditing by identifying active hosts, open ports, services, and operating systems. Remember, an open port doesn't automatically mean a vulnerability, and a clean scan doesn't guarantee security.

Use Nmap responsibly and scan only authorized systems.

Thank you for reading!

Official Nmap Documentation

For more details, consult the official documentation:

• Host Discovery
• Port Scanning Techniques
• Service and Version Detection
• Nmap Output Formats
• Nmap Reference Guide