LangStop

The Linux nmap Command: Seeing Your Network

The Linux nmap Command: Seeing Your Network

We were auditing our network security. My boss said "run nmap." I typed "nmap 192.168.1.0/24" and got 50 pages of output. Most of it was useless to me.

I didn't know how to filter, or which scan types to use. Let me save you that learning curve.

First nmap Scan

Basic ping scan

nmap 192.168.1.1

Simple port scan.

Scan all hosts in subnet

nmap 192.168.1.0/24

Entire local network.

Scan multiple hosts

nmap 192.168.1.1 192.168.1.10 192.168.1.20

Specific hosts.

Scan Types

SYN scan (requires root)

sudo nmap -sS 192.168.1.1

Fast but requires root.

TCP connect scan

nmap -sT 192.168.1.1

Slower but doesn't require root.

UDP scan

sudo nmap -sU 192.168.1.1

Slower but finds UDP services.

Port Selection

Common ports

nmap -F 192.168.1.1

Top 100 ports.

Specific ports

nmap -p 22,80,443 192.168.1.1

SSH, HTTP, HTTPS.

Port range

nmap -p 1-1000 192.168.1.1

Range.

Service Version Detection

nmap -sV 192.168.1.1

Shows service versions.

Aggressive detection

nmap -A 192.168.1.1

OS detection, version, script.

nmap Commands That Work

Quick port check

nmap -p 443 example.com

Is HTTPS open?

All interfaces

nmap -iflist

List network interfaces.

OS detection

sudo nmap -O 192.168.1.1

Identify OS.

Script scan

nmap --script=vuln 192.168.1.1

Vulnerability scripts.

Scan with service versions

nmap -sV --script default 192.168.1.1

Default scripts.

The nmap Command Builder

Building nmap commands—the nmap Command Builder helps:

  • Visual scan type selector
  • Port filter builder
  • Script presets for common scans

Quick Reference

Flag What It Does
-sS SYN scan
-sT TCP connect
-sU UDP scan
-sV Version detection
-O OS detection
-A Aggressive
-p Ports
-F Top ports
-oX XML output

Important Warnings

Only scan systems you own or have permission to test. Unauthorized scanning is illegal and can trigger blocking/alerting.

Lessons Learned

  1. Root required for SYN scan — use sudo.

  2. nmap shows open ports — closed ports aren't shown.

  3. Use -p for specific ports — don't scan everything.

  4. Script scan is powerful — --script=safe or default.

  5. -oA for all output — text, XML, grepable.

Conclusion: nmap Is Your Security Lens

nmap reveals your network exposure—use it responsibly.

The nmap Command Builder makes building scan commands easy.

Further Reading