The Linux nmap Command: Seeing Your Network
We were auditing our network security. My boss said "run nmap." I typed "nmap 192.168.1.0/24" and got 50 pages of output. Most of it was useless to me.
I didn't know how to filter, or which scan types to use. Let me save you that learning curve.
First nmap Scan
Basic ping scan
nmap 192.168.1.1Simple port scan.
Scan all hosts in subnet
nmap 192.168.1.0/24Entire local network.
Scan multiple hosts
nmap 192.168.1.1 192.168.1.10 192.168.1.20Specific hosts.
Scan Types
SYN scan (requires root)
sudo nmap -sS 192.168.1.1Fast but requires root.
TCP connect scan
nmap -sT 192.168.1.1Slower but doesn't require root.
UDP scan
sudo nmap -sU 192.168.1.1Slower but finds UDP services.
Port Selection
Common ports
nmap -F 192.168.1.1Top 100 ports.
Specific ports
nmap -p 22,80,443 192.168.1.1SSH, HTTP, HTTPS.
Port range
nmap -p 1-1000 192.168.1.1Range.
Service Version Detection
nmap -sV 192.168.1.1Shows service versions.
Aggressive detection
nmap -A 192.168.1.1OS detection, version, script.
nmap Commands That Work
Quick port check
nmap -p 443 example.comIs HTTPS open?
All interfaces
nmap -iflistList network interfaces.
OS detection
sudo nmap -O 192.168.1.1Identify OS.
Script scan
nmap --script=vuln 192.168.1.1Vulnerability scripts.
Scan with service versions
nmap -sV --script default 192.168.1.1Default scripts.
The nmap Command Builder
Building nmap commands—the nmap Command Builder helps:
- Visual scan type selector
- Port filter builder
- Script presets for common scans
Quick Reference
| Flag | What It Does |
|---|---|
-sS |
SYN scan |
-sT |
TCP connect |
-sU |
UDP scan |
-sV |
Version detection |
-O |
OS detection |
-A |
Aggressive |
-p |
Ports |
-F |
Top ports |
-oX |
XML output |
Important Warnings
Only scan systems you own or have permission to test. Unauthorized scanning is illegal and can trigger blocking/alerting.
Lessons Learned
-
Root required for SYN scan — use sudo.
-
nmap shows open ports — closed ports aren't shown.
-
Use -p for specific ports — don't scan everything.
-
Script scan is powerful — --script=safe or default.
-
-oA for all output — text, XML, grepable.
Conclusion: nmap Is Your Security Lens
nmap reveals your network exposure—use it responsibly.
The nmap Command Builder makes building scan commands easy.