Nmap Tutorial: The Complete Guide to Network Scanning for Ethical Hackers

If you've spent any time in cybersecurity, you've heard one rule repeated until it's almost a cliché: you cannot attack what you cannot see. Nmap — the Network Mapper — is how professionals see. It's the first tool most pentesters open, the last one they close, and the one that appears in practically every major penetration test report ever written. This guide walks you through everything from your first scan to advanced scripting, so you can use Nmap the way professionals actually use it — not just to run commands, but to understand what the output means.

What Is Nmap and Why Does It Matter?

Nmap is a free, open-source network scanning tool created by Gordon Lyon (Fyodor) in 1997. It has evolved from a simple port scanner into a full-featured network reconnaissance framework used by penetration testers, security auditors, sysadmins, and bug bounty hunters worldwide.

Here's what makes Nmap indispensable:

• Host discovery — find which machines are alive on a network
• Port scanning — determine which ports are open, closed, or filtered
• Service and version detection — identify what software is running on each port
• OS fingerprinting — guess the operating system of a target
• Nmap Scripting Engine (NSE) — automate vulnerability detection, brute-forcing, and more

For a complete guide, see our Network Penetration Testing resource that places Nmap inside the full pentest methodology.

> Important: Always obtain written authorization before scanning any network or system you do not own. Unauthorized scanning is illegal in most jurisdictions. Everything in this guide should be practiced in lab environments or against systems you have explicit permission to test.

Tools and Setup

What You Need

• Nmap (obviously) — version 7.90+ recommended
• A Linux environment (Kali, Parrot OS, or Ubuntu work great)
• Root or sudo privileges for most advanced scan types
• A target: your own lab, a CTF machine, or platforms like Hack The Box

Installing Nmap

# Debian / Ubuntu / Kali
sudo apt update && sudo apt install nmap -y

# Red Hat / Fedora / CentOS
sudo dnf install nmap -y

# macOS (Homebrew)
brew install nmap

# Verify install
nmap --version

On Windows, download the installer from nmap.org — it includes Zenmap, a GUI frontend, which is useful for visualizing scan results when you're first learning.

Understanding the Nmap Scan Lifecycle

Before running commands, understand the phases Nmap goes through:

1. Target specification — parse the target list
2. Host discovery — determine which hosts are up
3. Port scanning — probe ports on live hosts
4. Service/version detection — identify what's running
5. OS detection — fingerprint the OS
6. NSE script execution — run additional scripts
7. Output — format and save results

Each phase has its own flags. Understanding this flow stops you from wasting time scanning ports on hosts that aren't even alive.

Core Scan Types You Need to Know

Host Discovery (Ping Scan)

Before anything else, figure out which hosts are up:

# Ping scan — just check which hosts are alive (no port scan)
nmap -sn 192.168.1.0/24

# Disable ping check and scan all hosts (useful when ICMP is blocked)
nmap -Pn 192.168.1.0/24

The -sn flag tells Nmap to skip port scanning and only do host discovery. This is fast and quiet — great for mapping a network before deciding where to focus.

SYN Scan (Default, Most Common)

# SYN scan — requires root; sends SYN, doesn't complete handshake
sudo nmap -sS 192.168.1.10

# Scan specific ports
sudo nmap -sS -p 22,80,443,3306 192.168.1.10

# Scan top 1000 ports (default)
sudo nmap -sS 192.168.1.10

# Scan all 65535 ports
sudo nmap -sS -p- 192.168.1.10

SYN scan (also called a "stealth scan") sends a SYN packet and waits for a response. If it gets SYN-ACK, the port is open. It then sends RST to tear down the connection without completing the handshake — hence "stealth." It's faster than a full TCP connect scan and less likely to appear in application logs.

TCP Connect Scan

# Full TCP connect — doesn't need root
nmap -sT 192.168.1.10

This completes the three-way handshake. It's noisier and shows up in application logs, but doesn't require root privileges. Use it when you can't run SYN scans.

UDP Scan

# UDP scan — slow but critical; many services run over UDP
sudo nmap -sU -p 53,161,500,1194 192.168.1.10

# Combine UDP and TCP in one scan
sudo nmap -sS -sU -p T:80,443,U:53,161 192.168.1.10

UDP is frequently overlooked. DNS (53), SNMP (161), and VPN services (500, 1194) all run over UDP. Skipping UDP scans means missing entire attack surfaces.

Service and Version Detection

Knowing a port is open is one thing. Knowing what's running on it is what enables actual exploitation.

# Service version detection
nmap -sV 192.168.1.10

# Aggressive version detection (slower, more accurate)
nmap -sV --version-intensity 9 192.168.1.10

The output will look something like:

PORT    STATE SERVICE VERSION
22/tcp  open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.5
80/tcp  open  http    Apache httpd 2.4.29
3306/tcp open  mysql   MySQL 5.7.33

Now you're not just seeing open ports — you're seeing specific software versions. That Apache version or that MySQL build might have a known CVE. This is where reconnaissance turns into actionable intelligence.

OS Detection

# OS fingerprinting
sudo nmap -O 192.168.1.10

# Aggressive mode (combines OS, version, scripts, traceroute)
sudo nmap -A 192.168.1.10

> Note: -A is powerful but noisy. In a real engagement, use it selectively on high-value targets after you've done quieter enumeration.

A Complete Practical Workflow

Here's how a real reconnaissance workflow looks — from network sweep to detailed enumeration:

# Step 1: Discover live hosts on the subnet
sudo nmap -sn 10.10.10.0/24 -oG live_hosts.txt

# Step 2: Run a quick scan on live hosts to find open ports
sudo nmap -sS --open -T4 10.10.10.0/24 -oN quick_scan.txt

# Step 3: Full port scan on a specific target of interest
sudo nmap -sS -p- -T4 10.10.10.50 -oN full_ports.txt

# Step 4: Service and version detection on discovered open ports
sudo nmap -sV -sC -p 22,80,443,3306 10.10.10.50 -oN services.txt

# Step 5: OS detection and aggressive scan
sudo nmap -A -p 22,80,443 10.10.10.50 -oN detailed.txt

Notice the -oN, -oG flags — always save your output. In a long engagement, you'll refer back to early scans repeatedly.

Output Formats

# Normal output (human-readable)
nmap -oN output.txt 192.168.1.10

# Grepable format (great for scripting)
nmap -oG output.gnmap 192.168.1.10

# XML output (used by Metasploit and other tools)
nmap -oX output.xml 192.168.1.10

# All three formats simultaneously
nmap -oA output 192.168.1.10

The Nmap Scripting Engine (NSE)

NSE is where Nmap transforms from a scanner into a reconnaissance platform. Scripts are written in Lua and cover vulnerability detection, brute-forcing, service enumeration, and much more.

# Run default scripts (-sC is shorthand for --script=default)
nmap -sC 192.168.1.10

# Run scripts by category
nmap --script=vuln 192.168.1.10
nmap --script=auth 192.168.1.10
nmap --script=brute 192.168.1.10

# Run a specific script
nmap --script=http-title 192.168.1.10
nmap --script=smb-vuln-ms17-010 192.168.1.10  # EternalBlue check

# Run multiple specific scripts
nmap --script=http-headers,http-methods 192.168.1.10 -p 80

Practical NSE Examples

Enumerate HTTP directories:

nmap --script=http-enum -p 80,443 192.168.1.10

Check for SMB vulnerabilities:

nmap --script=smb-vuln-* -p 445 192.168.1.10

Enumerate DNS:

nmap --script=dns-brute --script-args dns-brute.domain=target.com -p 53 192.168.1.1

FTP anonymous login check:

nmap --script=ftp-anon -p 21 192.168.1.10

Scripts live at /usr/share/nmap/scripts/ on Linux. You can browse them with:

ls /usr/share/nmap/scripts/ | grep smb

Timing and Performance

Nmap has six timing templates (-T0 through -T5):

# Fast scan on a known reliable internal network
nmap -T4 -sS 192.168.1.0/24

# Slow, quiet scan trying to avoid IDS detection
nmap -T1 -sS 10.10.10.50

For most lab and CTF work, -T4 is the sweet spot. In real engagements, discuss timing with the client — aggressive scans can cause instability on older systems.

Common Mistakes Beginners Make

1. Not Scanning All Ports

The default scan only checks the top 1000 ports. Many CTF machines and real-world servers run services on non-standard ports.

# Always do a full port scan at some point
nmap -p- 192.168.1.10

2. Skipping UDP

As mentioned earlier, UDP services are regularly missed. SNMP misconfiguration is a classic foothold — you'll never find it if you only scan TCP.

3. Not Saving Output

Run a 45-minute full port scan and forget to save it? That's a painful redo. Always use -oA to save all formats.

4. Running as Non-Root

SYN scans, OS detection, and many NSE scripts require root. If you're running scans without sudo and getting incomplete results, that's likely why.

# Check if you have root
whoami

# Or just use sudo
sudo nmap -sS -O 192.168.1.10

5. Treating Nmap Output as Ground Truth

Filtered ports aren't necessarily closed. Firewalls can drop packets without responding, making open ports look filtered. If a port seems filtered but the service should logically be there (based on other findings), try scanning from a different position or using different techniques.

6. Ignoring Version Detection

Open ports alone don't tell you much. Always run -sV — the version information is what you take into vulnerability research.

Combining Nmap with Other Tools

Nmap is rarely used in isolation. Here's how it feeds into the rest of your toolkit:

# Export XML and import into Metasploit
nmap -oX scan.xml 192.168.1.0/24
# Then in msfconsole:
# db_import scan.xml

# Use Nmap output with Nikto for web scanning
nmap -p 80,443 --open 192.168.1.0/24 -oG - | grep '/open' | awk '{print $2}' | xargs -I{} nikto -h {}

# Feed into EyeWitness for web screenshots
nmap -p 80,443,8080,8443 --open 192.168.1.0/24 -oX web_hosts.xml
eyewitness --xml web_hosts.xml

In CyberVK's lab environments, you'll practice exactly this kind of chained tooling — Nmap feeds into Metasploit, which feeds into post-exploitation. The labs give you a real network to scan, not just documentation to read.

Scanning Techniques for Firewall Evasion

When a target has firewall rules or IDS in place, you may need to adjust your approach:

# Fragment packets to evade some packet inspection
nmap -f 192.168.1.10

# Use decoy addresses to mask your real IP
nmap -D RND:10 192.168.1.10

# Spoof source port (some firewalls allow traffic from port 53)
nmap --source-port 53 192.168.1.10

# Slow down scan timing to avoid rate-based IDS
nmap -T1 --scan-delay 2s 192.168.1.10

> Remember: Evasion techniques are valid for authorized penetration testing. Use them to help clients understand their detection gaps — not to actually evade defenders in unauthorized contexts.

Quick Reference Cheatsheet

# Host discovery
nmap -sn 192.168.1.0/24

# Quick scan top 1000 ports
nmap -sS -T4 192.168.1.10

# Full port scan
nmap -sS -p- -T4 192.168.1.10

# Service and OS detection
nmap -sV -O 192.168.1.10

# Full aggressive scan
nmap -A 192.168.1.10

# Vuln scan with NSE
nmap --script=vuln 192.168.1.10

# Save all output formats
nmap -oA scan_results 192.168.1.10

# Combine everything for thorough enumeration
sudo nmap -sS -sV -sC -O -p- -T4 --open -oA full_enum 192.168.1.10

Go Deeper

This article is part of our comprehensive Network Penetration Testing series. Once you've mastered this topic, explore the full guide to level up your skills.

Ready to practice? CyberVK has hands-on labs and courses for every skill level. Start learning at cybervk.com