Nmap Tutorial: Network Scanning & Security Analysis

Nmap is a free and open-source network scanning tool used to discover hosts and services on a computer network. It is widely used for network auditing, penetration testing, and security assessments.

With Nmap, you can identify live systems, detect open ports, determine running services, and even guess operating systems used by devices. First released in 1997, Nmap has grown into one of the most trusted tools in the cybersecurity industry, used by network administrators, security researchers, and IT teams around the world to keep their infrastructure visible and accounted for.

Nmap plays a critical role in cybersecurity by helping professionals understand network exposure and detect potential entry points for attackers.

• Identify open ports and services
• Detect unauthorized devices on a network
• Perform vulnerability assessments
• Strengthen network security posture
• Build an accurate inventory of assets connected to a network
• Verify that firewall rules are working as intended

The examples below use private network addresses (192.168.x.x) and IANA's reserved documentation domain, which are safe to reference for learning purposes. When practicing yourself, only run these against your own devices or a lab environment you control.

1. Scan a Single IP

nmap 192.168.1.1

This command scans a single device and shows open ports.

2. Scan a Range of IPs

nmap 192.168.1.1-100

Scans multiple devices in a network.

3. Scan a Website

nmap example.com

Finds open ports and services running on a domain. Note: example.com is a domain reserved by IANA specifically for documentation and testing — never run this against a live website you don't own or have permission to test.

4. Service Version Detection

nmap -sV 192.168.1.1

Shows versions of services running on open ports.

5. Scan Specific Ports

nmap -p 80,443 192.168.1.1

Limits the scan to specific ports instead of the default top 1,000 — useful when you already know which services you want to check.

6. Scan All 65,535 Ports

nmap -p- 192.168.1.1

A full port scan is slower but more thorough than the default scan, which only checks the most common ports.

After running an Nmap scan, the results show important details such as:

• Open Ports: Ports accepting connections
• Service: Application running on that port
• State: Open, closed, or filtered
• Protocol: TCP or UDP

A "filtered" state usually means a firewall is blocking Nmap's probes, while "closed" means the port is reachable but nothing is listening on it. Understanding this distinction helps you tell the difference between a genuinely secured system and one that's simply not running a service on that port.

The scans below (OS detection, aggressive scan, and stealth scan) are more invasive and, in the case of stealth scanning, specifically designed to evade detection. Only run these against systems you own or a lab environment set up for practice — never against third-party networks or websites.

OS Detection

nmap -O 192.168.1.1

Aggressive Scan

nmap -A 192.168.1.1

Stealth Scan

nmap -sS 192.168.1.1

Nmap Scripting Engine (NSE)

Nmap includes a built-in scripting engine that extends its functionality with community-written scripts, covering everything from service detection to configuration auditing. Scripts are grouped into categories such as default, discovery, safe, and vuln. Beginners should stick to scripts labeled "safe" when testing on any system, since some categories are intentionally more aggressive.

Nmap lets you control how fast a scan runs using timing templates, numbered T0 (slowest, most stealthy) to T5 (fastest, most aggressive). Slower scans are less likely to trigger intrusion detection systems but take longer to complete.

Example: nmap -T4 192.168.1.1

For real audits, you'll usually want to save your scan results rather than just reading them in the terminal. Nmap supports several output formats:

• -oN scan.txt — normal, human-readable output
• -oX scan.xml — XML output, useful for feeding into other tools
• -oG scan.gnmap — "grepable" format, easy to search with command-line tools
• -oA scan — saves all three formats at once using the same base filename

Example: nmap -oA my_scan 192.168.1.1

Nmap shows up constantly in real cybersecurity work. A few common scenarios:

• Network inventory audits: IT teams use Nmap to confirm exactly which devices are connected to their network and flag anything unexpected.
• Firewall rule verification: Security teams scan their own infrastructure from outside and inside to confirm firewall rules are blocking what they should.
• Penetration testing engagements: Nmap is typically the first tool used in an authorized pentest to map out the target scope before deeper testing begins.
• Incident response: After a suspected breach, responders use Nmap to check for unexpected open ports or services that might indicate a backdoor.
• Compliance checks: Some regulatory frameworks require periodic scanning to confirm no unauthorized services are exposed.

Many security professionals use Nmap alongside these other tools rather than instead of them — Nmap for initial discovery, then a dedicated vulnerability scanner for deeper analysis.

Nmap is one of the first tools used during penetration testing. It helps ethical hackers map the network, identify targets, and plan further testing — always within the scope of an agreed, authorized engagement.

By understanding open ports and services, security professionals can detect weaknesses before attackers exploit them.

Nmap is an essential tool for anyone interested in networking or cybersecurity. Whether you are a beginner or a professional, learning Nmap can significantly improve your ability to analyze and secure networks — always with proper authorization.