Nmap for Beginners: Essential Scans Explained

Nmap is the first tool almost every penetration tester learns. It tells you which machines are alive on a network, which ports are open and what software is listening. This guide explains the scans you will use most, in plain language. Run them only against your own lab or systems you are authorized to test. The Nmap project allows light scanning of scanme.nmap.org for learning.

Before You Start

Nmap comes with Kali Linux and installs easily on Windows, macOS and other Linux systems. Some scan types need administrator rights; on Linux, run those with sudo. In the examples, 192.168.56.0/24 is a typical VirtualBox host-only lab network; replace it with yours.

Find Live Hosts

"nmap -sn 192.168.56.0/24" checks which addresses respond, without scanning ports. Start here so you know what is on the network.

Scan Ports

• "nmap 192.168.56.101" scans the 1,000 most common TCP ports on one host
• "nmap -p- 192.168.56.101" scans all 65,535 TCP ports; slower, but finds services on unusual ports
• "nmap -p 22,80,443,445 192.168.56.101" scans only the ports you list
• "sudo nmap -sU --top-ports 50 192.168.56.101" scans common UDP ports; UDP scanning is slow, so limit it

Identify Services and Versions

"nmap -sV 192.168.56.101" asks each open port what software and version is running. Versions matter, because they tell you which known vulnerabilities might apply. Adding "-O" attempts to guess the operating system (needs sudo).

Run the Default Scripts

"nmap -sC -sV 192.168.56.101" adds Nmap's default scripts, which collect extra detail such as web page titles, SMB information and SSH host keys. The Nmap Scripting Engine has hundreds more scripts; some are intrusive, so read what a script does before running it on anything but your lab.

Save Your Output

"nmap -sC -sV -oA scan1 192.168.56.101" saves the results in three formats at once (normal, XML and grepable). Always save output: you will need it for your notes and your report.

Speed and Care

"-T4" speeds up scanning on a reliable lab network. On real client networks, agree on timing in the rules of engagement and go gently: aggressive scans can upset fragile systems and will certainly trigger alerts.

Reading the Results

• open: something is listening; investigate it
• closed: reachable, but nothing listening
• filtered: a firewall is probably blocking the probe

Nmap is only the start: each open port becomes a lead for enumeration. See penetration testing phases explained.

Learning More

Nmap is taught hands-on in our network and Active Directory course, together with Nessus, Metasploit and Wireshark. Build your own practice network with our home lab guide.