Nmap for Beginners: The Complete Scanning Guide

Nmap ("Network Mapper") is the single most important reconnaissance tool in an ethical hacker's kit. It answers the first questions of any engagement: what hosts are alive, what ports are open, and what services are running behind them. It is free, open source, and works on Linux, Windows, and macOS. This beginner's guide walks you through the core scan types with real, copy-ready commands. Only ever scan systems you own or have explicit written permission to test.

Key Takeaways

• Nmap maps networks: it discovers live hosts, open ports, services, and operating systems.
• Start with host discovery to find live targets before scanning ports.
• Service and version detection (-sV) tells you what is actually running, not just that a port is open.
• The Nmap Scripting Engine (NSE) extends Nmap into vulnerability checks and deeper enumeration.
• Always get authorization; scanning without permission can be illegal.

Installing Nmap

On most Linux distributions you can install it with your package manager, and Windows and macOS builds are available from the official Nmap site. Verify the install and check your version:

nmap --version

Understanding Ports and States

Nmap reports each scanned port in a state. The three you will see most often are open (a service is accepting connections), closed (reachable but no service listening), and filtered (a firewall is blocking Nmap from determining the state). Understanding these states is key to reading your results correctly.

Step 1: Host Discovery

Before scanning ports, find out which hosts are alive. A ping scan (-sn) does host discovery without port scanning:

nmap -sn 192.168.1.0/24

This sweeps an entire subnet and lists responsive hosts, a fast way to map what is on a network.

Step 2: Basic Port Scanning

To scan a single host's most common ports, simply point Nmap at it:

nmap 10.10.10.10

By default Nmap scans the 1,000 most common TCP ports. To scan all 65,535 ports, use -p-:

nmap -p- 10.10.10.10

To scan specific ports or ranges:

nmap -p 22,80,443,8080 10.10.10.10
nmap -p 1-1024 10.10.10.10

Step 3: Scan Types

The default scan for an unprivileged user is a TCP connect scan (-sT). With root privileges, Nmap defaults to the stealthier and faster SYN scan (-sS), which does not complete the full TCP handshake:

sudo nmap -sS 10.10.10.10

To scan UDP services (such as DNS or SNMP), use -sU. UDP scans are slower but reveal services TCP scans miss:

sudo nmap -sU -p 53,161 10.10.10.10

Step 4: Service and Version Detection

Knowing a port is open is only half the story. The -sV flag probes open ports to identify the service and its version, which is essential for finding known vulnerabilities:

nmap -sV 10.10.10.10

Step 5: OS Detection and the Aggressive Scan

Nmap can guess the target operating system with -O. For convenience, the aggressive option -A bundles OS detection, version detection, default scripts, and traceroute into one command:

sudo nmap -A 10.10.10.10

A very common combination for a first pass is version detection plus default scripts:

nmap -sV -sC 10.10.10.10

Step 6: The Nmap Scripting Engine (NSE)

NSE turns Nmap into far more than a port scanner. Scripts are grouped into categories such as default, safe, discovery, and vuln. Run the default set with -sC, or call specific scripts or categories with --script:

nmap --script vuln 10.10.10.10
nmap --script http-title -p 80,443 10.10.10.10

Step 7: Timing and Output

Timing templates from -T0 (slowest, stealthiest) to -T5 (fastest, noisiest) control scan speed. -T4 is a common balance on a reliable network. Save results for later analysis or reporting with the output flags:

nmap -sV -T4 -oN scan_results.txt 10.10.10.10
nmap -sV -oA fullscan 10.10.10.10

The -oN flag writes normal text output, while -oA saves in all three major formats (normal, grepable, and XML) at once.

A Practical First-Scan Workflow

A typical beginner workflow against an authorized lab target is: discover live hosts, run a full port scan, then run version and script detection on the ports you found:

nmap -sn 192.168.1.0/24
nmap -p- 192.168.1.50
nmap -sV -sC -p 22,80,443 192.168.1.50

Practicing this sequence on intentionally vulnerable lab machines builds real intuition. The Ethical Hacking track at TechBiz Security Academy uses safe, legal lab environments so you can run these exact commands without risk while you learn to interpret the output like a professional.

Frequently Asked Questions

Is it legal to use Nmap?

Nmap itself is a legitimate tool, but scanning networks or systems you do not own or have written permission to test can be illegal. Always practice on your own equipment or on authorized lab platforms.

What is the difference between a SYN scan and a connect scan?

A connect scan (-sT) completes the full TCP handshake and needs no special privileges. A SYN scan (-sS) sends a SYN and never finishes the handshake, making it faster and stealthier, but it requires root or administrator privileges.

Why does a port show as "filtered"?

Filtered means a firewall or filter is preventing Nmap from determining whether the port is open or closed. Nmap sent a probe but received no clear response, so it cannot confirm the state.

What is the fastest way to do a thorough first scan?

A common approach is host discovery first, then a full port scan with -p-, followed by -sV -sC on the open ports. Adding -T4 speeds things up on a stable network.