Nmap is a network discovery and diagnostic tool. It can tell you which hosts respond, which ports are reachable and which services appear to be listening. Use it only against systems you own or are explicitly authorized to assess; even ordinary scans can trigger alerts and disrupt fragile devices.
Install Nmap and choose a safe target
Use your operating system package manager or the official Nmap downloads. The examples below use documentation-style private network addresses; replace them with an authorized test host or subnet.
sudo apt update
sudo apt install nmap
nmap --version1–4: Basic discovery and common ports
Start with a single host, inspect a small number of ports, then discover which hosts are online in a small local subnet. Scanning an entire subnet is more intrusive than scanning one known machine.
nmap 192.168.1.10
nmap -p 22,80,443 192.168.1.10
nmap -F 192.168.1.10
nmap -sn 192.168.1.0/245–7: Service details and output
When you need more context, ask Nmap to identify service versions, show detailed progress or save results for comparison. Version guesses are observations, not proof that a particular vulnerability exists.
nmap -sV 192.168.1.10
nmap -v 192.168.1.10
nmap -oN local-scan.txt 192.168.1.108–10: Multiple hosts and discovery behavior
You can scan named hosts from a trusted file and test hosts that do not answer Nmap’s normal discovery probes. Skipping discovery makes sense only when a host is known to be up; it may increase scan traffic.
nmap -iL authorized-hosts.txt
nmap -Pn -p 443 192.168.1.10
nmap --reason 192.168.1.1011–13: Deeper diagnostics
Operating-system detection uses network fingerprints and can be wrong, especially through middleboxes. A TCP SYN scan generally requires additional privileges and does not make a scan invisible. Traceroute can reveal a path but may not work through all firewalls.
sudo nmap -O 192.168.1.10
sudo nmap -sS -p 22,80,443 192.168.1.10
nmap --traceroute 192.168.1.10Interpret the results responsibly
Open usually means a service is accepting connections; closed means the port is reachable but not listening; filtered means a firewall or network condition prevents a definitive answer. Compare results with the device’s own listening sockets and firewall rules.
Avoid scanning networks or services without approval, and use the official reference for option details and limitations.
Next steps
Use repeatable authorized scans to identify unexpected exposure, document the device owner and remediation, and validate changes after a service or firewall update. Nmap is one diagnostic signal; it does not replace vulnerability management or configuration review.
Background reading: original source article. This guide has been substantially rewritten and should be independently verified before operational use.
