Nmap Reconnaissance & Scanning

Overview

Nmap (Network Mapper) is an open-source utility for network discovery, port scanning, and vulnerability surface auditing. Its primary purpose in ethical security testing is to create an accurate inventory of reachable hosts, active transport-layer ports, and running service versions across an authorized scope.

Core Concepts

Nmap determines port states by analyzing transport layer responses (TCP SYN/ACK, RST, or ICMP unreachable errors):

• open: An application is actively accepting TCP connections or UDP packets on this port.
• closed: The probe packet was received, but no application is listening; the host replied with a TCP RST packet.
• filtered: A firewall, packet filter, or network rule blocked the probe or response, preventing Nmap from determining whether the port is open or closed.
• unfiltered: The port is accessible, but Nmap cannot determine whether it is open or closed (commonly seen in ACK scans).

Tools & Requirements

Nmap is pre-installed on Kali Linux and available across all standard Linux package repositories.

$ sudo apt update && sudo apt install -y nmap
$ nmap --version

Commands & Practical Examples

The following core commands represent the fundamental progression of host and service discovery:

1. Host Discovery (Ping Sweep)

Identify reachable hosts on a local subnet without probing individual transport ports:

$ nmap -sn 192.168.1.0/24

2. Full TCP Port Sweep

Scan all 65,535 TCP ports on a single target machine to discover non-standard services:

$ nmap -p- 192.168.1.10

3. Service and Version Identification

Probe specific open ports to extract service banners, application versions, and operating system clues:

$ nmap -sV -p 22,80,443 192.168.1.10

4. Comprehensive Scan with Full Output Formats

Execute service detection, default safe NSE scripts, and save output simultaneously in normal, XML, and grepable formats:

$ nmap -sV -sC -oA inventory 192.168.1.10

5. Advanced Timing & SYN Stealth Scanning

Use SYN half-open scanning with aggressive timing (T4) suitable for stable laboratory local networks:

$ sudo nmap -sS -T4 -p 1-1000 -oN lab_scan.txt 192.168.1.10

Practical Workflow

1. Define Target Scope: Confirm target IP or CIDR block matches authorized lab assignment.
2. Network Host Discovery: Run nmap -sn <subnet> to identify responsive IP addresses.
3. Port Sweeping: Execute fast initial sweep (top 1000 ports) followed by complete sweep (-p-) if needed.
4. Service & Version Fingerprinting: Run -sV -sC against discovered open ports.
5. Document Results: Inspect the resulting .nmap and .xml files before proceeding to vulnerability research.

Common Mistakes & Troubleshooting

• Assuming Closed equals Filtered: A closed port confirms host reachability (RST packet returned), whereas filtered indicates packet drops.
• Skipping UDP: Critical infrastructure services (DNS on 53, SNMP on 161, DHCP on 67/68) run over UDP. Use sudo nmap -sU when auditing network infrastructure.
• Ignoring Timing Impacts: Running -T5 over unreliable Wi-Fi or congested VPN tunnels causes packet drops and false negatives. Use -T4 or default -T3.

Security Considerations & Scoping

Port scanning triggers network intrusion detection systems (IDS/IPS) and generates significant firewall logs. In professional contexts, scanning parameters must align with agreed Rules of Engagement (ROE). In lab environments, always monitor target machine CPU load when running comprehensive NSE scripts.

Related Topics

• Module 10: Reconnaissance & Surface Enumeration
• Module 06: Network Security & Packet Analysis
• Module 14: Security Tools Command Index

Further Reading & TryHackMe Paths

• TryHackMe Network Fundamentals: Intro to LAN, Nmap, Nmap Live Host Discovery rooms.
• Offline PDFs: Refer to handbook/sources/nmap/nmap.pdf and the 10 granular chapter parts in the PDF Library.