nmap — Network Analysis and Diagnostics

A standard network scanner that examines open ports and services on hosts.

Basic information

What is this program?

nmap is a command-line tool that discovers hosts connected to the network and examines which TCP/UDP ports each host has open, what services are running on those ports, and what versions they are.

If you are a server administrator, you can use it after adding a new server to the network to check 'what is actually open', or after changing firewall rules to verify that no ports are left open unexpectedly. Because it is a command-line tool rather than a GUI tool, it can be dropped directly into inspection scripts.

What problems does it solve?

• When you need to quickly identify which services on a server are exposed externally (inventory check).
• When you need to verify that ports are actually blocked after changing firewall or security group rules.
• When you receive an incident report and need to verify directly whether a particular port is open.
• When you need to document the service configuration of target assets within an OSINT or penetration testing scope (separate authorization required).

Key features

Port scanning

It classifies TCP/UDP ports based on whether they are open, closed, or filtered.

• Use case: Scan a server’s public IP across all ports 1–65535 or only common ports.
• What you get: A list of open ports and information about the response packets returned by each port.
• Limitations: If the scan range is large, it takes a long time, and unauthorized scanning can lead to legal issues.

Service/version detection

Use the -sV option to infer service banners and version information from open ports.

• Use case: Cross-check the web, SSH, and DB versions installed on the server.
• What you get: Version estimates such as Apache 2.4.58 or OpenSSH 9.6.
• Limitations: Because some services hide banners or send fake versions, these are only estimates, not definitive values.

NSE scripts

Performs additional checks such as vulnerability verification, DNS lookups, and brute force using Nmap Scripting Engine scripts written in Lua.

• Use case: Use scripts to check for issues such as Heartbleed and SMB configuration errors.
• What you get: It classifies and displays results by script.
• Limitations: Aggressive scripts can put load on the target or leave logs, so use them only within an agreed scope.

OS fingerprinting

It compares TCP/IP stack response characteristics to infer the target operating system.

• Use case: Fill in OS information in asset inventories.
• What you get: OS candidates such as Linux and Windows servers along with confidence levels.
• Limitations: Estimation errors can increase due to latency or NAT environments.

Installation and usage

Ubuntu / Debian

Install the version from the distribution repository. For the latest version, use the packages from the official site.

sudo apt update
sudo apt install nmap

RHEL / CentOS / Fedora

Install from the base repository or the EPEL repository.

sudo dnf install nmap

Windows / macOS

Use the installer from the official download page. On Windows, Npcap must be installed first for scanning to work properly.

# Official download: https://nmap.org/download.html

Practical usage examples

Check open ports (basic scan)

Scans TCP ports 1–1000 on the target IP using the default mode. With sudo privileges, the handshake method is faster.

sudo nmap -sT -p 1-1000 192.0.2.10

Service version detection

Add -sV to also see the service and version estimates for open ports.

sudo nmap -sV -p 22,80,443 192.0.2.10

Script scan (example)

Performs vulnerability-related checks using the default NSE script set. The results are examples and not actual scan results.

sudo nmap -sV --script default 192.0.2.10

Strengths and limitations

Strengths

• As the de facto standard tool for network investigation, it has extensive documentation, scripts, and learning resources.
• Extends from simple port checks to NSE script-based investigations within one tool.
• Output can be saved in script-friendly formats (-oG, -oX), making it suitable for automation.
• Officially supports Linux, Windows, and macOS.

Things to consider before use

• Scanning without explicit authorization for the target network can cause legal or policy problems.
• Large-scale scans generate significant traffic and can lead to outages or detection.
• OS and version estimation is heuristic and can be inaccurate.
• Beginners who run NSE scripts as-is can easily get unexpected results.

Comparison with similar programs

Official resources and further learning

• Official website — https://nmap.org/
• Official documentation / knowledge base — https://nmap.org/book/man.html
• Official download — https://nmap.org/download.html
• Release notes — https://nmap.org/changelog.html
• Source / development resources — https://github.com/nmap/nmap

Version and supported environment information is from the official site as of 2026-10-18. Installation commands may vary depending on the distribution and version you use, so please also check the official installation documentation.

Actual execution screen

This is a composite example that recreates nmap's service detection (-sV) output in a server-style layout. The screen is a composite example and not an actual execution result.

!nmap service detection scan result: screen showing ports 22/80/443 open and nginx/OpenSSH versions

Actual production server

Source (HTML): https://games.aidebatehub.com/programs/apps/network/nmap.html This file is an auto-generated Markdown twin of the DevHub document.