---
title: nmap — Network Analysis and Diagnostics
date: 2026-10-18
time: 12:00
model: admin
category: programs
author_type: human
summary: A standard port scanner for enumerating hosts, ports, and service versions. Used in the reconnaissance phase before network inventory and vulnerability scanning.
tags: program, Network Analysis and Diagnostics, nmap
---

A standard network scanner that examines open ports and services on hosts.

## Basic information

| Program name | nmap (en-map) |
| --- | --- |
| One-line description | A standard network scanner that examines open ports and services on hosts. |
| Developed / maintained by | Nmap Project (Gordon Lyon) |
| Official website | https://nmap.org/ |
| Official documentation | https://nmap.org/book/man.html |
| Official download | https://nmap.org/download.html |
| Supported operating systems | Linux, Windows, macOS |
| License | GPL-2.0-or-later |
| Stable version | 7.991 (released 2026-08-06) — checked 2026-10-18 |
| GitHub repository | https://github.com/nmap/nmap |
| Category | Network analysis and diagnostics (tags: port scan, service detection, network inventory) |

## What is this program?

nmap is a command-line tool that discovers hosts connected to the network and examines which TCP/UDP ports each host has open, what services are running on those ports, and what versions they are.

If you are a server administrator, you can use it after adding a new server to the network to check 'what is actually open', or after changing firewall rules to verify that no ports are left open unexpectedly. Because it is a command-line tool rather than a GUI tool, it can be dropped directly into inspection scripts.

## What problems does it solve?

- When you need to quickly identify which services on a server are exposed externally (inventory check).
- When you need to verify that ports are actually blocked after changing firewall or security group rules.
- When you receive an incident report and need to verify directly whether a particular port is open.
- When you need to document the service configuration of target assets within an OSINT or penetration testing scope (separate authorization required).
## Key features

### Port scanning

It classifies TCP/UDP ports based on whether they are open, closed, or filtered.

- **Use case**: Scan a server’s public IP across all ports 1–65535 or only common ports.
- **What you get**: A list of open ports and information about the response packets returned by each port.
- **Limitations**: If the scan range is large, it takes a long time, and unauthorized scanning can lead to legal issues.
### Service/version detection

Use the -sV option to infer service banners and version information from open ports.

- **Use case**: Cross-check the web, SSH, and DB versions installed on the server.
- **What you get**: Version estimates such as Apache 2.4.58 or OpenSSH 9.6.
- **Limitations**: Because some services hide banners or send fake versions, these are only estimates, not definitive values.
### NSE scripts

Performs additional checks such as vulnerability verification, DNS lookups, and brute force using Nmap Scripting Engine scripts written in Lua.

- **Use case**: Use scripts to check for issues such as Heartbleed and SMB configuration errors.
- **What you get**: It classifies and displays results by script.
- **Limitations**: Aggressive scripts can put load on the target or leave logs, so use them only within an agreed scope.
### OS fingerprinting

It compares TCP/IP stack response characteristics to infer the target operating system.

- **Use case**: Fill in OS information in asset inventories.
- **What you get**: OS candidates such as Linux and Windows servers along with confidence levels.
- **Limitations**: Estimation errors can increase due to latency or NAT environments.
## Installation and usage

### Ubuntu / Debian

Install the version from the distribution repository. For the latest version, use the packages from the official site.

```
sudo apt update
sudo apt install nmap
```

### RHEL / CentOS / Fedora

Install from the base repository or the EPEL repository.

```
sudo dnf install nmap
```

### Windows / macOS

Use the installer from the official download page. On Windows, Npcap must be installed first for scanning to work properly.

```
# Official download: https://nmap.org/download.html
```

## Practical usage examples

### Check open ports (basic scan)

Scans TCP ports 1–1000 on the target IP using the default mode. With sudo privileges, the handshake method is faster.

```
sudo nmap -sT -p 1-1000 192.0.2.10
```

### Service version detection

Add -sV to also see the service and version estimates for open ports.

```
sudo nmap -sV -p 22,80,443 192.0.2.10
```

### Script scan (example)

Performs vulnerability-related checks using the default NSE script set. The results are examples and not actual scan results.

```
sudo nmap -sV --script default 192.0.2.10
```

## Strengths and limitations

### Strengths

- As the de facto standard tool for network investigation, it has extensive documentation, scripts, and learning resources.
- Extends from simple port checks to NSE script-based investigations within one tool.
- Output can be saved in script-friendly formats (-oG, -oX), making it suitable for automation.
- Officially supports Linux, Windows, and macOS.
### Things to consider before use

- Scanning without explicit authorization for the target network can cause legal or policy problems.
- Large-scale scans generate significant traffic and can lead to outages or detection.
- OS and version estimation is heuristic and can be inaccurate.
- Beginners who run NSE scripts as-is can easily get unexpected results.
## Comparison with similar programs

| Program | Characteristics | Best suited for |
| --- | --- | --- |
| masscan | Specialized for high-speed large-scale port scanning, handling tens of thousands of ports per second. | When you need to quickly sweep the entire internet or a large target range. |
| zmap | Specialized for fast scanning of a single port across a large number of targets. | When you need to broadly find hosts that have a single port open, such as port 80. |
| netcat (nc) | A simple tool for manually probing ports one by one. | When you need to recheck one or two specific ports that were already identified by a scan. |

## Official resources and further learning

- [Official website](https://nmap.org/) — https://nmap.org/
- [Official documentation / knowledge base](https://nmap.org/book/man.html) — https://nmap.org/book/man.html
- [Official download](https://nmap.org/download.html) — https://nmap.org/download.html
- [Release notes](https://nmap.org/changelog.html) — https://nmap.org/changelog.html
- [Source / development resources](https://github.com/nmap/nmap) — https://github.com/nmap/nmap
Version and supported environment information is from the official site as of 2026-10-18. Installation commands may vary depending on the distribution and version you use, so please also check the official installation documentation.

## Actual execution screen

This is a composite example that recreates nmap's service detection (-sV) output in a server-style layout. The screen is a composite example and not an actual execution result.

![nmap service detection scan result: screen showing ports 22/80/443 open and nginx/OpenSSH versions](https://games.aidebatehub.com/assets/nmap-demo.png)

Actual production server

---
Source (HTML): https://games.aidebatehub.com/programs/apps/network/nmap.html
This file is an auto-generated Markdown twin of the DevHub document.