Nmap — port scanning

In a nutshell Nmap answers "what's alive and what's listening?" You point it at a host or a whole network and it tells you which hosts respond, which ports are open, and often which software and version sits behind each port. It's the workhorse of the scanning stage — almost every engagement runs it first.

How a scan reads a port

Nmap sends crafted packets and reads the replies. Because of the TCP handshake (see TCP, UDP and ports), the reply reveals the port's state:

A single SYN, three possible answers — that's how a scan maps a host.

From open ports it moves to what is there: service name, version, sometimes the OS.

Analogy — walking a corridor of doors. Nmap knocks on each numbered door. Some open (a service answers), some are locked but clearly there (closed), some are behind a curtain (filtered). Then it peeks in the open ones to read the sign: "SSH, OpenSSH 8.9."

The commands you'll actually use

nmap 192.168.1.10             # default: top 1000 TCP ports of one host
nmap 192.168.1.0/24           # a whole /24 network
nmap -p- 10.10.10.5           # ALL 65535 ports (slower, thorough)
nmap -sC -sV target           # default scripts + versions — a great first sweep
nmap -sV -p 22,80,443 target  # service + version on given ports
nmap -A target                # aggressive: OS, versions, scripts, traceroute
nmap -Pn target               # skip host-discovery ping (host blocks ICMP)
nmap -sV -oN scan.txt target  # save output (always keep notes)

The flags that matter — and why

Flag	Why it earns its place
`-sV`	version detection — "Apache 2.4.49" may be a public exploit. The single most valuable flag.
`-p-`	all ports — admins hide services on odd high ports the default 1000 misses
`-sC`	default NSE scripts — grab banners, list SMB shares, find anon FTP
`-Pn`	treat host as up without ping — silence isn't death, a firewall may block ICMP
`-oN/-oA`	save results — a scan you didn't record is a scan you'll rerun

Reading the output into a plan

22/tcp   open  ssh      OpenSSH 8.9p1        → key auth? version exploits?
80/tcp   open  http     Apache 2.4.49        → test the web app + look up the CVE
445/tcp  open  smb      Samba 4.x            → enumerate shares
3306/tcp open  mysql    MySQL 5.7            → exposed DB? weak creds?

The scan hacks nothing — it hands you the map of where to look.

Loud, and legal A full scan is noisy — it shows in the target's logs, and aggressive timing can disrupt fragile services. Nmap is active recon: you're touching the target, so you need permission. On real work, scan only what's in scope, at an agreed pace.