Nmap: Scan and Audit a Linux Network

Introduction: why use Nmap?

Nmap answers a fundamental question in network administration: what is on my network, and what state is it in? Its use cases are numerous:

• Network inventory: automatically discover all active hosts on a segment or an address range.
• Security auditing: identify open ports and services that are needlessly exposed.
• Service and version detection: know exactly which software is listening on which port, along with its version number.
• OS detection: identify the operating system of remote machines to adapt security measures.
• Firewall auditing: verify that filtering rules are correctly applied from the outside.
• Vulnerability detection: through NSE scripts, Nmap can test for weak configurations or known vulnerabilities.

Installing Nmap

Nmap is available in the official repositories of all major Linux distributions.

Debian / Ubuntu

sudo apt update
sudo apt install -y nmap

# Check the installed version
nmap --version

CentOS / RHEL / AlmaLinux / Rocky Linux

# CentOS 7 / RHEL 7
sudo yum install -y nmap

# CentOS 8+ / RHEL 8+ / AlmaLinux / Rocky Linux
sudo dnf install -y nmap

nmap --version

Arch Linux / Manjaro

sudo pacman -S nmap

From source (latest version)

To get the very latest version with all features:

# Build dependencies
sudo apt install -y build-essential libssl-dev libpcap-dev

# Download the sources from nmap.org
wget https://nmap.org/dist/nmap-7.95.tar.bz2
tar -xjf nmap-7.95.tar.bz2
cd nmap-7.95/

# Compile and install
./configure
make
sudo make install

nmap --version

Basic syntax

The general Nmap syntax is:

nmap [options] target

The target can be an IP address, a hostname, an address range or CIDR notation. The options define the scan type, the ports to probe, the timing and the output format.

# Simple scan of an IP
nmap 192.168.1.1

# Scan of a hostname
nmap example.com

# Scan with DNS resolution
nmap -n 192.168.1.1    # disables DNS resolution (faster)
nmap -R 192.168.1.1    # forces reverse DNS resolution

Scan types

Nmap offers several scanning methods, each suited to a specific context.

TCP SYN scan (-sS) — the reference stealth scan

The SYN scan is the default scan when Nmap is run with root privileges. It sends a SYN packet and analyzes the response:

• SYN/ACK received: the port is open. Nmap responds with a RST so as not to complete the connection.
• RST received: the port is closed.
• No response: the port is filtered (firewall).

This scan is fast, stealthy (it does not complete the TCP connection) and generally leaves no trace in application logs.

# SYN scan on the 1000 most common ports (requires root)
sudo nmap -sS 192.168.1.1

# SYN scan on all ports
sudo nmap -sS -p- 192.168.1.1

TCP Connect scan (-sT)

The TCP Connect scan uses the operating system's connect() system call to establish a full TCP connection (SYN → SYN/ACK → ACK). It does not require root privileges but is slower and leaves traces in the logs of the target services.

# TCP Connect scan (without root)
nmap -sT 192.168.1.1

# Useful from an unprivileged user or through a SOCKS proxy
nmap -sT --proxies socks4://127.0.0.1:1080 192.168.1.1

UDP scan (-sU)

The UDP scan probes UDP ports. It is inherently slow because UDP is connectionless: Nmap has to wait for the timeout to expire to confirm a filtered port. A UDP port is considered open if a UDP response is received, closed if an ICMP "port unreachable" is received, and open|filtered in the absence of a response.

# UDP scan (slow, requires root)
sudo nmap -sU 192.168.1.1

# UDP scan on the most common ports only
sudo nmap -sU --top-ports 100 192.168.1.1

# Combined TCP SYN + UDP
sudo nmap -sS -sU -p T:80,443,22,U:53,123,161 192.168.1.1

Service version detection (-sV)

The -sV option enables version detection. After identifying the open ports, Nmap sends specialized probes to identify the exact service and its version number. The nmap-service-probes database contains thousands of signatures.

# Version detection on open ports
sudo nmap -sV 192.168.1.1

# Detection intensity (0=light, 9=exhaustive, default=7)
sudo nmap -sV --version-intensity 9 192.168.1.1

Example output:

PORT    STATE SERVICE VERSION
22/tcp  open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.6 (Ubuntu Linux; protocol 2.0)
80/tcp  open  http    nginx 1.24.0
443/tcp open  ssl     nginx 1.24.0

OS detection (-O)

Nmap uses TCP/IP fingerprinting techniques — analyzing TTL fields, TCP window sizes, TCP options, ICMP behavior — to identify the remote operating system with a confidence level expressed as a percentage.

# OS detection (requires root)
sudo nmap -O 192.168.1.1

# Enable OS detection even on difficult hosts
sudo nmap -O --osscan-guess 192.168.1.1

Example output:

OS details: Linux 5.4 - 5.15
OS CPE: cpe:/o:linux:linux_kernel:5

Aggressive scan (-A)

The -A option is a shortcut that simultaneously enables version detection (-sV), OS detection (-O), traceroute (--traceroute) and the default NSE scripts (-sC). It is the most complete and the most "noisy" scan on the network.

# Full aggressive scan
sudo nmap -A 192.168.1.1

# Aggressive scan with verbose output
sudo nmap -A -v 192.168.1.1

Target management

Nmap offers great flexibility for defining the targets to scan.

Single IP, hostname

nmap 192.168.1.10
nmap myserver.local
nmap example.com

Address range

# Range with a dash
nmap 192.168.1.1-50

# Subnet range with a wildcard
nmap 192.168.1.*

# Multiple hosts separated by spaces
nmap 192.168.1.1 192.168.1.5 192.168.1.10

CIDR notation

# Scan an entire /24 subnet (254 hosts)
sudo nmap -sn 192.168.1.0/24

# /16 subnet (65534 hosts) — prefer narrowing the target
sudo nmap -sn 10.0.0.0/16

Target file (-iL)

To scan a list of hosts stored in a text file (one IP or hostname per line):

# Contents of targets.txt
# 192.168.1.1
# 192.168.1.5
# web-server.local

sudo nmap -iL targets.txt -sV -oA results

Excluding targets (--exclude, --excludefile)

# Exclude an IP from a subnet scan
sudo nmap 192.168.1.0/24 --exclude 192.168.1.1

# Exclude a list of hosts from a file
sudo nmap 192.168.1.0/24 --excludefile exclusions.txt

Port management

Specifying ports (-p)

# Single port
nmap -p 80 192.168.1.1

# Multiple ports
nmap -p 22,80,443,8080 192.168.1.1

# Port range
nmap -p 1-1024 192.168.1.1

# All TCP ports (1-65535)
nmap -p- 192.168.1.1

# Combined TCP and UDP ports
nmap -p T:80,443,U:53,161 192.168.1.1

Most common ports (--top-ports, -F)

# The 100 most common ports (fast)
nmap -F 192.168.1.1

# The N most common ports (based on frequency in nmap-services)
nmap --top-ports 200 192.168.1.1
nmap --top-ports 1000 192.168.1.1

Timing options (-T0 to -T5)

Timing controls the speed and aggressiveness of the scan. A high timing is faster but more visible and less reliable on congested networks.

# Fast scan on a reliable local network
sudo nmap -T4 -F 192.168.1.0/24

# Discreet scan to avoid IDS
sudo nmap -T1 -sS 10.0.0.1

NSE scripts (Nmap Scripting Engine)

The NSE scripting engine is one of Nmap's most powerful features. It lets you run Lua scripts to automate advanced tasks: vulnerability detection, service enumeration, authentication testing, and so on. Nmap includes more than 600 scripts organized into categories.

Main categories

• auth: tests authentication mechanisms (default credentials, bypass).
• broadcast: host discovery via broadcast (mDNS, DHCP, etc.).
• default: scripts considered useful, fast and non-intrusive (enabled by -sC).
• discovery: enumeration of additional information (DNS, SNMP, LDAP).
• exploit: actual exploitation attempts (caution, intrusive).
• fuzzer: fuzzing tests on protocols.
• intrusive: aggressive scripts that can trigger alerts or impact services.
• malware: detection of known backdoors and malware.
• safe: non-intrusive scripts with no impact on target services.
• version: version detection extensions.
• vuln: detection of known vulnerabilities (CVEs, misconfigurations).

Using scripts

# Default scripts (-sC is equivalent to --script=default)
sudo nmap -sC 192.168.1.1

# Specific script
sudo nmap --script http-title 192.168.1.1

# Full category
sudo nmap --script vuln 192.168.1.1

# Multiple categories
sudo nmap --script "auth,discovery" 192.168.1.1

# Script with arguments
sudo nmap --script http-brute --script-args http-brute.hostname=example.com 192.168.1.1

Concrete NSE script examples

# Detect Heartbleed on port 443
sudo nmap -p 443 --script ssl-heartbleed 192.168.1.1

# Detect SMBv1 (EternalBlue/WannaCry) on Windows
sudo nmap -p 445 --script smb-vuln-ms17-010 192.168.1.0/24

# Test default SSH credentials
sudo nmap -p 22 --script ssh-brute 192.168.1.1

# Enumerate SMB shares
sudo nmap -p 445 --script smb-enum-shares 192.168.1.1

# Retrieve HTTP headers and the page title
sudo nmap -p 80,443 --script http-headers,http-title 192.168.1.1

# Detect misconfigured RDP services
sudo nmap -p 3389 --script rdp-enum-encryption 192.168.1.0/24

# List the available scripts in a category
ls /usr/share/nmap/scripts/ | grep vuln

Output formats

Nmap offers several output formats to integrate its results into analysis or reporting workflows.

# Simple text output
sudo nmap -sV 192.168.1.0/24 -oN network_scan.txt

# XML output for automated parsing
sudo nmap -sV 192.168.1.0/24 -oX network_scan.xml

# Grepable output
sudo nmap -sV 192.168.1.0/24 -oG network_scan.gnmap

# All formats at once (recommended for audits)
sudo nmap -A 192.168.1.0/24 -oA audit_$(date +%Y%m%d)

# Extract hosts with port 22 open from the grepable output
grep "22/open" network_scan.gnmap | awk '{ print $2 }'

# Parse the XML with nmap-parse-output (third-party tool)
nmap-parse-output network_scan.xml hosts-with-port 80

Practical use cases

Case 1: Network inventory scan

Discover all active hosts on a subnet without scanning ports (ping scan):

# Ping scan: host discovery only (fast)
sudo nmap -sn 192.168.1.0/24

# With DNS resolution disabled (even faster)
sudo nmap -sn -n 192.168.1.0/24

# Save the inventory
sudo nmap -sn 192.168.1.0/24 -oG - | grep "Status: Up" | awk '{ print $2 }' > active_hosts.txt

Case 2: Detecting exposed services

Identify all listening services on a server, along with their versions:

# Full version scan on all ports
sudo nmap -sV -p- -T4 --open 192.168.1.10

# Show only open ports
sudo nmap --open -sV 192.168.1.10

# Detect web services on non-standard ports
sudo nmap -sV --script http-title -p 80,443,8080,8443,8888,3000 192.168.1.10

Case 3: Auditing firewall rules

Verify that firewall rules are correctly applied from the outside:

# Scan from an external machine and compare with the expected policy
sudo nmap -sS -sV -p- 203.0.113.10

# Test evasion techniques (ACK scan to map stateful rules)
sudo nmap -sA -p 80,443 203.0.113.10

# Scan with fragmentation to test packet filtering rules
sudo nmap -sS -f 192.168.1.1

# Test whether a firewall is stateful or stateless (Window scan)
sudo nmap -sW 192.168.1.1

Case 4: Quick web server audit

# Targeted scan on web ports with appropriate NSE scripts
sudo nmap -sV -p 80,443,8080,8443 \
    --script "http-headers,http-title,http-methods,http-security-headers,ssl-cert,ssl-enum-ciphers" \
    -T4 \
    -oA web_audit_$(date +%Y%m%d) \
    myserver.example.com

Legal and ethical best practices

Using Nmap, like any security auditing tool, must comply with a strict framework:

• Explicit authorization: Always obtain written authorization before scanning systems you do not own. Document the scope, the dates and the authorized methods.
• Test environment: Favor a dedicated lab (virtual machines, isolated network) to learn and test.
• Legal platforms: Platforms such as HackTheBox, TryHackMe or VulnHub provide legal environments for practice.
• Minimal impact: Adjust the timing (-T2 or -T3) on production environments to limit network load.
• Logging: Always save your scans with -oA to trace the operations performed.
• Coordination: Inform the network/security team before any scan, even an authorized one, to avoid triggering unnecessary alerts.
• Personal data: Scan results can reveal sensitive information about the infrastructure. Treat them as confidential data.

Useful commands — Summary table

Conclusion

Nmap is an essential tool for any system administrator or security professional. Its wealth of features — from simple pings to advanced NSE scripts — makes it the Swiss Army knife of network mapping. Mastering Nmap means understanding in depth the attack surface of your infrastructure and being able to audit it regularly.

The natural next step is to combine Nmap with complementary tools: Fail2Ban to protect against incoming scans, Suricata or Snort to detect scan attempts on your network, and Lynis for a complete security audit of the operating system. Network security is a continuous process: regularly scanning your own network with Nmap is one of the best ways to keep an accurate view of your exposure.