NMAP — Network Scanning Reference

NMAP
Network Mapper — Study Reference
Scanning · OS Detection · NSE · Firewall Evasion

1. What is Nmap?
Nmap (Network Mapper) is a free, open-source tool used for network discovery and security
auditing. Originally released in 1997 by Gordon Lyon (Fyodor), it has become the industry-
standard utility for mapping networks, identifying hosts, discovering open ports, and
fingerprinting services.

Nmap works by sending crafted packets to target hosts and analysing the responses to
determine what is running, what ports are open, and what operating system is in use.

It runs on Linux, macOS, and Windows, and is routinely used by network administrators,
penetration testers, and security researchers alike.

2. What is Nmap Used For?

• Host discovery — identifying which devices are alive on a network
• Port scanning — determining which TCP/UDP ports are open, closed, or filtered
• Service and version detection — identifying what application is listening on each port
• OS fingerprinting — guessing the operating system of a remote host
• Vulnerability detection — running scripts (NSE) to find known weaknesses
• Firewall and IDS auditing — testing how security controls respond to different packet
types
• Network inventory and compliance checks — documenting what is running on a network

3. Which OSI Layers Does Nmap Interact With Most?

Nmap primarily operates at Layers 3 and 4 of the OSI model, with some activity at Layer 2 for
local network discovery.

Cybersecurity Study Notes Page 1

NMAP — Network Scanning Reference

Layer Name Nmap's Use

Layer 2 Data Link ARP ping for local LAN host discovery
Layer 3 Network IP packet crafting, ICMP pings, traceroute
Layer 4 Transport TCP/UDP port scanning, flag manipulation
Layer 7 Application Service version detection, NSE script
interactions

4. How Does a TCP Scan Work?

Nmap offers two main TCP scanning modes: the SYN scan (-sS) and the full Connect scan (-
sT). Both follow the TCP three-way handshake model, but differ in how much of it they
complete.

The Three-Way Handshake (Recap)

Client ──── SYN ────► Server

Client ◄── SYN/ACK ── Server
Client ──── ACK ────► Server (connection established)

SYN Scan (-sS) — "Half-Open Scan"

• Sends a SYN packet to the target port
• If the port is open: target replies with SYN/ACK — Nmap immediately sends RST to
abort the connection
• If the port is closed: target replies with RST/ACK
• If filtered: no response (or ICMP unreachable)

The connection is never fully established. This makes SYN scans faster and less likely to
appear in application-level logs, since no full session is created.

Connect Scan (-sT) — "Full Connect Scan"

• Completes the full three-way handshake using the OS's connect() system call
• More reliable when raw packet privileges are unavailable (e.g. no root/admin)
• Slower and more visible — every connection is logged by the target application

Cybersecurity Study Notes Page 2

NMAP — Network Scanning Reference

5. How Does a UDP Scan Work?

Unlike TCP, UDP is a connectionless protocol — there is no handshake. Nmap performs UDP
scanning with the -sU flag.

Nmap ──── UDP Packet ────► Target Port

Open: No response (or application-specific reply)

Closed: ICMP Port Unreachable (type 3, code 3)
Filtered: ICMP Unreachable (other type/code) or no response

• If a UDP packet arrives at an open port and the service responds, Nmap marks it open
• If there is no response, Nmap marks the port open|filtered (ambiguous)
• If the target sends back an ICMP Port Unreachable message, the port is marked closed

6. Why Are UDP Scans Slower?

• No handshake means Nmap must wait for a timeout before concluding a port is open|
filtered
• ICMP rate limiting — most operating systems throttle ICMP Unreachable responses (e.g.
Linux limits to ~1 per second by default), forcing Nmap to slow down
• Ambiguity — a non-response could mean open or filtered, requiring retransmits to
confirm
• 65,535 ports to check — without quick RST feedback like TCP, full UDP scans can take
minutes to hours

Tip: Combine -sU with --top-ports 100 to scan only the most commonly used UDP ports and
save significant time.

7. What Does OS Detection Try to Identify?

Enabled with the -O flag, Nmap's OS detection sends a series of TCP, UDP, and ICMP probes
to a target and compares the responses against a database of over 5,000 known OS
fingerprints.

It attempts to identify:
• Operating system family (Linux, Windows, macOS, FreeBSD, etc.)
• OS version and build (e.g. Windows 10 1903, Linux kernel 5.x)
• Device type (router, switch, firewall, printer, phone, general-purpose)

Cybersecurity Study Notes Page 3

NMAP — Network Scanning Reference

• CPU architecture (x86, x86-64, ARM, etc.)

The fingerprinting analyses subtle differences in how TCP/IP stacks are implemented, including:
• Initial TTL values in IP headers
• TCP window sizes in SYN/ACK responses
• Handling of unusual flag combinations (e.g. FIN sent to open port)
• IP ID field sequencing and ICMP response characteristics

OS detection requires at least one open and one closed port to work reliably. Results are given
as a probability — never treat them as absolute.

8. What is the Nmap Scripting Engine (NSE)?

The Nmap Scripting Engine (NSE) allows users to write and run Lua scripts that automate a
wide variety of network tasks. Scripts are invoked with the --script flag.

NSE scripts are grouped into categories:

• auth — testing authentication credentials and mechanisms
• brute — brute-force credential attacks against services
• discovery — gathering additional network information
• exploit — actively exploiting vulnerabilities
• safe — non-intrusive scripts safe to run on any target
• vuln — checking for known CVEs and weaknesses
• malware — detecting signs of malware or backdoors

# Run all default safe scripts

nmap -sC target

# Run a specific script

nmap --script=http-title target

# Run all vuln scripts

nmap --script=vuln target

# Run scripts with arguments

nmap --script=http-brute --script-args userdb=[Link] target

Cybersecurity Study Notes Page 4

NMAP — Network Scanning Reference

9. Common Flags Used on a Scanning Target

Flag Name Description

-sS SYN Scan Stealthy half-open TCP scan (requires
root)
-sT Connect Scan Full TCP connect scan (no root
needed)
-sU UDP Scan Scans UDP ports
-sV Version Detection Detect service/version on open ports
-O OS Detection Attempt to identify target OS
-A Aggressive Enables -sV, -O, -sC, and traceroute
-p Port Range Specify ports: -p 80, -p 1-1000, -p-
-T0 to -T5 Timing Template Controls speed: T0=slowest,
T5=fastest
-Pn No Ping Skip host discovery, assume host is up
-sC Default Scripts Run default NSE scripts (same as --
script=default)
-oN / -oX Output Format Save results in normal or XML format
--top-ports N Top Ports Scan the N most common ports
-v / -vv Verbosity Increase output verbosity
-n No DNS Skip DNS resolution for faster scans
-iL Input List Read targets from a file

10. What is the Difference Between -sS and -sT?

Property -sS (SYN / Stealth) -sT (Full Connect)

Handshake Half-open — RST after SYN/ACK Full three-way handshake
completion
Root required? Yes (raw sockets) No (uses OS connect())
Speed Fast Slower
Logged by target? Usually not (app-level) Yes — full session opened
Reliability High High

Cybersecurity Study Notes Page 5

NMAP — Network Scanning Reference

Property -sS (SYN / Stealth) -sT (Full Connect)

Stealth Higher Lower
Default scan? Yes (if root) Yes (if no root)

11. What Does a "Filtered" Port Mean?

When Nmap reports a port as filtered, it means that a packet was sent to the port but no
definitive response was received. This is most commonly caused by a firewall, packet filter, or
network ACL silently dropping the packets.

Port States Nmap Can Report:

open — Port is accepting connections

closed — Port is reachable, but no service is listening
filtered — Packet dropped / no response (firewall likely present)
open|filtered — Could not determine if open or filtered (common with
UDP)
unfiltered — Port is reachable, but open/closed status is unknown
closed|filtered — Cannot distinguish closed from filtered

A filtered result does not mean the port is necessarily closed — a service may well be running
behind the firewall. It simply means Nmap cannot confirm the state.

12. How Do Ethical Hackers Use Nmap for Firewall Evasion?

Ethical hackers use several Nmap techniques to probe targets while attempting to bypass or
evade firewalls and IDS/IPS systems. These are used in authorised penetration tests to assess
the effectiveness of security controls.

Fragmentation (-f)
Splits packets into small fragments, which some older firewalls may fail to reassemble and
inspect correctly.

nmap -f target

Decoy Scanning (-D)

Makes the scan appear to originate from multiple IP addresses simultaneously, making it harder
to trace back to the real source.

Cybersecurity Study Notes Page 6

NMAP — Network Scanning Reference

nmap -D RND:10 target

nmap -D [Link],[Link],ME target

Idle / Zombie Scan (-sI)

Uses a third-party "zombie" host with predictable IP ID values to conduct a completely blind
scan — the attacker's IP never touches the target directly.

nmap -sI zombie_host target

Spoofed Source IP (-S)

Sends packets with a forged source IP. Useful for testing firewall rules, but responses will go to
the spoofed address, not back to the attacker.

nmap -S spoofed_ip -e eth0 target

Custom MTU (--mtu)

Manually sets the Maximum Transmission Unit for packet fragmentation, giving fine-grained
control beyond -f.

nmap --mtu 8 target

Port / Timing Manipulation

• --source-port 53 — spoof source port 53 (DNS), which many firewalls allow through
• -T1 (Sneaky) or -T0 (Paranoid) — slow the scan down to avoid rate-based detection
• --data-length N — append random data to packets to confuse signature-based IDS

All firewall evasion techniques must only be used against systems you have explicit written
authorisation to test. Unauthorised scanning is illegal in most jurisdictions.

13. The Nmap Xmas Scan (-sX)

The Xmas scan gets its name because it "lights up" a packet with multiple TCP flags at once —
specifically FIN, PSH, and URG — like a Christmas tree full of lights.

nmap -sX target

Cybersecurity Study Notes Page 7

NMAP — Network Scanning Reference

# Packet sent with flags: FIN + PSH + URG all set simultaneously

How It Works
• An Xmas packet is sent with FIN, PSH, and URG flags all set
• Per RFC 793, if the target port is closed, it should respond with RST
• If the port is open or filtered, the target should send no response

No response → open | filtered

RST received → closed
ICMP Unreach → filtered

Key Characteristics
• Works only on RFC 793-compliant TCP stacks — Windows ignores these rules and
always sends RST
• Does not complete a connection, so it does not appear in most application logs
• Can bypass simple stateless packet filters that only block SYN packets
• Less reliable than SYN scans due to OS behaviour differences
• Related scans: NULL scan (-sN, no flags set) and FIN scan (-sF, only FIN flag)

Xmas scans are useful for probing non-Windows systems and older firewalls, but will not work
correctly against Windows targets. Use -sS or -sT for cross-platform TCP scanning.

Cybersecurity Study Notes Page 8