THE COMPLETE NMAP HANDBOOK

Beginner to Advanced Network Scanning, Reconnaissance &

Enumeration

Professional Training Guide for Ethical Hackers, SOC Analysts & Penetration Testers

PREFACE
Modern cybersecurity begins with visibility.

Before exploitation, privilege escalation, persistence, malware deployment, or lateral movement can occur,
an attacker must first understand the target environment.

This process is called reconnaissance.

Reconnaissance is the foundation of penetration testing, ethical hacking, red teaming, threat hunting, and
network defense.

Among all reconnaissance tools ever created, one tool has become the industry standard:

Nmap.

Nmap, short for Network Mapper, is one of the most powerful network scanning and enumeration
frameworks ever developed.

It is used by:

• Ethical hackers
• Penetration testers
• SOC analysts
• Incident responders
• Red teams
• Blue teams
• Government agencies
• Network engineers
• Security researchers

Nmap allows analysts to:

• Discover hosts
• Scan ports

1
 • Identify services
• Detect operating systems
• Enumerate applications
• Detect vulnerabilities
• Identify misconfigurations
• Map enterprise networks
• Assess exposure
• Investigate attacks

This handbook is designed to take students from complete beginner level to advanced Nmap operator.

Unlike basic tutorials that only explain commands, this book explains:

• How scanning actually works

• TCP/IP fundamentals
• Packet behavior
• Firewall interactions
• Detection mechanisms
• Enumeration methodologies
• Enterprise reconnaissance workflows
• Offensive and defensive perspectives

This is not merely a command reference.

This is a complete professional reconnaissance training handbook.

TABLE OF CONTENTS
1. Introduction to Nmap
2. Networking Foundations
3. Understanding Ports & Services
4. Installing & Configuring Nmap
5. Host Discovery
6. Port Scanning Fundamentals
7. TCP Scanning Techniques
8. UDP Scanning Techniques
9. Advanced Scan Types
10. Service & Version Detection
11. Operating System Detection
12. Timing & Performance Optimization
13. Firewall Evasion & Stealth
14. Nmap Scripting Engine (NSE)
15. Vulnerability Scanning
16. Web Enumeration
17. SMB Enumeration
18. FTP & Mail Enumeration

2
 19. Enterprise Reconnaissance
20. Wireless & Internal Network Scanning
21. Detection & Defense
22. Real-World Penetration Testing Workflows
23. Reporting & Documentation
24. Advanced Labs
25. Red Team Methodologies
26. Blue Team Detection Techniques
27. Troubleshooting Nmap
28. Automation & Scripting
29. Final Capstone Exercises

CHAPTER 1 — INTRODUCTION TO NMAP

What Is Nmap?
Nmap stands for Network Mapper.

It is an open-source network reconnaissance and security auditing tool developed by Gordon Lyon (Fyodor).

Nmap is designed to discover:

• Live hosts
• Open ports
• Running services
• Operating systems
• Firewall rules
• Application versions
• Vulnerabilities

Nmap works by sending specially crafted packets to systems and analyzing the responses.

This process reveals information about the target network.

Why Nmap Matters

Before attacking or defending a system, you must first understand the network.

Nmap provides visibility.

Without visibility:

• Administrators cannot secure infrastructure.

3
 • Attackers cannot identify targets.
• SOC teams cannot understand exposure.
• Penetration testers cannot enumerate services.

Nmap is therefore one of the most important tools in cybersecurity.

Common Uses of Nmap

Network Discovery

Identify live hosts on a network.

Example:

nmap [Link]/24

Port Scanning

Determine open ports.

Example:

nmap -p 1-65535 [Link]

Service Enumeration

Detect application versions.

Example:

nmap -sV [Link]

OS Detection

Identify operating systems.

Example:

nmap -O [Link]

4
Vulnerability Detection

Run NSE vulnerability scripts.

Example:

nmap --script vuln [Link]

Firewall Analysis

Analyze filtering behavior.

Example:

nmap -sA [Link]

Enterprise Mapping

Map internal networks and services.

CHAPTER 2 — NETWORKING FOUNDATIONS

Understanding TCP/IP
To master Nmap, students must first understand networking fundamentals.

Nmap operates primarily at packet level.

Understanding:

• TCP
• UDP
• IP
• ICMP
• ARP
• Ethernet

is essential.

5
The OSI Model
The OSI model divides communication into seven layers.

Layer Purpose

7 Application

6 Presentation

5 Session

4 Transport

3 Network

2 Data Link

1 Physical

Nmap primarily interacts with:

• Layer 3 (IP)
• Layer 4 (TCP/UDP)

IP Addresses
Every network device uses an IP address.

Examples:

• [Link]
• [Link]
• [Link]

IP addresses identify systems on a network.

Nmap scans these addresses.

Ports
Ports identify services.

Examples:

6
 Port Service

21 FTP

22 SSH

23 Telnet

25 SMTP

53 DNS

80 HTTP

443 HTTPS

445 SMB

3389 RDP

An open port indicates a listening service.

TCP vs UDP

TCP

Reliable communication.

Features:

• Handshakes
• Retransmissions
• Error correction

UDP

Fast but unreliable.

Features:

• No handshake
• No retransmission
• Lightweight communication

UDP scanning behaves very differently from TCP scanning.

7
CHAPTER 3 — INSTALLING & CONFIGURING NMAP
Installing on Linux
Ubuntu/Debian:

sudo apt install nmap

Fedora:

sudo dnf install nmap

Arch Linux:

sudo pacman -S nmap

Installing on Windows
Download installer from:

[Link]

Install:

• Nmap
• Zenmap GUI
• Npcap

Installing on macOS
Using Homebrew:

brew install nmap

Verifying Installation
Run:

nmap --version

8
Expected output:

• Nmap version
• NSE version
• OpenSSL support

CHAPTER 4 — HOST DISCOVERY

Understanding Host Discovery
Before scanning ports, Nmap identifies live systems.

This process is called host discovery.

Ping Scan
Command:

nmap -sn [Link]/24

Purpose:

• Discover active hosts

• Skip port scanning

ICMP Discovery
Nmap may use:

• ICMP Echo Requests

• Timestamp requests
• Address mask requests

ARP Discovery
On local networks, Nmap often uses ARP.

ARP discovery is highly accurate within LAN environments.

9
TCP Discovery
Nmap can also use:

• SYN probes
• ACK probes

Useful when ICMP is blocked.

LAB 1 — HOST DISCOVERY

Objective
Identify live hosts on a network.

Step-by-Step Procedure

Step 1 — Open Terminal

Launch terminal or command prompt.

Step 2 — Run Ping Scan

nmap -sn [Link]/24

Step 3 — Observe Results

Identify:

• Active hosts
• Hostnames
• MAC addresses

Step 4 — Document Results

Create inventory:

10
 IP Status

[Link] Up

[Link] Up

Expected Results
Students should:

• Discover active devices

• Understand subnet scanning
• Learn host discovery methods

CHAPTER 5 — PORT SCANNING FUNDAMENTALS

What Is Port Scanning?
Port scanning identifies listening services.

Open ports reveal:

• Running applications
• Potential attack surfaces
• Misconfigurations
• Vulnerabilities

Port States
Nmap identifies several states.

State Meaning

Open Service is listening

Closed No service listening

Filtered Blocked by firewall

Unfiltered Reachable but unclear

Open Filtered

11
 State Meaning

Closed Filtered

Default Port Selection

Nmap scans top 1000 ports by default.

These are selected based on frequency.

Scanning Specific Ports

Example:

nmap -p 80,443 [Link]

Scanning Port Ranges

Example:

nmap -p 1-65535 [Link]

CHAPTER 6 — TCP SCANNING TECHNIQUES

TCP Connect Scan
Command:

nmap -sT [Link]

How It Works

Performs full TCP handshake:

1. SYN
2. SYN-ACK
3. ACK

12
Connection fully establishes.

Advantages

• Reliable
• No raw packet privileges required

Disadvantages

• Easily logged
• Less stealthy

SYN Scan
Command:

nmap -sS [Link]

Most common scan type.

How SYN Scan Works

1. Send SYN
2. Receive SYN-ACK
3. Send RST instead of ACK

Connection never fully establishes.

Advantages

• Faster
• Stealthier
• Widely used by professionals

Disadvantages

• Requires administrative privileges

13
LAB 2 — TCP SYN SCANNING
Objective
Understand SYN scan behavior.

Step-by-Step Procedure

Step 1 — Open Wireshark

Start packet capture.

Step 2 — Run SYN Scan

sudo nmap -sS [Link]

Step 3 — Stop Capture

After scan completes.

Step 4 — Analyze Packets

Observe:

• SYN packets
• SYN-ACK responses
• RST packets

Step 5 — Compare with TCP Connect Scan

Run:

nmap -sT [Link]

Compare behavior.

14
Expected Results
Students should understand:

• Half-open scanning
• Stealth behavior
• TCP handshake interactions

CHAPTER 7 — UDP SCANNING

Understanding UDP Scans
UDP scanning is more difficult than TCP scanning.

Reasons:

• No handshake
• No acknowledgments
• Inconsistent responses

UDP Scan Command

sudo nmap -sU [Link]

Common UDP Services

Port Service

53 DNS

67 DHCP

69 TFTP

123 NTP

161 SNMP

UDP Scan Challenges

Open UDP ports often provide no response.

15
Closed UDP ports may respond with:

ICMP Port Unreachable

This makes scanning slower.

LAB 3 — UDP SCANNING

Objective
Analyze UDP scanning.

Step-by-Step Procedure

Step 1 — Start Wireshark Capture

Step 2 — Run UDP Scan

sudo nmap -sU target_ip

Step 3 — Analyze ICMP Responses

Observe:

• ICMP unreachable messages

• Lack of responses from open ports

Expected Results
Students should understand:

• UDP scan behavior

• ICMP error handling
• Slow scan characteristics

16
CHAPTER 8 — ADVANCED SCANNING TECHNIQUES
FIN Scan
Command:

sudo nmap -sF [Link]

Sends FIN packets.

NULL Scan
Command:

sudo nmap -sN [Link]

No flags set.

Xmas Scan
Command:

sudo nmap -sX [Link]

Uses:

• FIN
• PSH
• URG

ACK Scan
Command:

sudo nmap -sA [Link]

Used primarily for firewall analysis.

17
Window Scan
Command:

sudo nmap -sW [Link]

Analyzes TCP window sizes.

Maimon Scan
Command:

sudo nmap -sM [Link]

Specialized FIN/ACK behavior.

CHAPTER 9 — SERVICE & VERSION DETECTION

Service Enumeration
Open ports alone are insufficient.

Analysts must identify:

• Application names
• Versions
• Vendors
• Configurations

Version Detection
Command:

nmap -sV [Link]

Example Output
22/tcp open ssh OpenSSH 8.2 80/tcp open http Apache httpd 2.4

18
Why Version Detection Matters
Software versions reveal:

• Known vulnerabilities
• Exploitable services
• Outdated applications

LAB 4 — SERVICE ENUMERATION

Objective
Identify running applications.

Step-by-Step Procedure

Step 1 — Run Service Scan

nmap -sV [Link]

Step 2 — Identify Services

Document:

• Port numbers
• Service names
• Application versions

Step 3 — Research Vulnerabilities

Search versions for:

• CVEs
• Exploits
• Misconfigurations

19
Expected Results
Students should:

• Enumerate applications
• Understand attack surface analysis

CHAPTER 10 — OPERATING SYSTEM DETECTION

OS Fingerprinting
Nmap identifies operating systems by analyzing:

• TCP/IP stack behavior

• TTL values
• Window sizes
• Response patterns

OS Detection Command
sudo nmap -O [Link]

Example Results
• Linux Kernel 5.x
• Windows Server 2019
• Cisco IOS

Aggressive Scanning
Command:

sudo nmap -A [Link]

Includes:

• OS detection
• Version detection
• NSE scripts

20
 • Traceroute

CHAPTER 11 — FIREWALL EVASION & STEALTH

Why Stealth Matters
Organizations monitor networks.

Aggressive scans may trigger:

• IDS alerts
• SIEM detection
• Firewall blocking

Fragmented Packets
Command:

sudo nmap -f [Link]

Splits packets into fragments.

Decoy Scanning
Command:

sudo nmap -D RND:10 [Link]

Adds fake source addresses.

MAC Address Spoofing

Command:

sudo nmap --spoof-mac Cisco [Link]

21
Source Port Manipulation
Command:

sudo nmap --source-port 53 [Link]

Timing Templates

Template Speed

T0 Paranoid

T1 Sneaky

T2 Polite

T3 Normal

T4 Aggressive

T5 Insane

CHAPTER 12 — NMAP SCRIPTING ENGINE (NSE)

What Is NSE?
Nmap Scripting Engine allows automation.

NSE scripts can:

• Detect vulnerabilities
• Enumerate services
• Brute-force credentials
• Extract information

Running NSE Scripts

Command:

nmap --script vuln [Link]

22
Script Categories

Category Purpose

auth Authentication

vuln Vulnerability detection

brute Brute force

discovery Information gathering

malware Malware detection

safe Non-intrusive scripts

SMB Enumeration Example

nmap --script smb-enum-shares -p 445 [Link]

CHAPTER 13 — VULNERABILITY SCANNING

Using NSE for Vulnerability Detection
Nmap can detect:

• SMB vulnerabilities
• FTP misconfigurations
• Weak SSL/TLS
• Anonymous access
• Exposed services

Vulnerability Scan Example

nmap --script vuln [Link]

Important Note
Nmap is not a full vulnerability scanner like:

• Nessus

23
 • OpenVAS
• Qualys

However, NSE provides strong reconnaissance capabilities.

CHAPTER 14 — WEB ENUMERATION

HTTP Enumeration
Nmap can identify:

• Web servers
• Titles
• Directories
• Headers
• Technologies

HTTP Title Script

nmap --script http-title [Link]

HTTP Headers
nmap --script http-headers [Link]

Directory Enumeration
nmap --script http-enum [Link]

CHAPTER 15 — SMB ENUMERATION

SMB Overview
SMB is heavily targeted in enterprise environments.

Nmap can enumerate:

• Shares

24
 • Users
• OS versions
• Security settings

Common SMB Scripts

smb-enum-shares smb-os-discovery smb-enum-users

CHAPTER 16 — ENTERPRISE RECONNAISSANCE

Internal Network Assessments
Enterprise scanning requires:

• Asset identification
• Segmentation awareness
• Firewall understanding
• Risk management

Safe Scanning Practices

Avoid:

• Overwhelming production systems

• Aggressive timing
• Unsafe scripts

Documentation
Track:

• Hosts
• Ports
• Services
• Findings
• Risks

25
CHAPTER 17 — DETECTION & DEFENSE
How Defenders Detect Nmap
SOC teams monitor:

• SYN floods
• Sequential port scans
• Unusual packet patterns
• NSE activity

IDS Signatures
Snort and Suricata often detect:

• SYN scans
• Xmas scans
• FIN scans

Defensive Measures
Organizations use:

• Firewalls
• IDS/IPS
• SIEM correlation
• Rate limiting
• Segmentation

CHAPTER 18 — REAL-WORLD PENETRATION

TESTING WORKFLOW
Phase 1 — Scope Identification
Understand:

• Targets
• Allowed IP ranges
• Restrictions

26
Phase 2 — Host Discovery
Identify live systems.

Phase 3 — Port Enumeration

Identify open services.

Phase 4 — Service Enumeration

Identify applications.

Phase 5 — Vulnerability Analysis

Search for weaknesses.

Phase 6 — Reporting
Document findings professionally.

LAB 5 — COMPLETE RECONNAISSANCE WORKFLOW

Objective
Perform full reconnaissance assessment.

Step-by-Step Procedure

Step 1 — Host Discovery

nmap -sn [Link]/24

27
Step 2 — Port Scan

nmap -sS -p 1-1000 target_ip

Step 3 — Version Detection

nmap -sV target_ip

Step 4 — OS Detection

sudo nmap -O target_ip

Step 5 — NSE Enumeration

nmap --script vuln target_ip

Step 6 — Documentation

Record:

• Hosts
• Ports
• Services
• Risks
• Recommendations

Expected Results
Students should complete:

• Full reconnaissance workflow

• Enumeration methodology
• Risk analysis

28
CHAPTER 19 — AUTOMATION & SCRIPTING
Output Formats
Nmap supports:

• Normal output
• Grepable output
• XML
• JSON-compatible parsing

XML Output
nmap -oX [Link] [Link]

Grepable Output
nmap -oG [Link] [Link]

Automation with Bash

Example:

for ip in $(cat [Link]); do nmap -sV $ip done

CHAPTER 20 — FINAL THOUGHTS

Nmap is one of the most important tools in cybersecurity.

However, mastering Nmap requires more than memorizing commands.

Professionals must understand:

• TCP/IP behavior
• Protocol interactions
• Firewall responses
• Enumeration methodology
• Threat detection
• Safe scanning practices

29
The best Nmap operators think like:

• Network engineers
• Attackers
• Defenders
• Investigators

Reconnaissance is the foundation of cybersecurity.

And Nmap remains the industry standard for reconnaissance.

END OF HANDBOOK

30