How Nmap Works
1️⃣ WHAT NMAP REALLY IS (UNDER THE HOOD)
Nmap (Network Mapper) is not just a port scanner.
Internally, it is:
A packet-crafting engine
A state machine
A fingerprinting framework
A scripting platform (NSE – Lua based)
Core Components
Component Purpose
Nmap Core (C/C++) Packet generation & analysis
Npcap / libpcap Raw packet capture
TCP/IP Stack Logic Interprets responses
Fingerprint DB OS & service detection
NSE Engine (Lua) Scripted checks
2️⃣ HOW AN NMAP SCAN WORKS (STEP-BY-STEP FLOW)
Let’s assume this command:
nmap -sS -p 22,80 [Link]
🔹 STEP 1: TARGET RESOLUTION
Nmap first resolves:
IP address
Hostname (unless -n )
IPv4 / IPv6
Internally:
Target → Address object → Scan queue
🔹 STEP 2: HOST DISCOVERY (PING PHASE)
Before scanning ports, Nmap checks:
“Is this host alive?”
Depending on privilege & flags, it sends:
ICMP Echo ( ping )
TCP SYN to port 443
TCP ACK to port 80
ICMP Timestamp
If no response, host may be:
Down
Firewalled
👉 If you use -Pn , this step is skipped.
🔹 STEP 3: PORT SCANNING ENGINE STARTS
This is where packet logic kicks in.
For each port:
Nmap crafts a packet
Sends it
Waits for a response
Classifies port state
3️⃣ HOW NMAP USES TCP/IP BEHAVIOR (CORE LOGIC)
This is the heart of Nmap.
🧠 TCP SYN SCAN ( -sS ) LOGIC
Target Response Meaning
SYN + ACK Port is OPEN
RST Port is CLOSED
No response FILTERED
ICMP unreachable FILTERED
Internally (simplified logic):
send SYN → if SYN/ACK → OPEN if RST → CLOSED if no reply → FILTERED
💡 This is why SYN scan is called half-open — no handshake completion.
🧠 TCP CONNECT SCAN ( -sT ) LOGIC
Uses OS connect() syscall:
Full 3-way handshake
Slower
Logged by servers
🧠 UDP SCAN ( -sU ) LOGIC
UDP has no handshake.
Response Meaning
ICMP Port Unreachable CLOSED
Response Meaning
No response OPEN / FILTERED
UDP response OPEN
This is why UDP scans are slow & noisy.
4️⃣ HOW NMAP “BACKGROUND CODE” WORKS (HIGH-
LEVEL)
⚠️Not raw source code — architecture logic
🔹 A) PACKET CREATION
Nmap builds packets manually:
Sets flags (SYN, ACK, FIN)
Adjusts TTL, window size
Adds payload if needed
This is done using:
Raw sockets
libpcap
🔹 B) STATE MACHINE
Each port exists in a state machine:
UNKNOWN → PROBING → RESPONSE → CLASSIFIED
States:
OPEN
CLOSED
FILTERED
UNFILTERED
OPEN|FILTERED
🔹 C) TIMING ENGINE
Nmap dynamically adjusts speed:
Network latency
Packet loss
IDS detection thresholds
This is why -T4 vs -T0 behaves differently.
🔹 D) SERVICE VERSION DETECTION ( -sV )
Once a port is open:
1. Send protocol-specific probes
2. Analyze banner response
3. Match against signature DB
Example:
SSH-2.0-OpenSSH_8.2p1
Matched against:
OpenSSH 8.2p1 Ubuntu
🔹 E) OS DETECTION ( -O )
Uses TCP/IP stack fingerprinting:
TCP window size
TTL
DF bit
Response ordering
Compares against fingerprint database.
🔹 F) NSE SCRIPT ENGINE (VERY IMPORTANT)
Written in Lua
Runs after or during scan
Uses scan results as input
Script categories:
default
safe
vuln
auth
intrusive
5️⃣ NMAP FILES & DIRECTORIES IN LINUX
This is very important for teaching & customization.
📁 MAIN NMAP FILE LOCATIONS (LINUX)
🔹 Nmap binary
/usr/bin/nmap
🔹 NSE Scripts
/usr/share/nmap/scripts/
Example:
ls /usr/share/nmap/scripts/
You’ll see:
[Link] [Link] [Link]
🔹 NSE Script Database
/usr/share/nmap/scripts/[Link]
Update after adding scripts:
nmap --script-updatedb
🔹 OS Fingerprint Database
/usr/share/nmap/nmap-os-db
🔹 Service Version Database
/usr/share/nmap/nmap-service-probes
🔹 MAC Vendor Database
/usr/share/nmap/nmap-mac-prefixes
📁 USER-SIDE OUTPUT FILES
If you save scans:
nmap -oN [Link] [Link]
Saved in:
pwd (current directory)
6️⃣ HOW DEFENDERS DETECT NMAP (IMPORTANT FOR
TEACHING)
Nmap Behavior Defender Detection
SYN flood pattern IDS/IPS
Sequential ports Firewall logs
Version probes WAF
NSE scans SIEM correlation
7️⃣ SUMMARY (ONE-SLIDE VERSION)
Nmap crafts packets → observes responses
Uses TCP/IP rules, not exploits
Classifies ports via response logic
Uses fingerprint DBs for OS & services
NSE adds modular intelligence
Linux stores Nmap intelligence in /usr/share/nmap/