Nmap (Network Mapper) – Complete Teaching Content
Introduction to Nmap
• Nmap is an open-source network scanner used for:
o Host discovery (finding live systems).
o Port scanning (finding open ports).
o Service/version detection.
o OS detection.
o Vulnerability detection (with NSE scripts).
Command structure:
nmap [scan types/options] [target]
1. Host Discovery (Finding Live Hosts)
Command Explanation Example
Ping scan (checks if hosts are up without port nmap -sn
nmap -sn <target>
scan). [Link]/24
nmap -Pn
Treat all hosts as online, skip host discovery. nmap -Pn [Link]
<target>
nmap -n <target> Disables DNS resolution (faster). nmap -n [Link]
nmap -R <target> Force reverse DNS resolution. nmap -R [Link]
2. Port Scanning Techniques
Command Explanation Example
nmap -sS TCP SYN Scan (Stealth scan, default
nmap -sS [Link]
<target> for root).
nmap -sT TCP Connect Scan (full 3-way
nmap -sT [Link]
<target> handshake, less stealthy).
Command Explanation Example
nmap -sU UDP Scan (slow, used for DNS,
nmap -sU [Link]
<target> SNMP, DHCP).
nmap -sA ACK Scan (used for firewall rule
nmap -sA [Link]
<target> detection).
nmap -sF FIN Scan (sneaky, sends FIN
nmap -sF [Link]
<target> packets).
nmap -sX Xmas Scan (sets FIN, PSH, URG
nmap -sX [Link]
<target> flags).
nmap -sN NULL Scan (sends packet with no
nmap -sN [Link]
<target> flags).
nmap -p nmap -p 22,80,443 [Link] / nmap -
Specific ports or range.
<range> p 1-1000 [Link]
nmap -p-
Scan all 65535 ports. nmap -p- [Link]
<target>
3. Service & Version Detection
Command Explanation Example
Detects service version running on
nmap -sV <target> nmap -sV [Link]
open ports.
nmap -sV --version- Controls how aggressive version nmap -sV --version-intensity 9
intensity <0-9> detection is. [Link]
4. Operating System Detection
Command Explanation Example
nmap -O <target> Enables OS detection. nmap -O [Link]
Command Explanation Example
nmap -O --osscan- Limit OS detection to relevant nmap -O --osscan-limit
limit hosts. [Link]
5. Aggressive Scan (All-in-One)
Command Explanation Example
nmap -A Enables OS detection, version detection, script scanning, nmap -A
<target> traceroute. [Link]
6. Scan Timing & Performance
Command Explanation Example
Timing template (0 = paranoid, 5 =
nmap -T<0-5> nmap -T4 [Link]
insane).
nmap --max-retries nmap --max-retries 2
Set maximum probe retries.
<num> [Link]
nmap --host-timeout Abort scanning hosts that take too nmap --host-timeout 60s
<time> long. [Link]
7. Output Options
Command Explanation Example
nmap -oN <file> Normal output. nmap -oN [Link] [Link]
nmap -oX <file> XML output. nmap -oX [Link] [Link]
nmap -oG <file> Grepable output. nmap -oG [Link] [Link]
nmap -v Verbose mode (more info). nmap -v [Link]
nmap -vv Extra verbose. nmap -vv [Link]
8. Firewall & IDS Evasion
Command Explanation Example
Fragment packets (bypass
nmap -f <target> nmap -f [Link]
firewalls).
nmap --mtu <num> Set custom MTU for packet size. nmap --mtu 32 [Link]
nmap --data-length nmap --data-length 50
Append random data to packets.
<num> [Link]
nmap -D RND:10
Use decoy IPs to confuse IDS. nmap -D RND:10 [Link]
<target>
nmap -S <IP> Spoof source IP. nmap -S [Link] [Link]
Use specific source port (e.g., port
nmap -g <port> nmap -g 80 [Link]
80).
9. Nmap Scripting Engine (NSE)
Command Explanation Example
nmap --script <script> Run specific script. nmap --script=vuln [Link]
nmap --script <category> Run scripts by category. nmap --script=auth [Link]
nmap --script-help <script> Show script details. nmap --script-help ftp-anon
Categories include:
• auth (authentication)
• broadcast (network discovery)
• brute (brute-force attacks)
• default (default scripts)
• dos (DoS scripts)
• exploit (exploit scripts)
• vuln (vulnerability detection)
10. Practical Lab Examples
1. Find live hosts in your network:
nmap -sn [Link]/24
2. Find IP of Metasploitable VM:
nmap -sP [Link]/24
3. Scan open ports of Metasploitable:
nmap -p- [Link]
4. Identify running services:
nmap -sV [Link]
5. Full aggressive scan (fingerprinting):
nmap -A [Link]