/PLAYBOOK · 2026-07-27

Nmap Security Scanning in Practice: From Port Probing to Vulnerability Discovery

Covers Nmap host discovery, port scanning, service version detection, and NSE vulnerability scripts. Includes SYN and UDP scans, OS fingerprinting, stealth techniques, and runnable command examples.

Scope

Nmap (Network Mapper) is a core port-scanning and network-probing tool in network security. It applies to penetration testing, internal enterprise security audits, attack-surface inventory, and compliance checks. This tutorial is for security engineers, system administrators, and DevOps staff. It covers the full chain from basic port scanning to service identification, OS fingerprinting, and NSE vulnerability scripts.

Prerequisites

Nmap installed (this article uses 7.95); install command: sudo apt install -y nmap
Legal authorization to scan the target assets
root or sudo (required for some scan types)
Basic TCP/IP knowledge

Mechanism

Nmap works by sending crafted packets to a target and inferring open ports, running services, and OS type from response characteristics. Supported scan types: TCP SYN scan (half-open; fast and stealthy; default mode sends SYN, SYN/ACK means the port is open), TCP Connect scan (full three-way handshake, requires root, more reliable but easier to log), UDP scan (sends empty UDP packets; infers port state from ICMP unreachable replies), and Ping scan (host discovery). The NSE (Nmap Scripting Engine) adds vulnerability detection; 600+ security scripts are built in.

Procedure

Step 1: Host Discovery (Asset Inventory)

# Scan the entire /24, find live hosts
nmap -sn 192.168.1.0/24
# Output: Nmap done: 256 IP addresses (15 hosts up)

# Skip ping, scan directly (bypass firewall ICMP filtering)
nmap -Pn 192.168.1.0/24

# ARP scan (faster on the same segment)
nmap -PR 192.168.1.0/24

Step 2: Port Scanning (Core)

# TCP SYN scan (default, requires root)
nmap -sS 192.168.1.100
# Sample output: 22/tcp open ssh, 80/tcp open http, 3306/tcp open mysql

# Custom port range
nmap -p 1-10000 192.168.1.100

# Scan common high-risk ports
nmap -p 21,22,23,25,53,80,443,3306,3389,5432,6379,27017 192.168.1.100

# Full port scan (65535 ports, slower; use --max-retries and -T to speed up)
nmap -p- --max-retries 1 -T4 192.168.1.100

# UDP port scan (DNS, SNMP, and similar)
nmap -sU -p 53,161,162,500,1194 192.168.1.100

Step 3: Service Version and OS Detection

# Service version detection (-sV)
nmap -sV 192.168.1.100
# Sample output: 80/tcp open http Apache httpd 2.4.57

# OS fingerprinting (-O, requires root)
nmap -O 192.168.1.100
# Output: Aggressive OS guesses: Linux 5.x (95%), Linux 4.x (91%)

# Combined scan (version + OS + scripts)
nmap -sV -O --osscan-guess 192.168.1.100

# Add --traceroute to show the route
nmap -sV --traceroute 192.168.1.100

Step 4: NSE Vulnerability Script Scanning (Critical)

# Common vulnerability script categories
# Scan for security misconfigurations
nmap --script=vuln 192.168.1.100
# Scan for weak credentials
nmap --script=auth 192.168.1.100
# Scan for specific CVEs
nmap -p 80 --script=http-vuln-cve2024-* 192.168.1.100

# Broad security check for web services
nmap -p 80,443 --script=http-* 192.168.1.100

# Scan default credentials and common vulnerabilities
nmap -p 3306 --script=mysql-* 192.168.1.100
nmap -p 6379 --script=redis-* 192.168.1.100
nmap -p 27017 --script=mongodb-* 192.168.1.100

# SSL/TLS security checks
nmap --script=ssl-enum-ciphers -p 443 192.168.1.100
nmap --script=ssl-heartbleed -p 443 192.168.1.100

Step 5: Evasion and Stealth Scanning

# Fragmented scan (bypass simple packet-filter firewalls)
nmap -f 192.168.1.100

# Set source port (some firewalls trust ports below 1024)
nmap --source-port 53 192.168.1.100

# Spoof MAC address
nmap --spoof-mac 00:11:22:33:44:55 192.168.1.100

# IDLE stealth scan (via a zombie host; hard to attribute)
nmap -sI <zombie-host-IP> 192.168.1.100

# Timing (T0 slowest, T5 fastest)
nmap -T2 192.168.1.100  # Slow, less likely to be detected
nmap -T4 192.168.1.100  # Fast (default)

Step 6: Output Reports

# Output a searchable file
nmap -oN scan_result.txt 192.168.1.100
# XML (machine-parseable)
nmap -oX scan_result.xml 192.168.1.100
# HTML report
nmap -oA full_scan 192.168.1.100  # Writes Normal/XML/Grepable together

# Convert XML to HTML with xsltproc
xsltproc scan_result.xml -o scan_report.html

Verification

# Check Nmap version
nmap --version

# Compare results across scan types
nmap -sT -p 22,80,443 localhost  # Connect scan
nmap -sS -p 22,80,443 localhost  # SYN scan (requires sudo)

# Verify NSE scripts
nmap --script-updatedb  # Update NSE script database
ls /usr/share/nmap/scripts/ | wc -l  # Script count (typically 600+)

FAQ

Q1: Why does the scan show all ports as filtered?

Usually caused by: 1) the firewall uses a default DROP policy, so ports not explicitly allowed are dropped; 2) the target has iptables with DROP rules; 3) an IPS/IDS on the network is intercepting scan traffic. Try -sT (TCP Connect) instead of -sS, or -Pn -n to skip host discovery and DNS resolution, or -f fragmentation to bypass packet filters.

Q2: Nmap vulnerability scanning (script=vuln) found nothing. Does that mean the system is secure?

No. NSE vuln scripts cover a limited set of CVEs (about 200+) and mostly detect known high-severity or public issues. A clean Nmap result only means there are no known public vulnerabilities that NSE can detect. Real environments also have logic bugs, 0days, and misconfigurations (directory traversal, sensitive data exposure). Combine Nmap with dedicated scanners (Nessus, OpenVAS) and manual testing.

Summary

Nmap is a baseline tool for security practitioners. Host discovery, port scanning, service identification, and vulnerability detection can be chained in a few commands. In practice, use a staged approach: find live hosts first (-sn), then identify services on open ports (-sV), then run NSE scripts (--script=vuln). Unauthorized scanning can be illegal; stay within authorized scope.