TL;DR — The 5 Nmap commands you'll use most
nmap -sn 192.168.1.0/24 # Host discovery (no port scan)
nmap 192.168.1.10 # Default scan, top 1000 TCP ports
sudo nmap -sV -sC -p- 192.168.1.10 # Full TCP scan + version + scripts
sudo nmap -A 192.168.1.10 # Aggressive: OS, version, scripts, traceroute
sudo nmap --script vuln 192.168.1.10 # Vulnerability scan via NSE
Each is explained in detail below. Skip to Scan Types if you want to dive in, or read on for the full walkthrough.
What is Nmap?
Nmap (Network Mapper) is the most widely used network reconnaissance tool in the world. Created in 1997 by Gordon Lyon (a.k.a. "Fyodor"), it's been continuously developed for nearly three decades and ships pre-installed on Kali Linux. Nmap discovers what hosts are alive on a network, what ports are open on those hosts, what services are running on those ports, and even what operating system each host is likely running.
Every penetration test, security audit, and CTF challenge starts with Nmap. The information it gives you determines what you do next — which exploits to try, which credentials to brute-force, which web apps to investigate. It's the first of the 10 essential Kali Linux tools every pentester learns.
Setting Up a Safe Practice Lab
Before running any nmap commands, you need a target you control. The simplest setup:
- Kali Linux VM — your attack box. See the install guide.
- Metasploitable 2 — intentionally vulnerable Linux VM with dozens of open services. Free download from Rapid7.
- Both VMs on the same host-only network in VirtualBox so they can talk to each other but not the internet.
Once both VMs are running, find your Metasploitable IP (login as msfadmin/msfadmin, then ifconfig). All the examples below assume you're scanning that VM at something like 192.168.56.102.
Installing and Updating Nmap
Nmap ships with Kali, but it's worth checking you're on a recent version. Nmap 7.95 is current as of 2026 with new NSE scripts and improved IPv6 support.
If apt update throws a signing-key or repository error here, see how to fix broken Kali updates. New to the terminal in general? The beginner commands guide covers the basics every command below assumes. For every flag in exhaustive detail, the official Nmap reference guide is the authoritative source.
Nmap Basic Syntax
Every nmap command follows the same pattern:
sudo. Without sudo, nmap falls back to slower TCP connect scans.
Host Discovery: What's Alive?
Before port scanning, you usually want to know which hosts on a network are even alive. This is called host discovery or ping scanning.
-Pn matters: Many modern hosts and firewalls drop ICMP echo requests, making them appear "down" to nmap's default ping. If you know a host exists but nmap reports it as down, add -Pn to skip discovery and scan it anyway. This is essential when scanning external targets.
Port Scanning: What's Open?
Once you know hosts are alive, you scan their ports. Nmap supports several scan types, each with different tradeoffs between speed, stealth, and accuracy.
| Flag | Scan Type | Best For |
|---|---|---|
-sS | TCP SYN (Stealth) | Default for pentesting (requires root). Fast and relatively quiet. |
-sT | TCP Connect | When you don't have root. Completes the full TCP handshake. |
-sU | UDP | Finding DNS, SNMP, NTP services. Very slow. |
-sA | TCP ACK | Mapping firewall rules (filtered vs unfiltered). |
-sN / -sF / -sX | NULL / FIN / Xmas | Evading basic firewalls/IDS. Often unreliable on Windows targets. |
The default scan
Specifying ports
-p-: A common beginner mistake is only scanning the default 1000 ports and missing services running on non-standard ports (think SSH on port 2222, web admin on 8080, custom apps on 5000+). On any real engagement, do a full -p- scan to catch what's hiding.
UDP scanning (-sU)
Everything so far scans TCP ports, but plenty of important services run over UDP — DNS (53), SNMP (161), DHCP (67), NTP (123), and more. TCP scans miss them completely. The catch is that UDP scanning is slow: UDP is connectionless, so an open port often just stays silent, and nmap has to wait and retry before deciding. A full UDP port scan can take hours or even days, which is why you almost always limit it to the common ports.
open|filtered: UDP scans frequently report this state instead of a clean open. It means nmap got no response and can't tell whether the port is open or simply firewalled — and it's completely normal for UDP. Confirm the interesting ones with a version scan (-sV), which sends a real protocol probe and forces a clearer answer.
Service & Version Detection
Knowing port 80 is open isn't very useful by itself. You need to know what's running on it. The -sV flag tells nmap to probe each open port and identify the service and version.
Service version output is gold for pentesters. vsftpd 2.3.4 in the output above is the famous backdoored version with a known exploit in Metasploit. OpenSSH 4.7 is ancient and has multiple known vulnerabilities.
OS Detection
The -O flag tells nmap to fingerprint the target's operating system based on subtle quirks in how it responds to crafted packets. It needs root and at least one open and one closed port to work reliably.
The Aggressive Scan: Everything at Once
Most of the time, you want everything: OS, version, default scripts, and traceroute. The -A flag combines them all.
-A flag is loud. It triggers nearly every IDS/IPS signature, fills the target's logs, and can crash fragile services. Use it on lab targets and authorized engagements where stealth doesn't matter. For real-world testing where stealth matters, build the scan up gradually instead.
NSE: Nmap's Scripting Engine
The Nmap Scripting Engine (NSE) is what transforms nmap from "port scanner" into "lightweight vulnerability scanner." NSE ships with over 600 scripts written in Lua, organized into categories like safe, discovery, vuln, brute, exploit, and intrusive.
Common script usage
NSE script categories
| Category | What It Does | Risk |
|---|---|---|
safe | Won't crash or overload the target | Low |
discovery | Service banners, info gathering | Low |
default | Run by -sC, common quick checks | Low-Medium |
version | Refines version detection | Low |
vuln | Known vulnerability detection (CVEs) | Medium |
brute | Brute-force credentials | High |
exploit | Actually exploits vulnerabilities | Very High |
intrusive | May crash services or generate alerts | High |
dos | Causes denial of service | Critical — never on production |
The most useful NSE scripts
Out of the 600+ available, here are the ones I actually use most often:
vulners.nse from GitHub for live CVE database matching. After running -sV, vulners will cross-reference detected service versions against published CVEs and tell you exactly which vulnerabilities apply. Combined with --script-args mincvss=7.0, it filters to high-severity issues only.
Timing & Performance
Nmap has six timing templates (-T0 through -T5) that control scan speed. Faster scans get noticed by IDS systems; slower scans take forever.
| Template | Name | Use Case |
|---|---|---|
-T0 | Paranoid | IDS evasion. Wait 5+ minutes between probes. Hours per host. |
-T1 | Sneaky | IDS evasion. Wait 15s between probes. |
-T2 | Polite | Reduces bandwidth use. Useful on fragile networks. |
-T3 | Normal | Default. Reasonable speed. |
-T4 | Aggressive | Fast and reliable on stable networks. Common for CTFs. |
-T5 | Insane | Maximum speed, sacrifices accuracy. May miss results. |
Saving and Reading Results
Nmap can save scan results in multiple formats simultaneously. The most useful is -oA ("output all"), which saves three files at once.
-oA. You'll thank yourself later when you need to import findings into Metasploit (it parses the XML), grep through results, or compare what's changed between scans with ndiff.
Firewall & IDS Evasion
If you're scanning targets behind firewalls, basic scans often get blocked. Nmap has several evasion options — most have legitimate uses in authorized testing where you're checking whether IDS/IPS catches your activity.
A Real-World Workflow
How I use Nmap on a typical CTF or lab engagement. The pattern: start broad and fast, then narrow and deep.
This workflow catches the most exploitable services first while still ensuring you don't miss anything. The full -p- scan in step 3 is critical — it catches services on non-standard ports that the top-1000 scan misses.
Lessons From The Field
Things I've learned from years of scanning:
- Always run
-p-at some point. The top 1000 ports miss a surprising amount. SSH on 2222, web admin on 8443, custom apps on weird ports — they're all somewhere in 1-65535. - UDP scans take forever. A full UDP scan can take literal days. Use
--top-ports 100for UDP unless you have a specific reason to scan more. - Service version output is gold. "Apache 2.2.8 from 2008" tells you 99% of what you need to know about a target. Always run
-sVon anything interesting. - Save everything with
-oA. You'll forget what you scanned. The XML output also feeds directly into Metasploit and other tools. - Don't run vuln scripts blindly on production. Some are aggressive and can cause outages. Read the script description before running it.
- nmap is a starting point, not an ending point. A "Apache 2.2.8" doesn't tell you whether the actual app is vulnerable. Use nmap output to guide your manual investigation, not replace it.
The flip side of all this: everything nmap reveals about a target is exactly what an attacker sees on your boxes. If you run servers, my Linux server hardening guide is the defensive counterpart — it closes the doors a scan like this would otherwise find open.
When To Use Something Else
Nmap is the right tool 90% of the time, but a few situations call for alternatives:
- Ultra-fast scanning of huge ranges: Use masscan. It's faster than nmap but less accurate. Common pattern: masscan to find open ports, then nmap to deeply analyze them.
- Web app testing specifically: Once you know a web server is up, switch to Burp Suite, Gobuster/FFUF, and SQLMap.
- Comprehensive vulnerability scanning: Nessus, OpenVAS, or Greenbone do more thorough work than NSE's
vulnscripts. They have larger CVE databases and better reporting. - Wireless reconnaissance: Nmap doesn't do WiFi. Use aircrack-ng or kismet.
Frequently Asked Questions
Is using Nmap legal?
Installing and running Nmap is legal everywhere. Using it against systems you don't own or have authorization to test is illegal in most jurisdictions — under the CFAA in the US, the Computer Misuse Act in the UK, and equivalent laws worldwide. Practice on your own VMs, intentionally vulnerable targets like Metasploitable, or authorized platforms like TryHackMe and HackTheBox.
Why does my scan say all ports are filtered?
"Filtered" means a firewall is dropping your packets without telling you whether the port is open or closed. Try: (1) adding -Pn to skip the host discovery ping (some firewalls drop ICMP), (2) using -sT instead of -sS if you don't have root, (3) trying different scan types like -sA to map firewall rules, or (4) slowing down the scan with -T2.
What's the difference between -sS and -sT?
-sS (SYN/stealth scan) sends a SYN packet, gets a SYN/ACK response, and then sends RST instead of completing the handshake — so the connection never fully establishes. It requires root. -sT (TCP connect) completes the full three-way handshake using the OS's connect() syscall — it works without root but is slower and more visible in logs. Use -sS when you can.
How long should a full -p- scan take?
On a fast LAN with -T4, a single host's -p- scan finishes in 2-5 minutes. Across a slow internet link or with -T3, expect 15-30 minutes. UDP -p- can take many hours — always limit UDP to --top-ports.
Should I use Nmap or Zenmap?
Zenmap is the official GUI for Nmap and ships with Kali. It has a nice topology view and pre-built scan profiles. But every command Zenmap runs is just nmap with flags — once you're comfortable with the CLI, you'll find it faster. I recommend learning CLI nmap first; Zenmap is fine if you prefer GUIs.
What's the safest NSE script category?
The safe category. Scripts in this category are guaranteed not to crash the target, brute-force credentials, or use bandwidth abusively. Run nmap --script "safe and discovery" for low-risk reconnaissance.
How do I know which Nmap version I have?
Run nmap --version. As of mid-2026, Nmap 7.95 is the current stable release with new NSE scripts and IPv6 improvements. Update on Kali with sudo apt update && sudo apt upgrade nmap.
Can Nmap scan IPv6 networks?
Yes — add -6 to any nmap command. Many flags work the same way: nmap -6 -sn fe80::/64 for ping scanning a local IPv6 subnet, nmap -6 -sV [target] for IPv6 service detection. Nmap 7.95 has notably improved IPv6 host discovery and OS detection.
How do I scan UDP ports with Nmap?
Use the -sU flag, almost always limited to the common ports with --top-ports because UDP scanning is slow: sudo nmap -sU --top-ports 100 [target]. UDP scans need root, and ports frequently show as open|filtered because UDP is connectionless and silent services give nmap no clear answer. Confirm the interesting ones with -sV, which sends a real protocol probe.
How do I feed Nmap results into Metasploit?
Save your scan as XML with -oX (or -oA, which includes XML), then run db_import scan_results.xml from the msfconsole prompt. Metasploit reads the hosts, ports, and service versions straight into its database, so you can search for matching exploits without retyping anything. This is exactly why saving every scan with -oA pays off.
