1. Mental Model & Architectural Core
Nmap (Network Mapper) is the industry-standard open-source network scanner used by every penetration tester, sysadmin, and auditor on the planet. It discovers hosts, open ports, running services, OS fingerprints, and application versions across any IP range from a single host to a /8 CIDR block.
Imagine you are a locksmith hired to audit a building. Nmap is your clipboard and flashlight you walk every door, knock on each one, listen to how it responds, and note down exactly what's behind each lock. Some doors answer immediately, some are locked and quiet, and some have security guards that lie to you. Nmap handles all three.
- Initial reconnaissance of a target host or network range
- Service version discovery before exploit selection
- Vulnerability scanning via NSE Lua scripts (--script vuln)
- Firewall and IDS evasion using fragmented packets or decoys
- Network topology mapping for internal pivoting
- HTB machines: identify web server on port 80 and custom service on high port before searching for exploit
- Corporate pentest: map entire /24 subnet to identify rogue services and shadow IT
- Bug bounty: sweep acquired IP ranges for forgotten staging servers
- Internal red team: map AD domain controller ports (88, 389, 445, 636, 3268) for attack surface
Nmap operates at the TCP/IP layer. For a SYN scan (-sS), it sends a TCP SYN packet and waits for a response: SYN-ACK means the port is OPEN, RST means CLOSED, and no response (after retries) means FILTERED. This "half-open" scanning leaves no TCP session in application logs because the 3-way handshake is never completed. Service detection (-sV) sends protocol-specific probes to open ports and matches responses against a database of 11,000+ service fingerprints (nmap-service-probes). OS detection (-O) analyzes TCP/IP stack characteristics like TTL, window size, and don't-fragment bit patterns.
2. Syntax, Flags & Live Telemetry
| Flag / Option | Description |
|---|---|
| -sS | TCP SYN "stealth" scan half-open, fastest, leaves no connection logs |
| -sV | Service version detection probes open ports to identify software and version |
| -sC | Default NSE script scan runs common safe discovery scripts |
| -O | OS fingerprinting infer operating system from TCP/IP stack behavior |
| -Pn | Skip host discovery ping treat all hosts as alive (bypasses ICMP filters) |
| -p- | Scan all 65535 TCP ports (default is top 1000 only) |
| -p 80,443,8080 | Scan specific ports only |
| --script vuln | Run all vulnerability detection NSE scripts against open ports |
| --script=http-title | Run a specific NSE script (e.g., grab HTTP page title) |
| -T4 | Aggressive timing template faster scan, more network noise |
| -T0 | Paranoid timing very slow scan, almost undetectable by IDS |
| --min-rate 5000 | Send at least 5000 packets per second (faster for CTF targets) |
| -f | Fragment packets into 8-byte chunks to evade packet inspection firewalls |
| -D RND:10 | Decoy scan send probes from 10 random spoofed IPs alongside real IP |
| -oN output.txt | Save output in human-readable format |
| -oA allformats | Save output in all 3 formats: normal, XML, and grepable |
nmap -sS -sV -sC -Pn -p- --min-rate 5000 -oA full_scan 10.10.11.240
nmap -sV --script vuln -p 80,443,8080,8443 10.10.11.240
nmap -sS -Pn -f -D RND:10 --data-length 25 -T2 -p 22,80,443 10.10.11.240
When port 8080 shows Apache Tomcat with a JMX Console endpoint, immediately test for unauthenticated JMX exposure this is a direct path to remote class loading and OS command execution. Always follow up an Nmap scan with targeted service-specific probes.
3. Hands-On Practice Labs & Cyber Ranges
4. Detection & Prevention Playbook
- Deploy IDS/IPS with Snort/Suricata rules for SYN scan signatures
- Implement port-knocking or single-packet authorization (SPA) on sensitive services
- Rate-limit TCP SYN packets per source IP at the firewall edge
- Enable network flow monitoring (NetFlow/IPFIX) for anomalous port sweep patterns