Skip to content
Search

Nmap

lastmod 2026-01-09created 2017-04-2930 edits

Nmap is a security scanner originally written by Gordon Lyon. It is used to discover computers and services, building a "map" of the network along the way. Like other simple port scanners, Nmap can also discover passive services that do not advertise themselves with a service discovery protocol. In addition, Nmap can determine detailed information about remote computers. These details include the operating system, device type, uptime, the software product used for a service, the exact version of that product, the presence of firewall technology, and even the vendor of the network card on a local area network.

Nmap runs on Linux, Windows, Solaris, BSD including Mac OS X, and AmigaOS. Linux is the most commonly used nmap platform, with Windows second.

Feature

  • Host discovery - identifies computers on the network. For example, lists computers that respond to ping or have a specific port open.
  • Port scan (Port scanner) - lists the open ports on one or more target computers.
  • Version detection - interrogates network services on remote computers to determine the application name and version number.
  • OS detection - remotely determines the operating system and hardware characteristics of network devices.

Options

Flags

Remarks

-sn

"Ping Scan" option. Only checks whether hosts are alive (whether they respond to ping), without a port scan. [^0]

-sT

Ordinary TCP port scanning.

-sS

A so-called 'half-open' scan, hard to trace.

-sP

Ordinary scan using ping. [^1]

-sU

UDP port scanning.

-PO

Does not request ping responses from the target host. Can avoid log records and filtering.

-PT

Sends pings with ACK packets instead of ordinary ICMP pings, and receives responses as RST packets.

-PI

Ordinary ICMP ping, which gets filtered out by firewalls or filtering.

-PB

Uses ICMP ping and TCP ping at the same time when pinging.

-PS

Scans by sending SYN packets instead of ACK packets when pinging.

-O

Identifies the OS of the target host.

-p

Scans a specific port on the target host, or specifies the range of ports to scan. (ex: -p 1-1024)

-D

Decoy feature that spoofs the address of the scanning host to the target host.

-F

Scans only the ports listed in the /etc/services file.

-I

Retrieves the identd information of the TCP processor.

-n

Does not convert IP addresses to DNS hostnames. Fast.

-R

Scans with IP addresses converted to DNS hostnames. Slow.

-o

Saves the scan results to a text file.

-i

Scans by reading target host information from the specified file.

--open

Output only the open ones.

-h

Show help

SCAN TECHNIQUES

-sS - TCP SYN

  • Called a stealth scan or half-open scan.
  • Sends only a SYN packet and checks the response, without completing the TCP 3-way handshake
  • If a SYN/ACK response arrives, the port is judged open, and an RST packet is sent immediately to terminate the connection
  • Because the connection is never completed, it is not logged on many systems
  • The fastest and most commonly used scan method
  • Requires root privileges

-sT - Connect()

  • A full connect scan.
  • Attempts a complete TCP connection using the operating system's connect() system call
  • Completes the TCP 3-way handshake.
  • The default scan method used without root privileges
  • Because the connection is completed, it is likely to be logged on the target system
  • Slower than a SYN scan and more easily detected

-sA - ACK

  • Used for mapping firewall rules.
  • Sends only ACK packets
  • Cannot distinguish whether a port is open or closed
  • An RST response means the port is unfiltered; no response means filtered
  • Useful for checking whether a firewall is stateful or for figuring out firewall rules

See Transmission Control Protocol#ACK transmission scenarios for details.

-sW - Window

  • An improved version of the ACK scan.
  • Sends ACK packets and checks the TCP window size of the RST response
  • On some systems, open and closed ports have different window sizes
  • This makes it possible to distinguish whether a port is open or closed
  • Does not work on all systems

-sM - Maimon scans

  • A technique discovered by Uriel Maimon.
  • Sends FIN/ACK packets
  • According to RFC 793, a port should respond with RST whether it is open or closed, but some BSD-derived systems ignore the packet for open ports
  • Ineffective on most modern systems
  • Useful only on certain old BSD systems

General usage recommendations

  • By default, using -sS (SYN scan) is the most effective
  • Without root privileges, -sT is used automatically
  • For firewall analysis, use -sA

Example

To install nmap, enter 

$ sudo apt-get install nmap
nmap -sn 192.168.1.0/24
Once it is installed, enter
nmap -sT localhost
TCP Port Open scan
sudo nmap -sS localhost
Note that -sS requires root privileges.
sudo nmap --top-ports 30000 -sS git.server.com
Checks a total of 30000 ports.
nmap -p 80 192.168.0.1
Scan port 80 on the target system
nmap -p 1-200 192.168.0.1
Scan ports 1 to 200 on the target system
nmap -F 192.168.0.1
(Fast) scan of commonly used ports
nmap -p– 192.168.0.1
Scan all ports from 1 to 65535
nmap -p 22 192.168.0.0/24
Scan IPs from 192.168.0.1 ~ 192.168.0.255 that accept SSH (22) connections
nmap --open -p 554 10.0.0.1-254 -oG - | grep "/open"
ONVIF#Scan method

How to check users on the network 

$ nmap -sn 192.168.0.1/24

The result is output as follows: 

Starting Nmap 7.80 ( https://nmap.org ) at 2023-12-19 16:52 KST
Nmap scan report for ******* (192.168.0.1)
Host is up (0.0068s latency).
Nmap scan report for ******* (192.168.0.222)
Host is up (0.00036s latency).
Nmap scan report for ******* (192.168.0.111)
Host is up (0.0075s latency).
Nmap done: 256 IP addresses (3 hosts up) scanned in 2.93 seconds

More network scan examples

sudo nmap -sn -R 192.168.88.0/24
Detailed scan including DNS resolution
sudo nmap -A 192.168.88.0/24
Aggressive scan including OS detection

Troubleshooting

=== Assertion `htn.toclock_running == true' failed. === When I ran the following: 

sudo nmap -p 502 192.168.100.1/24

The following warning was printed: 

Starting Nmap 7.80 ( https://nmap.org ) at 2026-01-09 08:04 KST
nmap: Target.cc:503: void Target::stopTimeOutClock(const timeval*): Assertion `htn.toclock_running == true' failed.
Aborted

Remove sudo and run it.

See also

Favorite site

author Zer0 sitemap