What is Nmap?
Nmap is the world's most widely used network scanner. Defenders use it for asset discovery, finding exposed services, validating firewall rules and checking what attackers would see.
1 Host discovery
Before scanning ports, Nmap finds which addresses are alive using ARP, ICMP and TCP probes (-sn).
2 Port states
open = a service answers; closed = reachable but nothing listening; filtered = a firewall dropped the probe.
3 Service detection & NSE
-sV fingerprints software versions; the Nmap Scripting Engine runs safe checks like SMB signing or Redis info.
The scenario: Shadow IT on the finance network
An asset audit found unknown devices on the finance VLAN. Change ticket CHG-2231 authorises you to scan 10.10.20.0/24 today. Find every live host, what it exposes, and which device is the biggest risk.
Live lab: try it now
Type the commands in the terminal below. Everything is simulated, so it's safe and legal and nothing is installed.
Step-by-step: Nmap commands used in this lab
1Discover live hosts on 10.10.20.0/24
A ping sweep doesn't scan ports.
nmap -sn 10.10.20.0/24Show sample output
Starting Nmap 7.95 ( https://nmap.org )
Nmap scan report for 10.10.20.1 (fin-gw.acme.local)
Host is up (0.00051s latency).
Nmap scan report for 10.10.20.10 (FIN-APP01.acme.local)
Host is up (0.00082s latency).
Nmap scan report for 10.10.20.15 (FIN-FS02.acme.local)2Find open ports on the live hosts
Scan the default top 1000 ports of the subnet.
nmap 10.10.20.0/24Show sample output
Starting Nmap 7.95 ( https://nmap.org )
Nmap scan report for 10.10.20.1 (fin-gw.acme.local)
PORT STATE SERVICE
22/tcp filtered ssh
443/tcp open https
3Identify service versions on the suspicious hosts
Version detection on .41 and .57.
nmap -sV -p 22,6379,8080 10.10.20.41,57Show sample output
Starting Nmap 7.95 ( https://nmap.org )
Nmap scan report for 10.10.20.41
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.4 (protocol 2.0) <- 2016 release, out of support
6379/tcp open redis Redis key-value store 5.0.7
4Check whether the Redis server needs authentication
Use the redis-info NSE script on port 6379.
nmap --script redis-info -p 6379 10.10.20.41Show sample output
Starting Nmap 7.95 ( https://nmap.org )
Nmap scan report for 10.10.20.41
PORT STATE SERVICE
6379/tcp open redis
| redis-info:
| Version: 5.0.75Check SMB signing on the file server
smb2-security-mode script on port 445 of .15.
nmap --script smb2-security-mode -p 445 10.10.20.15Show sample output
Starting Nmap 7.95 ( https://nmap.org )
Nmap scan report for 10.10.20.15 (FIN-FS02.acme.local)
PORT STATE SERVICE
445/tcp open microsoft-ds
Host script results:6Save the evidence for the change ticket
Add -oN to write a normal-format report.
nmap -sV 10.10.20.0/24 -oN finance-scan.txtShow sample output
Starting Nmap 7.95 ( https://nmap.org )
... 6 hosts up, 15 open ports, versions detected ...
Nmap done: 256 IP addresses (6 hosts up) scanned in 31.55 seconds
Report written to finance-scan.txt (attach it to CHG-2231 as evidence)Key takeaways
- Use -sn to inventory first, then scan ports on what's alive.
- -sV and safe NSE scripts turn 'port open' into actionable findings.
- Unknown hosts without DNS names often mean shadow IT. Compare with the asset register.
- Always save output (-oN/-oA) as evidence for tickets and audits.
Install Nmap and practise for real
sudo apt install nmap # or download from nmap.orgPractise on your own lab, or the intentionally scannable host scanme.nmap.org, which the Nmap project explicitly permits. Only scan or test systems you own or are explicitly authorised to assess. Official site: nmap.org · Licence: Nmap Public Source License.
Scenario questions
Which host is the most urgent risk?
Answer: 10.10.20.41 Redis with no authentication. Redis bound to 0.0.0.0 with no auth gives anyone on the network full access to its data and is a known path to code execution.
Port 22 on the gateway showed as 'filtered'. What does that mean?
Answer: A firewall dropped the probe, so Nmap can't tell if it's open. Filtered means no response came back, usually because a firewall silently drops the packets.
Why must you have a change ticket or written scope before scanning?
Answer: Scanning without authorisation can be illegal and disrupt systems. Always scan with written permission and a defined scope, even inside your own company.
More open-source tool labs
Wireshark / tshark
See exactly what's crossing the wire and spot malware calling home.
Zeek
Turn raw traffic into rich, searchable logs for threat hunting.
Suricata
Detect attacks in network traffic with signatures, and write your own.
Wazuh
An open-source SIEM and XDR: collect logs, detect attacks, respond automatically.
Sigma
Write a detection once, run it in any SIEM.
YARA
Describe malware by its patterns and hunt for it across files.