nmap scan types

What nmap is

nmap (Network Mapper) is a free, open-source scanner. It is the tool most testers reach for first. You give it one or more targets and some flags, and it reports which hosts are up and which ports are open. Everything here should be run only against your lab or an authorised target.

Host discovery and a basic scan

nmap 192.168.56.0/24        # which hosts are up in this lab range?
nmap 192.168.56.102         # scan the most common 1000 ports
nmap -p 22,80,443 192.168.56.102  # scan only these ports
nmap -p- 192.168.56.102     # scan all 65535 ports (slower)

Two important scan types

A TCP connect scan (-sT) completes the full handshake to each port, like a normal connection. It is reliable and needs no special privileges, but it is easy to log. A SYN scan (-sS) sends only the first step of the handshake and never finishes it; it is faster and a little quieter, which is why it is often the default when run as root. Both simply ask "is this port open?" — neither breaks in.

Speed and output

nmap -T4 192.168.56.102          # faster timing (T0 slow ... T5 fastest)
nmap -oN scan.txt 192.168.56.102 # save normal output to a file
nmap -oA myscan 192.168.56.102   # save in all formats for later

Detection and defence

Detection: a burst of connection attempts across many ports from one source is a classic scan signature. Firewalls and IDS/IPS raise alerts on it; a SIEM can correlate it with other events. Defence: close unused ports, rate-limit, and tune IDS to alert on scans. Testers should assume a competent blue team will see the scan and may ask about it.