Nmap Guide
A comprehensive guide to mastering Nmap for OSINT investigations
Core Concepts
Understanding Nmap requires familiarity with key networking ideas. The TCP 3-Way Handshake (SYN, SYN-ACK, ACK) is the process by which two computers establish a TCP connection. Nmap manipulates this process to determine port status. Ports can be reported as open (service actively listening), closed (port accessible but no service), or filtered (firewall blocking probes).
Installation
On Debian-based Linux systems like Kali Linux: `sudo apt-get install nmap`. For other operating systems, installers are available on the official Nmap website. Linux is the recommended platform for optimal performance.
Step-by-Step Usage Guide
Basic Host Discovery (Ping Scan)
To discover which hosts are online in a network without port scanning, use the `-sn` flag. This is a light and fast way to map live devices.
Command: `nmap -sn 192.168.1.1/24`
This command pings every IP address in the range and reports which ones responded.
Default Port Scan
A basic Nmap scan against a single target will scan the 1,000 most common TCP ports.
Command: `nmap scanme.nmap.org`
TCP SYN Scan
The default scan type when running as a privileged user. Often called a "stealth scan" because it never completes the TCP handshake, making it less likely to be logged.
Command: `sudo nmap -sS target.com`
Service Version Detection
After finding open ports, probe them to determine the exact service and version number running. This is crucial for vulnerability identification.
Command: `nmap -sV target.com`
Operating System Detection
Nmap analyzes TCP/IP stack responses to make an educated guess about the target's operating system.
Command: `sudo nmap -O target.com`
Aggressive Scanning
This option enables OS detection, version detection, script scanning, and traceroute all at once. It is powerful but very intrusive.
Command: `sudo nmap -A target.com`
Practical Tips
Use timing templates like `-T4` for faster scans on reliable networks. Save results with `-oX` for XML output that can be parsed by other tools. Always verify you have permission before scanning.
Legal Considerations
Unauthorized port scanning is illegal in many jurisdictions. Always ensure you have explicit, written permission to scan any network or host that you do not own.