Practice Lab Tools
Contact Us
Not sure which tool or platform to start with? Send us your background and goals and a specialist will personally reply within one business day.
What Is Nmap?
Nmap, short for Network Mapper, is a free and open source tool for network discovery and security auditing, first released in 1997 and still the most widely used network scanner in security work today. At its core, Nmap answers a deceptively simple question: what is actually running on this network, and how is it exposed?
A single scan can identify which hosts are alive on a network range, which ports are open on each host, what service and version is listening behind each port, and often the underlying operating system, all without needing any credentials or prior access. This makes it the natural first step in almost any security assessment, offensive or defensive.
Nmap is cross-platform, scriptable through its own Nmap Scripting Engine, and forms the basis for several other well-known tools, including Zenmap, its official graphical interface, and Masscan, a faster but less detailed alternative built for scanning very large IP ranges.
Common Nmap Scan Types and Commands
A basic scan checks the 1,000 most common ports on a target and reports which are open. Adding service and version detection goes further, identifying not just that a port is open but exactly what software and version is listening behind it, for example a specific version of OpenSSH.
Operating system detection attempts to fingerprint the target by analysing subtle differences in how its network stack responds to specific crafted packets. Scanning every port rather than the default subset is useful when you suspect a service is running on a non-standard port. The Nmap Scripting Engine automates hundreds of additional checks, from detecting known vulnerabilities to enumerating shared folders.
Timing also matters: scan speed can be tuned from extremely slow and stealthy to extremely fast and noisy. Real assessments almost always favour a slower, more deliberate scan over a fast one that risks disrupting a production system or tripping an intrusion detection system unnecessarily.
- Maps open ports across a single host or an entire network range
- Identifies running services and their exact software versions
- Detects operating system fingerprints from network stack behaviour
- Nmap Scripting Engine automates vulnerability and enumeration checks
- Configurable scan timing, from stealthy to fast
- Free, open source, and available on every major platform
- Official graphical interface available through Zenmap
- One of the most tested skills across security certifications
Using Nmap Responsibly
Only ever scan networks and systems you own or have explicit written authorization to test. Unauthorized scanning has led to real legal consequences in multiple jurisdictions, even when the person running the scan had no intention of causing harm, because the act of probing a system without permission can itself be treated as unauthorized access.
In a practice or lab environment, Nmap is usually the first step in a broader workflow: an initial scan identifies live hosts and open ports, a more detailed service-version scan narrows down what software is running, and the results then guide deeper investigation with tools like Wireshark for traffic analysis or Metasploit for testing whether an identified vulnerability is actually exploitable.
Step-by-Step: Scanning a Lab Machine
This progression is a common way to build up a picture of a target step by step.
- Confirm the target is reachable with a simple ping.
- Run a default scan to see which ports are open.
- Add version detection to identify what software is running behind each open port.
- Run a full port scan across all 65,535 ports to catch anything on a non-standard port.
- Try a scripted vulnerability check against a lab machine you are authorised to test.
This progression from a quick default scan to a detailed, scripted one mirrors how a real assessment builds up a picture of a target, rather than trying to learn everything about it in a single command.
Nmap scans a target host or network to discover open ports, identify running services and their versions, and fingerprint the operating system in use.
Running Nmap itself is legal, but scanning a network or system without explicit authorization from its owner is not, and can be treated as unauthorized access in many jurisdictions.
The Nmap Scripting Engine, or NSE, is a framework of scripts that automate tasks like vulnerability detection, advanced service enumeration, and other checks beyond a basic port scan.
No, Nmap is available for Windows, macOS, and Linux independently. Kali Linux simply comes with it pre-installed alongside other security tools.
Nmap's OS detection analyses subtle differences in how a target's network stack responds to specific probes, comparing the results against a database of known operating system fingerprints.
Nmap performs detailed scans with service detection, OS fingerprinting, and scripting, making it thorough but slower. Masscan is built purely for speed, capable of scanning very large ranges quickly, but with far less detail per host.
Yes, Nmap can often infer the presence of a firewall from filtered ports, unusual response patterns, or specific scan types designed to map firewall rule sets rather than find open ports.
Yes, Nmap supports IPv6 scanning, though scan behaviour and default port ranges can differ slightly from IPv4 due to the size of IPv6 address spaces.
A default scan of common ports on a single host typically takes seconds to a few minutes. A full scan of all ports on a host, or scanning an entire subnet, can take significantly longer depending on network conditions and timing settings.