How to Use Nmap?
Nmap, short for Network Mapper, is an open-source network scanning tool used to discover devices within computer networks and perform security audits. Administrators use Nmap to identify devices, open ports, services, and operating systems running on a system; detect open communication points; and scan for security risks. Therefore, Nmap is widely used by system administrators, security professionals, and penetration testers.
To use network mapping, you must first download Nmap. Nmap comes preinstalled with the Kali Linux operating system. If you want to install Nmap on Windows, you can directly run the installer from “nmap.org.” For macOS installation, use brew install nmap. Familiarity with command-line interfaces is required to use Nmap effectively. When creating a basic Nmap command, the pattern “nmap {scan type} {options} {target}” is followed. The target may be an IP address, domain name, or IP range. For example:
• 192.168.1.1
• google.com
• 192.168.1.0/24
To start Nmap, simply type “nmap” into the command line. Using Nmap is highly flexible and can vary based on requirements; however, the core concept is defining the target and scan type via the command line.
Most Common Nmap Commands
- Basic port scan to see open ports on a device: nmap 192.168.1.10
- Scan all ports: nmap -p- 192.168.1.10
- Service and version detection: nmap -sV 192.168.1.10
- Determine the operating system: nmap -O 192.168.1.10
- Quick scan to rapidly discover devices and open ports: nmap -T4 192.168.1.10
- Host discovery to list active devices on a subnet: nmap -sn 192.168.1.0/24
- Comprehensive information gathering: nmap -A 192.168.1.10
Parameters Used in Nmap Scanning
- -sn: Used for host discovery (ping scan).
- -n: Disables DNS resolution and scans without DNS queries.
- -v, -vv, -vvv: Increases verbosity level for more detailed output.
- -F: Faster scan with fewer results.
- -sS: Performs a SYN scan.
- –reason: Shows the reason behind each detected result.
- –open: Displays only open ports.
- -p-: Scans all 65,535 possible ports on a given IP.
- -sV: Attempts to determine the service running on open ports. Works well with -sC.
- -sC: Uses Nmap’s default NSE scripts for security and service discovery.
- -p: Scans only the specified ports following this parameter.
- –top-ports: Scans the most commonly used ports.
- –h: Displays help information.
- –V: Shows detailed version information.
- –6: Enables IPv6 scanning.
- –A: Activates aggressive scan including OS detection, version scanning, script scanning, and traceroute.
- –Pn: Scans the target without ping checks.
- –e [interface]: Specifies the network interface.
- –ttl: Adjusts the TTL value.
- –badsum: Sends packets with incorrect checksums.
- –data-length: Sets the size of packets.