Host discovery
Discover which devices may be reachable on a local network.
PriceTag HUB / Networking
Computer Networking
Learn computer networks, Wi-Fi, routers, IP addressing, network protocols, troubleshooting, and network security through practical guides and step-by-step explanations.
Knowledge Hub
Build networking skills step by step
Practical Network Security
Nmap Tutorial: Learn Network Scanning Step by Step
Learn how Nmap discovers devices, checks network ports, identifies services, and helps security learners understand exposed network services. Start with simple commands and build your skills through practical, authorized lab exercises.
Beginner-friendly · Command-line learning · Authorized lab use
What does Nmap do?
A simplified view of a network scan
Target host
192.168.1.10
↓
Port scan
Check selected TCP ports
↓
Service detection
Collect service information
The example address is illustrative. Scan only systems within your authorization.
Understanding Nmap
What is Nmap?
Nmap, short for Network Mapper, is an open-source tool used for network discovery and security auditing. Administrators and security professionals use it to understand which hosts are reachable and which network services may be exposed.
Port scanning
Identify TCP ports that appear open, closed, or filtered.
Service detection
Collect information about services listening on accessible ports.
Security assessment
Use scan results to understand exposed services and investigate unnecessary network access.
Install Nmap before starting
Download Nmap from its official website. Windows users can use the official installer; Linux users can use their distribution's package manager. macOS users can use the official macOS distribution or a trusted package manager.
Nmap official download pageTerminal command
nmap --versionAdvertisement
Command reference
Nmap commands from beginner to intermediate
Run these examples in a terminal where Nmap is installed. Replace sample IP addresses with authorized lab targets. On some systems, advanced scan techniques may require elevated privileges.
Beginner: installation and basic scansIntermediate: discovery and service details
BeginnerNmap command
1. Check the Nmap installation
Terminal command
nmap --versionDisplays the installed Nmap version and build information. If the command is not recognized, check whether Nmap is installed and available in your system PATH.
BeginnerNmap command
2. Scan your own computer
Terminal command
nmap 127.0.0.1Scans the local loopback address for commonly scanned TCP ports. Results describe services reachable through that local address, not every service or every port.
BeginnerNmap command
3. Scan an authorized lab host
Terminal command
nmap 192.168.1.10Scans the default set of commonly scanned TCP ports on the specified host. Replace the example IP with a device you own or have permission to test.
BeginnerNmap command
4. Scan selected ports
Terminal command
nmap -p 22,80,443 192.168.1.10Checks TCP ports 22, 80, and 443. These are commonly associated with SSH, HTTP, and HTTPS, although the actual service can differ.
BeginnerNmap command
5. Scan a specific port range
Terminal command
nmap -p 1-1000 192.168.1.10Scans TCP ports 1 through 1000. Larger ranges take longer and may generate more network traffic.
IntermediateNmap command
6. Detect service versions
Terminal command
nmap -sV 192.168.1.10Probes open ports to identify the services and possible version information they expose. Identification is not always exact.
IntermediateNmap command
7. Discover live hosts
Terminal command
nmap -sn 192.168.1.0/24Performs host discovery across a typical /24 subnet without doing a port scan. This covers addresses from 192.168.1.0 through 192.168.1.255, but the number of reachable hosts depends on the network.
IntermediateNmap command
8. Skip host discovery
Terminal command
nmap -Pn 192.168.1.10Treats the target as online and proceeds with the requested scan even if host discovery would not identify it as reachable. This does not bypass a firewall or guarantee that the host responds.
IntermediateNmap command
9. Run a TCP connect scan
Terminal command
nmap -sT -p 1-1000 192.168.1.10Uses the operating system's TCP connect mechanism to test the selected ports. It is useful when a SYN scan is unavailable, although it may establish complete TCP connections.
IntermediateNmap command
10. Save the results
Terminal command
nmap -sV -oN scan-results.txt 192.168.1.10Performs service detection and saves a readable report to scan-results.txt in the current working directory.
Advertisement
Guided lab
Direct practice: your first Nmap exercises
Work through these exercises in order. They are designed to help you understand scan output rather than simply memorize commands.
Practice safely on localhost
The loopback address 127.0.0.1 refers to your own computer. It is a good starting point for learning. A port will appear open only if a suitable service is listening and reachable through that address.
01
Prepare a safe lab
Use your own computer, a local virtual machine, or a deliberately vulnerable training machine in an isolated lab.
Terminal command
nmap --version02
Perform your first scan
Start with the loopback address. This lets you learn the output without scanning another device.
Terminal command
nmap 127.0.0.103
Explore port states
Choose a lab service that you control. Compare results before and after starting or stopping that service.
Terminal command
nmap -p 8080 127.0.0.104
Identify a service
If your lab has an HTTP service on port 8080, use service detection to collect additional information.
Terminal command
nmap -sV -p 8080 127.0.0.105
Save and review
Save the report, note the detected port states, and write down which results changed after your lab configuration changed.
Terminal command
nmap -sV -oN lab-report.txt 127.0.0.1Practice challenge
Run a basic localhost scan, then scan only the port you selected for your lab service. Compare the two reports. Which ports appear open? Did the service-detection scan identify an application? Can you explain why the results differ?
If you do not have a listening service on port 8080, the example may report it as closed. That is a valid result, not an error in Nmap.
Understand scan output
What do Nmap port states mean?
A port state describes what Nmap can determine about a port from the probes and responses it receives. It does not, by itself, prove that a machine is secure or compromised.
An application is accepting connections on the scanned port.
What to investigate
Identify the service and confirm whether it should be accessible.
The target is reachable, but no application is listening on that port at the time of the scan.
What to investigate
Check whether the service is expected to be running.
Nmap cannot determine whether the port is open because packet filtering or another network condition prevents a clear response.
What to investigate
Review authorized firewall rules and network reachability.
Nmap can report other states, including open|filtered and closed|filtered in certain scan types. Results depend on the scan method, target behavior, routing, and filtering rules.
Advertisement
Intermediate knowledge
How to think like a network defender
The value of scanning is not the number of ports found. It is understanding which services are exposed and whether that exposure is appropriate.
Identify exposed services
Use service detection to understand what may be listening. Confirm the result through system configuration and service documentation.
Review unnecessary access
Compare scan results with the intended network design. A service that should not be reachable may need a firewall rule review or service configuration change.
Compare scans over time
Save reports and compare them after authorized configuration changes. Unexpected changes can be a reason to investigate, but are not proof of malicious activity.
Understand network limitations
Firewalls, host-based filters, virtual networks, and routing can change scan results. An incomplete response is not the same as proof that a system is offline.
Responsible Nmap practice
Scan your own systems, isolated labs, or networks where you have explicit permission. Confirm the authorized IP ranges, ports, timing, and testing window before scanning a production network. Even ordinary scans can generate logs or trigger security alerts.
Common questions
Nmap FAQs
Quick answers to common beginner questions.
What is Nmap used for?
Nmap is an open-source network exploration and security auditing tool. It can discover hosts, scan ports, identify services, and gather other information about systems on networks you are authorized to assess.
Is Nmap free to use?
Yes. Nmap is available as free, open-source software. Download it from the official Nmap website at nmap.org.
Can Nmap tell me whether a computer has been hacked?
No. Nmap can identify exposed ports and gather service information, but a port scan alone cannot determine whether a system has been compromised. Investigate system logs, endpoint security alerts, processes, and other evidence as appropriate.
Why does Nmap show no open ports?
The scanned ports may genuinely be closed, filtered, or unavailable. The host could also be offline or the scan could be affected by routing or firewall rules. Check the target address and scan scope before drawing conclusions.
Does service detection identify every software version correctly?
No. Nmap service detection uses probes and response fingerprints. Proxies, customized services, filtering, and incomplete responses can cause uncertain or inaccurate identification.
Can I scan any public IP address?
Do not assume a publicly reachable address is available for testing. Obtain permission from the system owner and follow applicable laws, organizational rules, and the owner's testing scope.
Continue learning
Explore related networking topics
Build on your understanding of network discovery, traffic control, and defensive monitoring.
Continue Learning
Explore Related Topics
Continue exploring related guides to build your understanding step by step.