What it does
nmap sends probes to hosts and ports and reports which ports are open, closed or filtered. With -sV it detects service versions, with -O the OS, and the NSE scripts add checks (TLS ciphers, HTTP headers, SSH algorithms, known CVEs). DevSecOps use: check that only the ports you expect are open after a deployment, find forgotten services, and verify firewall rules from the outside.
Scan only networks you own or are allowed to test.
How to write it
nmap [SCAN TYPE] [OPTIONS] TARGETSMain parts
Scan types
-sS- TCP SYN scan (default as root; fast, half-open).
-sT- TCP connect scan (default as normal user).
-sU- UDP scan (slow).
-sn- Host discovery only, no ports.
-sV- Detect service versions.
-O- Detect the OS.
-A- -O -sV -sC --traceroute together.
-sC/--scriptNAME- Default / chosen NSE scripts.
Options 10
Most used
Options
Nothing matches this filter.
Examples 10
$ run as a normal user# run as root (or with sudo)
1Which hosts are up in the lab?
nmap -sn 192.168.122.0/242Open ports and versions on one server
sudo nmap -sS -sV --open 192.168.122.113All TCP ports
sudo nmap -p- --open -T4 192.168.122.114Check what the internet sees (run from outside)
nmap -Pn --top-ports 100 --open shop.example.com5TLS versions and ciphers
nmap --script ssl-enum-ciphers -p 443 shop.example.com6SSH algorithms
nmap --script ssh2-enum-algos -p 22 192.168.122.117HTTP security headers and title
nmap --script http-security-headers,http-title -p 80,443 shop.example.com8UDP services (DNS, NTP, SNMP)
sudo nmap -sU -p 53,123,161 192.168.122.19Compare two scans after a change
10Scan a list of servers and save all formats
Nothing matches this filter.
Watch out
- Scanning networks without permission can be illegal and can trigger security alerts.
- "filtered" means a firewall drops the probes — not that the port is safe.
Files
/usr/share/nmap/scripts/- NSE scripts.
Tips to remember
- Put a weekly
nmap+ndiffof your public IPs into a pipeline and alert on new open ports.
Exit codes
0 | Success. |
1 | Error. |