Nmap is the first tool almost every ethical hacker learns, and the one you'll still be using years later. It maps a network: which machines are alive, which ports are open, and which services are running on them. Here's the order we teach it in, with the commands to try in your own lab.
The scans to learn, in order
Run these only against your own lab machines. The addresses below (192.168.56.x) are a typical VirtualBox host-only network; use your own lab's addresses.
| What you learn | Example command |
|---|---|
| 1. Scan a single IP | nmap 192.168.56.101 |
| 2. Scan a range with CIDR | nmap 192.168.56.0/24 |
| 2b. Scan a from–to range | nmap 192.168.56.100-120 |
| 3. Choose ports | nmap -p 22,80,443 192.168.56.101 or all ports: nmap -p- 192.168.56.101 |
| 4a. TCP full connect scan | nmap -sT 192.168.56.101 |
| 4b. Half-open (stealth / SYN) scan | sudo nmap -sS 192.168.56.101 |
| 5a. Host discovery (ping scan) | nmap -sn 192.168.56.0/24 |
| 5b. ARP ping scan (local network) | sudo nmap -sn -PR 192.168.56.0/24 |
| 6. UDP scan | sudo nmap -sU --top-ports 20 192.168.56.101 |
| 7. NSE scripts | nmap -sC 192.168.56.101 or nmap --script http-title 192.168.56.101 |
Read the results: what the port states mean
| State | What it means |
|---|---|
| open | A service is listening and accepting connections on this port. |
| closed | The host answered, but nothing is listening on this port. |
| filtered | A firewall or filter is blocking the probe, so Nmap can't tell if the port is open. |
| open|filtered | Common in UDP scans: no reply came back, so the port is either open or filtered. |
Next steps: versions, the OS, speed and saving your work
| What you want | Example command |
|---|---|
| Service versions on open ports | nmap -sV 192.168.56.101 |
| Guess the operating system | sudo nmap -O 192.168.56.101 |
| Versions, OS, default scripts and traceroute together | sudo nmap -A 192.168.56.101 |
| A faster scan on a reliable lab network | nmap -T4 192.168.56.0/24 |
| Save results in every format | nmap -oA lab-scan 192.168.56.101 |
Version detection is what turns a list of open ports into something useful: knowing a server runs a specific old version of a service tells you which known vulnerabilities to check. Always save your output (-oA writes normal, XML and grepable files), so you can compare scans and write up what you found.
Full connect vs stealth scan
Full connect (-sT)
- Completes the full TCP handshake: SYN, SYN-ACK, ACK
- Works without admin rights
- More likely to be logged by the target
Half-open / stealth (-sS)
- Sends SYN, reads the reply, then resets: never completes the handshake
- Faster, and quieter on many systems
- Needs root or admin rights
Where to practise legally
Scanning someone else's network without permission is illegal, even "just to learn". Practise only in places you own:
Build a safe Nmap lab
- Install VirtualBoxOn your own computer
- Add target VMsE.g. Metasploitable 2
- Private networkHost-only, isolated
- Scan only thoseNever anywhere else
The biggest beginner mistake
Treating Nmap as just a network scanner. It's much more than that. The Nmap Scripting Engine (NSE) comes with hundreds of scripts that can detect service versions, find common misconfigurations, check for known vulnerabilities and gather information that would otherwise take several tools. Once you're comfortable with the basic scans, spend time on NSE scripts. That's where Nmap goes from useful to indispensable.
Nmap: beginner to expert · ₹749
Learn Nmap properly, in Malayalam
Our Nmap course takes you from your first scan to mapping a whole network, with NSE scripts and a lab you build yourself: 22 lessons, self-paced, on learn.edwhere.com.
Keep reading
Frequently asked questions
What is Nmap used for?
Nmap maps networks: it finds which hosts are online, which ports are open and which services and versions are running, and with its scripting engine it can do much more, such as checking for known vulnerabilities.
Is it legal to use Nmap?
Using Nmap on your own network or lab is legal. Scanning systems you don't own or don't have written permission to test is not.
What is the difference between -sS and -sT?
-sT completes the full TCP handshake and works without admin rights. -sS is a half-open (stealth) scan that never completes the handshake; it's faster but needs root or admin rights.
How do I find service versions with Nmap?
Add -sV to your scan, for example nmap -sV 192.168.56.101. Nmap then probes each open port to identify the service and its version.
Where can I practise Nmap safely?
On your own home network, or on virtual machines in a VirtualBox lab on a private host-only network.
Is there an Nmap course in Malayalam?
Yes. Edwhere's Nmap course takes you from beginner to expert, including NSE scripts and building your own lab, for ₹749 on learn.edwhere.com.