How to Use Nmap Command to Scan Ports on Linux

Nmap, or Network Mapper, is a powerful, open-source tool widely used for network discovery, vulnerability assessments, and penetration testing. This guide will show you how to use Nmap, complete with commands and real-world examples.

1. What is Nmap?

Nmap (Network Mapper) is a versatile, accessible, open-source tool for network administrators, penetration testers, and cybersecurity professionals. It is designed to scan networks and hosts, identify active devices, detect open ports, and discover services and vulnerabilities.

Nmap works on multiple platforms, including Linux. It supports macOS, Windows, and various scanning techniques, from basic ping scans to in-depth service and OS detection.

2. Why should we use Nmap?

Nmap is a must-have tool in network security and administration because of its wide-ranging capabilities:

• Network Discovery: Identify devices connected to a network and assess their status.
• Port Scanning: Check for open, closed, or filtered ports on a target.
• Service Identification: Determine what services run on open ports and their versions.
• OS Detection: Identify the operating system and software running on a host.
• Vulnerability Assessment: Utilize Nmap scripts to detect known vulnerabilities.
• Flexibility: Suitable for large-scale networks or single hosts with custom scanning options.

3. Installing nmap on Linux

To install Nmap on Linux, you need to update your package lists. Use the command:

sudo apt update

This command updates the package list and allows checking for updates. Once updated, you can install Nmap by running:

sudo apt install nmap

4. What are Ports?

Ports are communication endpoints for networked devices, enabling multiple services to run simultaneously. Nmap scans for open ports to identify active services and potential vulnerabilities.

Types of Ports:

• Open Ports: Actively accepting connections.
• Closed Ports: Accessible but not running a service.
• Filtered Ports: Blocked by firewalls or other security measures.

Nmap supports scanning both TCP and UDP ports to discover services or vulnerabilities effectively.

5. Basic Nmap Commands

Simple Host Discovery

Command

nmap -sn 192.168.1.0/24

performs a network scan to discover active devices within the specified subnet (192.168.1.0/24) without scanning for open ports. This command is helpful for quickly identifying devices on a local network.

Skipping the port scan reduces scanning time and resources, focusing solely on host discovery. This can benefit large networks where a complete port scan may be time-consuming. The -sn option, also known as “ping scan,” helps identify which IPs are active by sending ICMP echo requests or using ARP requests for hosts within the subnet.

Single Host Port Scan

Command:

nmap 192.168.1.1

The command performs a default port scan on a single IP address (192.168.1.1). By default, Nmap scans the most commonly used 1,000 TCP ports, providing insights into open services and possible vulnerabilities on that host. 

This type of scan is useful for quickly assessing the status of services on a specific device. If the host does not respond to pings, adding the -Pn option can bypass the host discovery phase, forcing Nmap to proceed with the port scan. This command is often used in troubleshooting to verify if expected services are accessible on a particular IP.

Scanning Multiple IPs

Command:

nmap 192.168.1.1 192.168.1.2

Allows for scanning multiple, specific IP addresses in a single command. This approach is practical when you only need to analyze a few selected hosts rather than a range of IPs.

Using Nmap to scan specific IP addresses is like pulling the string in the game and telling them where to check, specifically in a big building. It makes little sense compared to a list that’s just going straight through every single room, and instead, you’re just listing the relevant rooms. This approach is handy, so it may be suitable for cases where you know exactly which devices you want to scrutinize. It’s far more efficient than scanning a complete network if one knows how the range of IP addresses is arranged in your system. A quick analysis of specific machines is precious when I need to provide brief solutions.

Subnet Scanning

Command:

nmap 192.168.1.0/24

You can scan an entire subnet, which allows you to check all devices within the specified range. This command examines every IP in the subnet for online status and open ports. It is ideal for discovering all active hosts on a network without needing to enter each IP individually.

For instance, scanning a local network subnet helps identify connected devices and their active ports, which benefits network administrators managing devices across a range. This method ensures complete network coverage, identifying new or previously unknown devices.

6. Advanced Nmap Commands

Custom Port Scanning

Command:

nmap -p 1-65535 192.168.1.1

This command enables a comprehensive scan across all 65,535 TCP ports on the target IP address. It is beneficial when you want to thoroughly examine open ports on a system, including non-standard or less common ones that default scans may not cover.

Scanning the entire port range increases the chances of identifying hidden or misconfigured services that might otherwise go undetected. This approach is valuable in vulnerability assessments and security audits to uncover entry points in a system’s network setup.

Service and Version Detection

Command:

nmap -sV 192.168.1.1

It shows detailed service information on current port-to-port connections. This feature is essential for cases where the specifics of certain software or service versions must evolve and when the threat indicators refer to definite versions.

This way, administrators or security analysts can identify probable variances or risks and decide about updates or patches for specific service versions. This command is usually applied in pen-testing or security auditing to determine the degree of threat to running services. It also helps to identify services that use outdated and, thus, potentially vulnerable software.

OS Detection

Command:

nmap -O 192.168.1.1

This allows Nmap to discover the OS running on the target IP by evaluating the pattern of the packets exchanged by the program. This technique is called OS fingerprinting and provides information about the type and version of OS that is certainly useful during the network audit and security evaluation.

By knowing the OS, network administrators can apply specific security configurations or patches tailored to that system. OS detection is also helpful in auditing to ensure that only approved operating systems are deployed on the network.

7. Specialized Scanning Techniques

Stealth Scan (SYN Scan)

Command:

nmap -sS 192.168.1.1

starts a SYN scan, often called a “stealth scan.” This technique sends SYN packets to the target without completing the TCP handshake, making it less detectable by sure firewalls and intrusion detection systems.

If the target port is open, it responds with a SYN-ACK packet, while closed ports respond with an RST packet. Another helpful method for security analysts is the stealth scan, which helps them get information about open ports without establishing a complete connection that may trigger an alert.

UDP Scanning

Command:

nmap -sU 192.168.1.1

Performs a UDP scan, focusing on services that use the User Datagram Protocol. UDP doesn’t need a handshake, making it challenging to detect open ports. Open UDP ports typically do not respond, while closed ports often reply with ICMP “Port Unreachable” messages.

UDP scanning is essential for discovering services such as DNS, DHCP, and SNMP, which commonly operate over UDP. This means that UDP scans should be used for a thorough audit rather than a quick scan, as they help identify weaknesses or probable entry points in systems that depend on UDP-based applications.

Aggressive Scan

Command:

nmap -A 192.168.1.1

Initiates an aggressive scan mode, which combines multiple scanning techniques to gather comprehensive information. This scan type includes OS detection, version detection, script scanning, and traceroute. 

It’s ideal for obtaining a detailed view of the target in a single command but may increase the likelihood of detection by security systems due to its intensity. Intense scans are generally helpful since they offer essential information regarding public services and the environment in which the operating system resides. In contrast, discreet scans analyze the network more properly to recognize its strengths and weaknesses.

Timing and Performance Optimization

Command:

nmap -T4 192.168.1.1

There are two timing templates: level 2 and level 4; it sets the timing template to level 4, increasing the scanning speed. Nmap offers five times of timing from T0, the slowest, to T5, the fastest timing users can employ depending on network state and target stability. A higher timing level shortens the scanning time and is suitable for achieving a quick assessment.

However, the price of faster timing is possible packet drops on the network or interceptions by an IDS system. The T4 set can maintain a fast sweep without straining the network’s resources. It is best used where time is of the essence.

8. Nmap Scripting Engine (NSE)

The NSE extends Nmap’s capabilities by running specialized scripts. Useful scripts include:

Vulnerability Scan

Command:

nmap --script vuln 192.168.1.1

A vulnerability scan is launched using the NSE tab in Nmap to begin the actual scan in a given IP. This scan contains a set of scripts that check well-known vulnerability issues, such as old software versions, misconfiguration, and security flaws.

It affords a relatively rapid means of evaluating the criticalities in a network for such problems burgeoning with potential vulnerabilities that attackers can seize on. The usefulness of this command is crucial for the system administration and security professional to monitor and potentially control the existence of these weak areas within the system infrastructure, hence improving the general security features of the system.

HTTP Enumeration

Command:

nmap --script http-enum 192.168.1.1

Nmap identifies HTTP directories on the target server. This scan only uses script and shows available directories and files on the HTTP server to understand its structure and existing entries. It helps test web applications and measure the exposure levels concerning web servers.

The command assists in mapping the application’s layout by revealing potentially sensitive directories. This can help identify unprotected or misconfigured files that could pose security risks, making it an essential technique in vulnerability assessment for web-based resources.

Custom Scripts

To use custom scripts, save them in the scripts directory and execute them:

nmap --script your_script_name 192.168.1.1

With this approach, users can create more scripts to add to Nmap’s functionality, for example, performing a particular scan or gathering specific data on a host. These scripts can be custom-developed depending on the particularity of a given network analysis to detect, for instance, a special kind of vulnerability or fetch a special type of information from the networked devices. 

The flexibility provided by custom scripts makes Nmap a highly adaptable tool for network administrators and security professionals looking to address unique challenges not covered by standard Nmap scripts.

9. Real-World Examples

Example 1: Scanning a Local Network

Command:

nmap -sn 192.168.1.0/24

This scan performs a simple ping sweep to discover active devices in a local network without performing a port scan. The -sn—union tells Nmap to skip port scanning and focus on identifying responsive hosts within the subnet. 

This is particularly useful for quickly mapping out devices connected to a local network, identifying IP addresses in use, and checking connectivity. Network administrators can use this command to assess network activity, check for unauthorized devices, or get an overview of network presence without a detailed scan.

Example 2: Web Server Analysis

Command:

nmap -p 80,443 -sV 192.168.1.100

It is designed to Scan ports 80 and 443 on a target IP address (in this case, 192.168.1.100). The -sV flag enables version detection, allowing Use Nmap to identify services and versions on these ports.

This scan is handy for checking web server configurations, identifying software versions, and verifying the availability of HTTP and HTTPS services. Network administrators can quickly assess web server security and functionality without a comprehensive port scan by focusing on these two essential ports.

Example 3: Checking for Vulnerabilities

Command:

nmap --script vuln 192.168.1.1

Leverages Nmap’s scripting engine to run vulnerability checks on the target IP address (192.168.1.1). The –script vuln parameter instructs Nmap to utilize a set of scripts designed to detect common vulnerabilities, such as outdated software, misconfigurations, and weak protocols.

This scan effectively identifies potential security risks on a device or network, as it can reveal issues that attackers might exploit. Security professionals use this scan as a proactive measure to harden systems and ensure compliance with security standards.

10. Best Practices

1. Use Stealth Scanning: To avoid detection, use commands like -sS.
2. Target Specific Ports: Focus scans on important ports using the -p option.
3. Stay Ethical: Always have permission before scanning networks.

11. Troubleshooting

Common Issues and Fixes:

Permission Errors:

You might encounter permission errors when running Nmap if you need to execute the command with sufficient privileges. To resolve this, use sudo before the command or run it as an administrator. For example, running

sudo nmap ...

ensures that Nmap has the necessary permissions to perform tasks that require elevated access, like scanning specific ports or interfaces.

Timeouts:
Nmap might time out during lengthy scans or when the target system has high latency. To address this, increase the host timeout duration by using the –host-timeout option followed by the desired time limit, like

nmap --host-timeout 2m 

This extension gives Nmap more time to gather information, reducing incomplete scans.

Ambiguous Results:
Nmap might return unclear or minimal results. To gain more detailed information, enable verbose mode with the -v option, as in

nmap -v 192.168.1.1

Verbose mode provides additional context on the scan’s progress and findings, helping you better interpret the results and troubleshoot issues.

Conclusion

Nmap is a robust tool for network discovery and security assessments, providing unparalleled insight into a network’s infrastructure. By understanding its commands and features, users can identify vulnerabilities, improve security, and gain better control of their network environments. While using Nmap, always adhere to ethical practices and legal regulations.

About the writer

Vinayak Baranwal wrote this article. Use the provided link to connect with Vinayak on LinkedIn for more insightful content or collaboration opportunities.