Introduction to Nmap in an Authorized Lab
Before you scan
Scanning systems you do not own can be unlawful or violate terms of service. Practise on your own lab network (see build a personal lab) or on scanme.nmap.org, which the Nmap project provides for polite, limited test scans. Read ethical hacking vs malicious hacking first.
Install and check
sudo apt install nmap # Debian/Ubuntu
nmap --version
See the full Nmap tool page for links and notes.
Step 1 — find live hosts
nmap -sn 192.168.56.0/24
-sn means "no port scan": it only reports which hosts respond. Replace the network with your lab's subnet.
Step 2 — scan common ports
nmap --top-ports 100 192.168.56.101
Each result shows a port, its state (open, closed or filtered) and the guessed service name.
Step 3 — identify versions
nmap -sV -p 22,80,443 192.168.56.101
-sV probes open ports to detect the software and version. Version information helps you compare against advisories and the CVE database.
Step 4 — save your results
nmap -sV -oN scan.txt 192.168.56.101
-oN writes normal text output; -oX writes XML for tools.
Reading the output
| State | Meaning |
|---|---|
| open | A service is listening and accepting connections |
| closed | Reachable but nothing listening |
| filtered | A firewall or filter blocks the probe, so Nmap cannot tell |
Good habits
- Write down the scope and the time before scanning.
- Prefer slower timing on fragile systems (
-T2). - Do not leave scan results with credentials or hostnames unprotected.
- Learn what the scan looked like on the wire by capturing it with Wireshark.
Related practice: networking fundamentals.
Related tool: Nmap
Use techniques only on systems you are authorised to test.