Skip to content

Nmap

MITRE ATT&CK: T1595 Active Scanning · T1046 Network Service Discovery · T1018 Remote System Discovery · Tactic: Reconnaissance / Discovery · Last updated: 2026-10-13

What it does

Nmap sends crafted packets and classifies the replies (or the silence) into port states and service identities. Everything it reports is an inference from how the target answered, so the same output can mean different things depending on a firewall in between.

Pages in this section

Cheat sheet

Goal Command
Live hosts on a subnet, no port scan sudo nmap 10.129.2.0/24 -sn -oA hosts
All TCP ports, fast sudo nmap <ip> -p- --min-rate 1000 -oA full_tcp
Versions on the open ports only sudo nmap <ip> -p 22,80,443 -sV -oA svc
Default scripts + versions sudo nmap <ip> -sC -sV -oA default
Top UDP ports sudo nmap <ip> -sU --top-ports 100 -oA udp
See exactly what was sent/received sudo nmap <ip> -p 80 --packet-trace -Pn -n --disable-arp-ping
Why does Nmap think the port is that state add --reason
Scan progress press Space or --stats-every=5s

Pentester view

  • Scope first. Scan only what the rules of engagement list. Pass the scope file with -iL scope.txt.
  • The real risk is availability, not detection. In a pentest the client usually knows you are scanning. What can hurt is a fragile device (printers, PLCs, old appliances) falling over under aggressive timing, or an intrusive/dos script. Keep -T4 for labs; on client networks lower --max-rate and avoid dos, intrusive, brute and exploit scripts unless the scope explicitly allows them.
  • Save everything. -oA every time. Reports and re-checks come from the saved files, not from memory.
  • Two-stage workflow. A quick -p- to find ports, then -sV -sC only on those ports. Much less traffic than -sV over 65535 ports.

Defender view

Where Artifact What to look for
Zeek conn.log conn_state = S0 (SYN, no reply) or REJ (RST reply) One source touching many destination ports or hosts in a short window
Zeek notice.log Scan::Port_Scan, Scan::Address_Scan Built-in scan detection
Firewall logs Many denied connections from one source Count distinct dest_port per src_ip
Windows Security log 5156 allowed / 5157 blocked (Filtering Platform) Only if audit policy enabled
IDS Nmap default User-Agent Nmap Scripting Engine in HTTP NSE web scripts are easy to fingerprint 
index=firewall action=blocked
| bin _time span=5m
| stats dc(dest_port) AS ports dc(dest_ip) AS hosts count BY _time src_ip
| where ports > 50 OR hosts > 20

bin _time span=5m puts events in 5-minute buckets, stats dc() counts distinct values per source per bucket, and where keeps only sources that touched many ports or hosts.

CPTS exam notes

Always run a full -p- TCP scan, not just the top 1000. Run UDP top ports too (SNMP 161, DNS 53, TFTP 69 are common finds). Keep every scan's -oA output for the report's evidence section.