Nmap

Nmap shows you which devices are on a network, which ports each one has open, and what services are running on them. Start by scanning your own computer, then move on to virtual machines you set up yourself.

This review is for people who know the basics of IP addresses and ports. After reading it, you can do the following:

• List the open ports on your own computer
• Tell the port states in the results apart (open, closed, and filtered)
• Find out which service and version is running on a port

##What Nmap is for

Nmap started as a port scanner, and that is still its core job. It can also do the following:

• Host discovery: find which IP addresses in a range have a device on them (-sn)
• Service and version detection: identify the software and version behind an open port (-sV)
• OS detection: guess the operating system from how the target’s packets look (-O)
• Script scanning: collect more detail with scripts written in Lua (NSE) (-sC)

For administrators, the main use is checking that their own network has no ports open that they didn’t expect.

##Install

Get Nmap from the official download page.

• Windows: run the installer (nmap-<version>-setup.exe). It also installs Npcap, which Nmap uses to send and receive packets, and the Zenmap GUI. The project supports Windows 7 and later.
• macOS: use the installer inside the disk image (.dmg).
• Linux: the project provides RPM packages and source code.

After installing, run nmap -V in a terminal to check that it prints a version number.

##Try it safely

Nmap sends packets to other devices, so decide on your target first.

1. Scan your own computer. Run this in a terminal. The traffic never leaves your machine.

   nmap 127.0.0.1

   On Windows, scanning your own machine requires Npcap. The installer’s default settings include it.

2. Scan virtual machines you set up yourself. Put them on an internal network with no outside connection and scan their IP addresses (see How to set up a safe test lab).

3. To try a scan over the internet, use scanme.nmap.org. The Nmap project set up this server and says you may scan it with Nmap. Keep it to a few scans a day.

##Read the results

Running nmap <target> with no options scans 1,000 common TCP ports. Each port in the results gets a state. These are the ones you will see most:

Nmap uses six states in total. The other three are unfiltered, open|filtered, and closed|filtered. A state describes how the port looks to Nmap, not a property of the port itself. The same port can show as open from inside the network and filtered from across the internet.

##Common options

For example, nmap -sV -p 22,80 127.0.0.1 checks what is running on ports 22 and 80 of your own computer.

##Why it needs admin rights

The default scan is a SYN scan (-sS). It builds and sends raw packets, which requires root on Linux and macOS. Without those rights, Nmap falls back to a connect scan (-sT), which uses the operating system’s normal connection calls. A connect scan works without special rights but is slower. On Windows, the project recommends running Nmap as an administrator.

##Cautions

##Read next

• cd ../wiresharkWiresharksee the packets Nmap sends and the replies, down to their contents
• cd ../suricataSuricataa tool on the other side that detects traffic such as scans
• cat ~/guides/lab-setup.mdHow to set up a safe test lab