Manage Learn to apply best practices and optimize your operations.

Nmap: How to scan ports and services

Nmap is the ideal tool for performing a simple network inventory or vulnerability assessment. This article offers tips on how to use a Nmap

This is the fourth in a series of tips on how to use Nmap in an enterprise network environment.

Nmap is the ideal tool for performing a simple network inventory or vulnerability assessment. By default, Nmap scans perform a SYN Scan, which works against any compliant TCP stack, rather than depending on idiosyncrasies of specific platforms. It can be used to quickly scan thousands of ports, and it allows clear, reliable differentiation between ports in open, closed and filtered states.

To perform an Nmap SYN scan on the host, use the command:


Though not essential, it's best if you have root access on your Unix or Linux machine, or use an administrator account on Windows, as most of the scan types send and receive raw packets, and so are only available to privileged users. If you don't have the necessary privileges or you are scanning an IPv6 network, use the command:

nmap –sT

to perform a TCP connect scan. Nmap scans all ports up to and including 1024, as well as higher numbered ports listed in the nmap-services file. You can also specify the ports you want to scan using –p, so:

nmap –p U:53,T:21-25

will scan just UDP port 53 and TCP ports 21 to 25.

Once Nmap has scanned and discovered a machine's visible ports, you need to know which services are running on them in order to inventory them or determine to which exploits the machine is vulnerable. The –sV option enables version detection interrogation, but a better option is –A which enables both OS detection and version detection. The following uses the nmap-service-probes database to try and determine the service protocol, the application name, the version number, hostname, device type, the OS family, and other miscellaneous details like the SSH protocol version or whether an X server is open to connections:

nmap –A

If Nmap is compiled with OpenSSL support, it can even connect to an SSL server to deduce the service listening behind that encryption layer. Another advantage of running version detection is that Nmap will try to get a response from TCP and UDP ports that a simple port scan can't determine are open or filtered, and Nmap will change the state to open if it succeeds.

Nmap offers various output formats for both human and machine consumption, including XML, which can be imported into a database or parsed by programs such as the Nmap graphical user interface NmapFE. For example, by adding the following options:

-oX and –oN

you can save the regular output for your own review while saving an XML version of the same scan for programmatic analysis, as in:

nmap –A –oX scanreport.xml –oN scanreport.txt

There are also options for controlling the detail of the output as well as various debugging messages. If a prolonged Nmap scan doesn't complete for some reason it can be resumed at the target it was querying when execution stopped, but unfortunately, this feature does not support the XML output format.

In the next Nmap tip we'll be looking at more Nmap scanning techniques, including Idle scans.

Nmap technical manual

About the author:
Michael Cobb, CISSP-ISSAP, is a renowned security author with over 20 years of experience in the IT industry. He has a passion for making IT security best practices easier to understand and achievable. His website offers free security posters to raise employee awareness of the importance of safeguarding company and client data and of following good practices. He co-authored the book IIS Security and has written many technical articles for leading IT publications. Mike has also been a Microsoft Certified Database Manager and registered consultant with the CESG Listed Advisor Scheme (CLAS).

Next Steps

Analyze your hosts and ports with Nmap

View a demonstration of using Nmap to scan a network

Join the discussion: Nmap: How to scan ports and services

This was last published in June 2006

Dig Deeper on Real-time network monitoring and forensics