Nmap

Tool manual · Kali & common usage

Network · Beginner · Network lane

BeginnerNetwork Scanner

Authorized usage only. Capture and inspect traffic only on systems and networks you own or have written permission to analyze.

What is Nmap?

Nmap (Network Mapper) discovers hosts and services on a network by sending crafted probes and interpreting responses.

Asset discovery, open-port inventory, service/version detection, and basic scripted checks — only on authorized targets.

Official website: Nmap · Documentation

Do not scan the public internet or third-party networks without written permission.
Aggressive timing (-T5) on production can cause outages — use carefully.

Every serious tool has a built-in way to look up flags. Learn these first so you are not stuck memorizing every option.

1. Help
```
nmap -h
```
Quick flag overview.
2. Man page
```
man nmap
```
Complete reference.
3. Official book/docs
```
https://nmap.org/book/man.html
```
Authoritative option guide.

Preinstalled on Kali. Package: nmap. Default tool for host/port discovery.

OS	Installation
`Kali Linux`	Preinstalled on Kali. Package: nmap. Default tool for host/port discovery.
`Debian/Ubuntu`	sudo apt install nmap
`macOS`	brew install nmap
`Windows`	Installer from nmap.org

1. Quick local scan
```
nmap 127.0.0.1
```
Common ports on localhost.
2. Service versions
```
nmap -sV 127.0.0.1
```
Detect service/version where possible.
3. Specific ports
```
nmap -p 22,80,443 127.0.0.1
```
Limit port set.
4. Official test host
```
nmap scanme.nmap.org
```
Only host Nmap authorizes publicly.
5. Save output
```
nmap -oN scan.txt 127.0.0.1
```
Normal output file.

Option	Purpose
`-sV`	Service/version detection
`-sC`	Default NSE scripts
`-p <ports>`	Port list or range
`-T0..5`	Timing template (slower → stealthier / safer)
`-Pn`	Skip host discovery (treat host as up)
`-oA name`	Save all major output formats

Example 1: Quick local scan
```
nmap 127.0.0.1
```
Common ports on localhost.
Example 2: Service versions
```
nmap -sV 127.0.0.1
```
Detect service/version where possible.
Example 3: Specific ports
```
nmap -p 22,80,443 127.0.0.1
```
Limit port set.
Example 4: Official test host
```
nmap scanme.nmap.org
```
Only host Nmap authorizes publicly.
Example 5: Save output
```
nmap -oN scan.txt 127.0.0.1
```
Normal output file.

Used by sysadmins for asset inventory and by defenders to verify firewall rules.
Authorized targets only — labs, systems you own, or written permission.
Prefer reading --help / man / official docs for your installed version; flags change over time.