Beginner's Guide to Nmap | Linux.

com

Linux Foundation

Training

Events

http://www.linux.com/learn/tutorials/290879-begi...

Video

search linux.com

Home

Home

News

Linux Community

Learn Linux

Learn Linux

Linux Tutorials

Directory

Jobs

Beginner's Guide to Nmap

Beginner's Guide to Nmap

Wednesday, 03 March 2010 09:13
Like

75

Tweet

Joe 'Zonker' Brockmeier

21

Exclusive

Ever wondered how attackers know what ports are open on a system? Or how to find out what services a
computer is running without just asking the site admin? You can do all this and more with a handy little tool
called Nmap.
What is Nmap? Short for "network mapper," nmap is a veritable toolshed of functionality to perform network
scans. It can be used for security scans, simply to identify what services a host is running, to "fingerprint" the
operating system and applications on a host, the type of firewall a host is using, or to do a quick inventory of
a local network. It is, in short, a very good tool to know.

Upcoming Linux Fo

It's famous, too. Once you get to know Nmap a bit, you'll notice that it makes all types of cameo
appearances in movies.

LFD312 Developing A

In this tutorial, I'll cover some of the basics of using Nmap and provide some examples you can use quickly.

Getting Nmap and Basic Use

17 Nov
DETAILS

LFD405 Embedded Li

You'll find Nmap packaged for most major Linux distros. The most recent release of Nmap came out in early
2010, so the most recent version (5.21) might not be in the current stable releases. You can find the sources
and some binaries on the download page.
The basic syntax for Nmap is Nmap Scan Type Options target. Let's say you want to scan a host to see
what operating system it is running. To do this, run the following:

17 Nov
DETAILS

LFS540 Linux KVM Vi

02 Dec
DETAILS

View All Upcoming Cou

nmap -O target.host.com
Note that Nmap requires root privileges to run this type of scan. The scan might take a minute or so to run,
so be patient. When it finishes, you'll see something like this:
Starting Nmap 5.21 ( http://nmap.org ) at 2010-02-27 23:52 EST
Nmap scan report for 10.0.0.1

1 of 7

11/08/2014 12:57 AM

Beginner's Guide to Nmap | Linux.com

http://www.linux.com/learn/tutorials/290879-begi...

Host is up (0.0015s latency).

Not shown: 997 closed ports
PORT
STATE SERVICE
53/tcp
open domain
5009/tcp open airport-admin
10000/tcp open snet-sensor-mgmt
MAC Address: 00:11:24:6B:43:E2 (Apple Computer)
Device type: WAP|printer
Running: Apple embedded, Canon embedded, Kyocera embedded, Xerox embedded
OS details: VxWorks: Apple AirPort Extreme v5.7 or AirPort Express v6.3;
Canon imageRUNNER printer (5055, C3045, C3380, or C5185); Kyocera
FS-4020DN printer; or Xerox Phaser 8860MFP printer
Network Distance: 1 hop

Tweets

OS detection performed. Please report any incorrect results at

http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 10.21 seconds
As you can see, Nmap provides a lot of data. Here it takes a guess at the operating system that might be
running on the system. I ran this particular scan against an Apple Airport Extreme router. As an added
bonus, Nmap tells me that the device is one hop away, the MAC address of the device and manufacturer of
the NIC, the open ports, and how long the scan took.

Compose new Tw

Here's the result of another scan, against a desktop machine running Ubuntu 9.10:
Starting Nmap 5.21 ( http://nmap.org ) at 2010-02-28 00:00 EST
Nmap scan report for 10.0.0.6
Host is up (0.0039s latency).
Not shown: 999 closed ports
PORT
STATE SERVICE
22/tcp open ssh
MAC Address: 00:17:08:2A:D6:F0 (Hewlett Packard)
Device type: general purpose
Running: Linux 2.6.X
OS details: Linux 2.6.19 - 2.6.31
Network Distance: 1 hop
OS detection performed. Please report any incorrect results at
http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 3.40 seconds

Latest Tutorials

The Perfect Server - U

Here we see that the system has an HP NIC (it's an HP workstation), running the Linux kernel somewhere
between Linux 2.6.19 and 2.6.31. You may not be able to get an explicit identification of the operating
system down to the version of Linux.

Intro to Systemd Runle

Commands

Practice Hosts

Monitor Ubuntu 14.04 a

In the examples above, I chose a local router and one of my workstations in part because I have the
permission to scan them. You can use Nmap to scan virtually any host. However, it's a bad idea to run many

2 of 7

ISPConfig 3)

Linux-Dash

11/08/2014 12:57 AM

Beginner's Guide to Nmap | Linux.com

http://www.linux.com/learn/tutorials/290879-begi...

scans against hosts you're not in control of or don't have permission to scan. The Nmap folks have a test
host at scanme.nmap.org that can be used for testing, so long as you're not running any tests of exploits or
Denial of Service (DoS) attacks.
Some admins don't appreciate unexpected scans, so use best judgment and restrict scans to hosts that are
on your own network or that you have permission to scan. It may also be against your ISP's terms of service
to use some of Nmap's more aggressive scan features, so be careful out there!

Multiple Hosts

How to Use NumPy for

How to Find the Best L

Sign Up For th
First Name

You can scan more than one host at a time using nmap. If you're using IP addresses, you can specify a
range like 10.0.0.1-6 or a range like 10.0.0.0/24. The 10.0.0.1-6 would scan hosts 10.0.0.1, 10.0.0.2,
10.0.0.3 through 10.0.0.6. Using the /24 notation would scan the whole range of hosts from 10.0.0.0 to
10.0.0.255. For example, to scan 10.0.0.1 through 10.0.0.42 to learn what OS they might be running I'd use
nmap -O 10.0.0.1-42.

Last Name

Country

If you have hostnames instead of IP addresses, you can separate them with a space on the command line,
like so:
nmap -O host1.target.com host2.target.com

Checking Open Ports

If you give Nmap no options at all and just point it at a given host it will scan for open ports and report back
those that are open, and what service is running on them. For instance, running nmap
target.hostname.com might yield something like this:

Latest Software New

Companies Are Finally

Way

Ubuntu, ownCloud, and

Interesting ports on target.hostname.com (10.0.0.88):

Not shown: 1711 closed ports
PORT
STATE SERVICE
22/tcp
open ssh
80/tcp
open http
3306/tcp open mysql

Repositories

Raided for Hosting a To

New Kernel Live Patch

Debian 8.0 Jessie Now

Nmap done: 1 IP address (1 host up) scanned in 0.228 seconds

Here you can see that there are three ports open: 22, 80, and 3306 which run SSH, HTTP, and MySQL
respectively. Nmap recognizes six states: open, closed, filtered, unfiltered, open|filtered, and closed|filtered.
These are mostly self-explanatory. See the Nmap docs for more on these states. If Nmap can tell what
service is running, it will report it under the SERVICE column.
If you'd like a little more information, crank it up a notch by adding one or two -v options to the command.
For example, using nmap -vv host.target.com would produce something like this:
Initiating Ping Scan at 11:44
Scanning 10.0.0.28 [1 port]
Completed Ping Scan at 11:44, 0.00s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 11:44
Completed Parallel DNS resolution of 1 host. at 11:44, 0.00s elapsed

3 of 7

11/08/2014 12:57 AM

Beginner's Guide to Nmap | Linux.com

http://www.linux.com/learn/tutorials/290879-begi...

Initiating Connect Scan at 11:44

Scanning host.target.com (10.0.0.28) [1714 ports]
Discovered open port 22/tcp on 10.0.0.28
Discovered open port 80/tcp on 10.0.0.28
Discovered open port 3306/tcp on 10.0.0.28
Completed Connect Scan at 11:44, 0.08s elapsed (1714 total ports)
Host host.target.com (10.0.0.28) appears to be up ... good.
Interesting ports on host.target.com (10.0.0.28):
Not shown: 1711 closed ports
PORT
STATE SERVICE
22/tcp
open ssh
80/tcp
open http
3306/tcp open mysql
Read data files from: /usr/share/nmap
Nmap done: 1 IP address (1 host up) scanned in 0.104 seconds
Nmap provides a lot more information when using the verbose (-v) option.

Service Scans
If you're really curious about what services a host might be running, try the -sV options. This will do a more
aggressive scan to try to figure out what versions of services are running on a given host, and also might
help determine more specifically what OS a host is running. For instance, I ran nmap -sV against a test
server and got this in response:
Starting Nmap 5.21 ( http://nmap.org ) at 2010-02-28 00:15 EST
Nmap scan report for test.host.net (XX.XXX.XXX.XX)
Host is up (0.090s latency).
Not shown: 965 closed ports, 33 filtered ports
PORT
STATE SERVICE VERSION
22/tcp open ssh
OpenSSH 4.7p1 Debian 8ubuntu1.2 (protocol 2.0)
80/tcp open http
Apache httpd 2.2.8 ((Ubuntu) PHP/5.2.4-2ubuntu5.10
with Suhosin-Patch)
Service Info: OS: Linux
Service detection performed. Please report any incorrect results at
http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 11.43 seconds
As you can see, Nmap can "fingerprint" the packets and identify the versions of the software running on the
SSH and HTTP ports. Here you can see that the system being pinged is a Ubuntu box with Apache 2.2.8
and OpenSSH 4.7p1. This can be useful for a number of reasons. A quick Nmap scan can identify systems
that are running unpatched systems and therefore ones that might be vulnerable to known exploits.

What's on My Network?
Not quite sure what might be running on your network? Try using nmap -sP, which will run a ping scan on
the specified network. For instance, nmap -sP 10.0.0.0/24 will scan the 256 hosts from 10.0.0.0 through

4 of 7

11/08/2014 12:57 AM

Beginner's Guide to Nmap | Linux.com

http://www.linux.com/learn/tutorials/290879-begi...

10.0.0.255 to see if they're available, and report back. You can also use a range, such as nmap -sP
10.0.0.1-15.

Zenmap
Finally, if all this command line fun is not your bag, Nmap has a GUI that you can use to build and execute
commands. Called Zenmap, the GUI will let you specify targets, run scans, display the results and even save
and compare them against one another.
When you open Zenmap, you can give it a target to scan and select one of the profile scans to get started. It
includes your basic ping scan, quick scans, some more intense scans that include UDP services, and so
forth. The Zenmap GUI is a good way to get acquainted with Nmap, but it's also a good idea to know how to
use Nmap from the command line if you're going to be working with it often.
In a future tutorial we'll take a more in-depth look at Nmap and specific tasks you might want to do with
Nmap. I hope this overview gave a good sense what Nmap can do and helps you get started working with
Nmap.

Joe 'Zonker' Brockmeier

Comments

Khalifa :

20 Nov 12

This is really helpful, thank you very much for your efforts in making it easy to read &
understand specially for non-english readers.

Report

Edward Mwangile :

Reply

13 Dec 12

The tutorial is very helpful for beginners.

Report

Hadi :

5 of 7

Reply

09 Apr 13

11/08/2014 12:57 AM

Beginner's Guide to Nmap | Linux.com

http://www.linux.com/learn/tutorials/290879-begi...

very newbie friendly, people should learn to explain stuff in this way to beginners.
Thanks

Report

Lily :

Reply

13 Sep 13

I wrote a blog post titled: "3 easy quick resources and nmap tutorials" which readers
might find helpful! Thought I'd share: http://www.concise-courses.com/security/nmaptutorial-and-help/ Thanks - Lily

Report

Nandan :

Reply

26 Feb

The content is very helpful. Thanks for explaining it in simple way

Report

Vaidik :

Reply

04 Apr

If it is showing that the host is down then what should we do?

Report

Aaron :

Reply

30 Apr

This is a very good post...It explained the concepts in a very beginner friendly way.

Report

Alvaro :

Reply

08 Sep

Hello, my name is Alvaro Valenzuela, actually i am working in my thesis project for

my bachelor degree in informatic engineer and i have to analyze the behavior of
some IP's that operate as free WiFi hotspots. My question has to do with the
difference between 1) and 2) at the moment of detecting on one of them the SSL and
in the another one not. I hope you can help me with that! Regards, 1) PORT STATE
SERVICE VERSION 443/tcp open ssl/https? 2) PORT STATE SERVICE VERSION
443/tcp open https?

Report

6 of 7

Reply

11/08/2014 12:57 AM

Beginner's Guide to Nmap | Linux.com

http://www.linux.com/learn/tutorials/290879-begi...

walex :

4 days ago

Very interesting

Report

Reply

Name :

Email :

Comment :

Post Comment

Subscribe to Comments

WHO WE ARE ?

EXPLORE

STAY CURRENT

The Linux Foundation is a non-profit

Answers

Netbooks

Blogs

Cloud Computing

Forums

Enterprise

Directory

Embedded & Mobile

consortium dedicated to the growth of

Linux.
More About the foundation...
Frequent Questions
Join / Linux Training / Board

Linux.com 2012 Linux.com. All rights reserved.

The Linux Foundation Symbol is a trademark of the Linux Foundation.
Linux is a registered trademark of Linus Torvalds.

7 of 7

11/08/2014 12:57 AM