10 Practical ‘nmap’ Commands

Nmap is a tool used for determining the hosts that are running and what services the hosts are running.

n this article, we will cover some useful practical examples of Linux namp command. The primary Uses of
nmap is:

 Determining open ports and services running in an host

 Determine the Operating System running on a host
 Alter the source IP of the scan (One way is to use –S option)

Discover IP’s in a subnet

This command is commonly refereed to as a “ping scan”, and tells nmap to send an icmp echo request to all
hosts in the specified subnet.

$ nmap -sP 172.16.0.0/24

Check and Scan for open ports

This command is the default use of nmap allowing nmap to perform a DNS reverse lookup on the identified
IPs.

$ nmap 172.16.0.0/24 – Subnet

$ nmap 172.16.0.233 – Host

When scanning individual hosts, use the decoy mode:

e.g:
sudo nmap -n -D172.16.5.95,172.16.5.90,172.16.5.12,192.168.1.5 172.16.5.233

Identify the Operating System of a host

To identify the operating system of a host using nmap, you can do it with option -O.
$ sudo nmap -O 172.16.0.15

Scan TCP and UDP port

This command nmap -sS -sU -PN will check about 2000 common tcp and udp ports to see if they are
responding.

$ sudo nmap -sS -sU -PN 172.16.5.233

Scan TCP Connection

This command will ask the OS to establish a TCP connection to the 1000 common ports.
$ nmap -sT 172.16.0.14

Fast Scan
You can use this scan to check the most common 100 ports.
$ nmap -T4 -F 172.16.0.14

Aggressive and obtrusive Scan

Not like the earlier commands this scan is very aggressive and very obtrusive. The option -A will tell nmap to
perform OS checking and version checking. The -T4 is for the speed template, these templates are what tells
nmap how quickly to perform the scan.
$ nmap -T4 -A 172.16.0.0/24
Verbose [Use this!]
The last command is verbose. When you add verbose to the commands line above you will get a better info
into what nmap is doing and also get DNS name of Host.
$ nmap -T4 -A -v 172.16.0.16

e.g:

sudo nmap -T4 -A -v -D172.16.5.90,172.16.5.95,172.16.5.12,192.168.1.15

172.23.0.231

Scan for MAC Address

You can issue the same command to identify device MAC address
sudo nmap -T4 -A -v -D172.16.5.90,172.16.5.95,172.16.5.12,192.168.1.15
172.16.0.3

nmap -T4 -sP -D172.16.1.221,192.168.0.236,172.16.1.20 172.16.0.34

However, this only works if the device is in the same network with the scanning host. If you are scanning a
10.x.x.x network in 172.16.0.x network, MAC address won’t display