Nmap Tutorial for Beginners: Complete Guide to Network Scanning

Nmap, short for Network Mapper, is a widely used open-source tool for network discovery and security auditing.

For cybersecurity beginners, Nmap is useful because it helps you understand important networking concepts such as IP addresses, ports, services, protocols, hosts, and network discovery.

This guide explains Nmap from the beginning, including installation, basic commands, scan types, interpreting results, common mistakes, and safe practice examples.

Important Security Notice: Never scan networks, servers, devices, or applications that you do not own or do not have explicit permission to test. Use your own computer, virtual machines, or authorized training labs.

What Is Nmap?

Nmap is a network exploration and security auditing tool.

It can help identify information such as:

• Which hosts are reachable
• Which ports are open
• Which services may be listening
• Which protocols are in use
• Basic characteristics of a target system

Nmap is commonly used by system administrators, network engineers, security professionals, and students in authorized environments.

Why Should Cybersecurity Beginners Learn Nmap?

Nmap is valuable because it connects several concepts that beginners need to understand.

For example:

IP Address → Host → Port → Service → Protocol

Instead of only reading about ports and services, Nmap lets you observe how systems expose network services in a controlled environment.

How Does Nmap Work?

At a high level, Nmap sends specially constructed network probes and analyzes the responses.

Depending on the scan and target, Nmap may help determine whether:

• A host appears reachable
• A TCP port appears open
• A port appears closed
• A port is filtered
• A service may be running

The exact result depends on the scan type, operating system, firewall behavior, network path, and other conditions.

What Is a Port?

A port is a logical endpoint used by networked applications and services.

For example, common services may use well-known port numbers.

Port	Common Service	Protocol
22	SSH	TCP
25	SMTP	TCP
53	DNS	TCP/UDP
80	HTTP	TCP
443	HTTPS	TCP

These are examples of commonly associated ports. A service is not permanently tied to a particular port number, and administrators can configure services differently.

Installing Nmap

The exact installation command depends on your operating system.

Ubuntu or Debian-Based Linux

sudo apt update
sudo apt install nmap

Fedora-Based Linux

sudo dnf install nmap

Windows

Download Nmap from its official website and follow the Windows installation instructions.

macOS

Nmap can also be installed on macOS using supported package-management options or the official installer.

After installation, check whether Nmap is available:

nmap --version

Basic Nmap Syntax

The basic structure is:

nmap [options] target

For example, in your own lab:

nmap 192.168.1.10

Replace the example address with an IP address belonging to a system you are authorized to test.

1. Basic Scan

A basic Nmap scan can be performed with:

nmap 192.168.1.10

Nmap will attempt to identify accessible TCP ports using its default scanning behavior and report the results.

2. Scan Localhost

One of the safest ways to learn Nmap is to scan your own computer.

nmap localhost

You can also use:

nmap 127.0.0.1

This is a good starting point because the target is your own machine.

3. Scan Specific Ports

You can specify individual ports:

nmap -p 22,80,443 192.168.1.10

This asks Nmap to examine the listed ports on the authorized target.

4. Scan a Port Range

You can scan a specific range:

nmap -p 20-100 192.168.1.10

This checks ports from 20 through 100.

5. Scan All TCP Ports

You can request a scan of all TCP port numbers:

nmap -p- 192.168.1.10

This can take longer than scanning a smaller set of ports.

6. Service Version Detection

The -sV option attempts to determine what services are running and may identify version information.

nmap -sV 192.168.1.10

This is useful in authorized security assessments because knowing the service can help administrators identify unexpected or unnecessary network exposure.

7. Operating System Detection

The -O option attempts operating-system fingerprinting.

sudo nmap -O 192.168.1.10

Operating-system detection is based on network characteristics and may not always be accurate.

8. More Aggressive Detection

The -A option enables a collection of detection features.

nmap -A 192.168.1.10

This can generate significantly more traffic and information than a basic scan, so it should only be used where you are explicitly authorized.

9. Scan Multiple Hosts

Nmap can scan multiple explicitly authorized hosts.

nmap 192.168.1.10 192.168.1.20

You can also specify a range carefully inside your own lab:

nmap 192.168.1.10-20

10. Scan a Subnet in Your Own Lab

For an authorized private network, you can specify CIDR notation.

nmap 192.168.1.0/24

Only do this when you have permission to scan the entire range.

11. Host Discovery

The -sn option performs host discovery without performing a traditional port scan.

nmap -sn 192.168.1.0/24

This can help identify which systems appear to be online on an authorized network.

Understanding Nmap Results

A simplified result can look similar to:

PORT    STATE    SERVICE
22/tcp  open     ssh
80/tcp  open     http
443/tcp open     https

Let's understand what the columns mean.

PORT

This shows the port number and transport protocol.

For example:

80/tcp

means port 80 using TCP.

STATE

Nmap may report states such as:

• open — an application appears to be accepting connections
• closed — the port is reachable but no application appears to be listening
• filtered — a filtering mechanism prevents Nmap from determining the state normally

There are additional Nmap states, and the exact result depends on the scan method.

SERVICE

This column gives Nmap's interpretation of the service associated with the port.

It is an identification hint, not an absolute guarantee that the expected service is actually running.

Open vs Closed vs Filtered Ports

State	Meaning
Open	A service appears to be accepting connections.
Closed	The port is reachable, but no service appears to be listening.
Filtered	A filter or firewall prevents Nmap from determining the port state normally.

TCP and UDP Scanning

Nmap supports both TCP and UDP scanning methods.

TCP Example

nmap -sT 192.168.1.10

UDP Example

sudo nmap -sU 192.168.1.10

UDP scanning can be slower because UDP does not use the same connection behavior as TCP.

SYN Scan

The -sS option performs a TCP SYN scan.

sudo nmap -sS 192.168.1.10

This is a commonly used TCP scanning method for security auditing in authorized environments.

Save Nmap Results to a File

It is useful to save the output so you can compare results later.

Normal Output

nmap -oN scan.txt 192.168.1.10

XML Output

nmap -oX scan.xml 192.168.1.10

Save Multiple Output Formats

nmap -oA myscan 192.168.1.10

Saving scan results can make documentation and comparison much easier.

Useful Nmap Options for Beginners

Option	Purpose
-p	Specify ports
-p-	Scan all TCP ports
-sV	Service/version detection
-O	OS detection attempt
-A	Enable several detection features
-sn	Host discovery without a port scan
-sS	TCP SYN scan
-sU	UDP scan
-oN	Save normal output
-oX	Save XML output
-oA	Save output in multiple formats

Safe Nmap Practice Lab

The best way to learn Nmap is to use a small lab that you control.

Lab Option 1: Scan Your Own Computer

Start with:

nmap localhost

This lets you learn the basic output without scanning another person's machine.

Lab Option 2: Use a Virtual Machine

Create a Linux virtual machine and place it on a private lab network.

Then identify its IP address and scan that machine from your authorized testing system.

For example:

ip addr

Suppose your lab machine has an address such as:

192.168.56.101

You could then run:

nmap 192.168.56.101

Only use an address belonging to your own lab.

What Should You Do After Finding an Open Port?

Finding an open port is not automatically a security vulnerability.

An open port simply indicates that a service appears to be accessible.

The next questions should be:

• What service is running?
• Is the service expected?
• Is remote access actually required?
• Is the service configured securely?
• Is the software maintained and patched?
• Can access be restricted?

This is an important mindset for cybersecurity students: discovery is the beginning of analysis, not the end.

Nmap and Firewalls

Firewalls and network filtering can change what Nmap observes.

For example, a port may appear filtered because a firewall is dropping or restricting traffic.

This is why Nmap results should always be interpreted in context.

Nmap and Service Detection

Suppose Nmap reports:

80/tcp open http
443/tcp open https

This suggests that services associated with HTTP and HTTPS appear reachable.

You can then perform additional authorized investigation to understand how those services are configured.

Common Beginner Mistakes

1. Scanning random internet addresses

Do not scan internet systems just because they are publicly reachable.

Public availability does not automatically grant permission to test a system.

2. Treating every open port as a vulnerability

An open port can be completely legitimate and necessary for a service.

3. Ignoring service context

Understanding why a service is running is often more useful than simply finding the port number.

4. Using aggressive scans everywhere

Some scan modes generate more traffic or perform additional probing. Use them only when your authorization allows it.

5. Never documenting results

Save your scan output and record what you found. This helps you compare changes and learn from your results.

Nmap for Cybersecurity Students

Nmap can help you practice several fundamental topics.

Concept	What Nmap Helps You Understand
Networking	Hosts, addresses, ports and protocols
TCP	Connection behavior and port states
UDP	Connectionless network communication
Services	Which services may be exposed
Security	Network exposure and attack surface concepts
Administration	Inventory and troubleshooting

Example Learning Exercise

Try this simple sequence in your own lab:

Step 1: Identify your own system

ip addr

Step 2: Scan localhost

nmap localhost

Step 3: Check service information

nmap -sV localhost

Step 4: Scan specific ports

nmap -p 22,80,443 localhost

Step 5: Save your results

nmap -oN scan.txt localhost

Now compare the output and try to understand why each result appears.

How to Learn Nmap Properly

Do not focus only on memorizing options.

For every scan, ask yourself:

What did I scan?
Why did I scan it?
What does the output mean?
Which service is exposed?
Is the exposure expected?
What security control could reduce unnecessary exposure?

This approach helps turn Nmap from a command-line tool into a real learning instrument.

Nmap Cheat Sheet

# Scan localhost
nmap localhost

# Scan a specific host
nmap 192.168.1.10

# Scan specific ports
nmap -p 22,80,443 192.168.1.10

# Scan a range of ports
nmap -p 20-100 192.168.1.10

# Scan all TCP ports
nmap -p- 192.168.1.10

# Detect services
nmap -sV 192.168.1.10

# Attempt OS detection
sudo nmap -O 192.168.1.10

# Enable multiple detection features
nmap -A 192.168.1.10

# Host discovery
nmap -sn 192.168.1.0/24

# TCP SYN scan
sudo nmap -sS 192.168.1.10

# UDP scan
sudo nmap -sU 192.168.1.10

# Save normal output
nmap -oN scan.txt 192.168.1.10

# Save XML output
nmap -oX scan.xml 192.168.1.10

Remember: Replace the sample addresses with systems you are explicitly authorized to test.

Frequently Asked Questions

Is Nmap free?

Nmap is an open-source network scanning and security auditing tool.

Is Nmap used by hackers?

Nmap is used for legitimate purposes such as network administration, security auditing, inventory, troubleshooting, education, and authorized security testing. Like many security tools, it can also be misused, so authorization is essential.

Can Nmap find open ports?

Yes. Port discovery is one of Nmap's primary uses.

Can Nmap find operating systems?

Nmap can attempt operating-system detection using network fingerprinting techniques, but results are not guaranteed to be accurate.

Can I use Nmap on my own computer?

Yes. Scanning your own computer is a good way to learn the basics.

Is scanning a public website always legal?

No. A website being publicly accessible does not automatically mean you are authorized to perform security scanning against it. Use systems and labs where you have explicit permission.

What should I learn before Nmap?

Learn basic networking first, especially IP addresses, TCP, UDP, ports, DNS, routing, and common network services.

What should I learn after Nmap?

Continue with networking analysis, Wireshark, web fundamentals, Linux, service enumeration, system administration, and authorized security labs.

Recommended Reading on CodeWithAV

Cybersecurity Roadmap for Beginners

Linux Commands for Cybersecurity Beginners

Computer Networking Resources

Final Thoughts

Nmap is an excellent tool for learning practical networking and security concepts.

Start with localhost and your own virtual machines. Learn what each result means instead of simply running commands from a cheat sheet.

As your knowledge improves, you can use Nmap as part of a broader workflow involving network analysis, service identification, configuration review, documentation, and defensive security.

CodeWithAV Tip: Keep a notebook of your lab scans. Record the IP address, open ports, detected services, date, and what you learned. Comparing results over time is a great way to understand network changes.