Nmap Tutorial for Beginners: Complete Guide to Network Scanning
Nmap, short for Network Mapper, is a widely used open-source tool for network discovery and security auditing.
For cybersecurity beginners, Nmap is useful because it helps you understand important networking concepts such as IP addresses, ports, services, protocols, hosts, and network discovery.
This guide explains Nmap from the beginning, including installation, basic commands, scan types, interpreting results, common mistakes, and safe practice examples.
What Is Nmap?
Nmap is a network exploration and security auditing tool.
It can help identify information such as:
- Which hosts are reachable
- Which ports are open
- Which services may be listening
- Which protocols are in use
- Basic characteristics of a target system
Nmap is commonly used by system administrators, network engineers, security professionals, and students in authorized environments.
Why Should Cybersecurity Beginners Learn Nmap?
Nmap is valuable because it connects several concepts that beginners need to understand.
For example:
Instead of only reading about ports and services, Nmap lets you observe how systems expose network services in a controlled environment.
How Does Nmap Work?
At a high level, Nmap sends specially constructed network probes and analyzes the responses.
Depending on the scan and target, Nmap may help determine whether:
- A host appears reachable
- A TCP port appears open
- A port appears closed
- A port is filtered
- A service may be running
The exact result depends on the scan type, operating system, firewall behavior, network path, and other conditions.
What Is a Port?
A port is a logical endpoint used by networked applications and services.
For example, common services may use well-known port numbers.
| Port | Common Service | Protocol |
|---|---|---|
| 22 | SSH | TCP |
| 25 | SMTP | TCP |
| 53 | DNS | TCP/UDP |
| 80 | HTTP | TCP |
| 443 | HTTPS | TCP |
These are examples of commonly associated ports. A service is not permanently tied to a particular port number, and administrators can configure services differently.
Installing Nmap
The exact installation command depends on your operating system.
Ubuntu or Debian-Based Linux
sudo apt update
sudo apt install nmapFedora-Based Linux
sudo dnf install nmapWindows
Download Nmap from its official website and follow the Windows installation instructions.
macOS
Nmap can also be installed on macOS using supported package-management options or the official installer.
After installation, check whether Nmap is available:
nmap --versionBasic Nmap Syntax
The basic structure is:
nmap [options] targetFor example, in your own lab:
nmap 192.168.1.10Replace the example address with an IP address belonging to a system you are authorized to test.
1. Basic Scan
A basic Nmap scan can be performed with:
nmap 192.168.1.10Nmap will attempt to identify accessible TCP ports using its default scanning behavior and report the results.
2. Scan Localhost
One of the safest ways to learn Nmap is to scan your own computer.
nmap localhostYou can also use:
nmap 127.0.0.1This is a good starting point because the target is your own machine.
3. Scan Specific Ports
You can specify individual ports:
nmap -p 22,80,443 192.168.1.10This asks Nmap to examine the listed ports on the authorized target.
4. Scan a Port Range
You can scan a specific range:
nmap -p 20-100 192.168.1.10This checks ports from 20 through 100.
5. Scan All TCP Ports
You can request a scan of all TCP port numbers:
nmap -p- 192.168.1.10This can take longer than scanning a smaller set of ports.
6. Service Version Detection
The -sV option attempts to determine what services are running and may identify version information.
nmap -sV 192.168.1.10This is useful in authorized security assessments because knowing the service can help administrators identify unexpected or unnecessary network exposure.
7. Operating System Detection
The -O option attempts operating-system fingerprinting.
sudo nmap -O 192.168.1.10Operating-system detection is based on network characteristics and may not always be accurate.
8. More Aggressive Detection
The -A option enables a collection of detection features.
nmap -A 192.168.1.10This can generate significantly more traffic and information than a basic scan, so it should only be used where you are explicitly authorized.
9. Scan Multiple Hosts
Nmap can scan multiple explicitly authorized hosts.
nmap 192.168.1.10 192.168.1.20You can also specify a range carefully inside your own lab:
nmap 192.168.1.10-2010. Scan a Subnet in Your Own Lab
For an authorized private network, you can specify CIDR notation.
nmap 192.168.1.0/24Only do this when you have permission to scan the entire range.
11. Host Discovery
The -sn option performs host discovery without performing a traditional port scan.
nmap -sn 192.168.1.0/24This can help identify which systems appear to be online on an authorized network.
Understanding Nmap Results
A simplified result can look similar to:
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
443/tcp open httpsLet's understand what the columns mean.
PORT
This shows the port number and transport protocol.
For example:
80/tcpmeans port 80 using TCP.
STATE
Nmap may report states such as:
- open — an application appears to be accepting connections
- closed — the port is reachable but no application appears to be listening
- filtered — a filtering mechanism prevents Nmap from determining the state normally
There are additional Nmap states, and the exact result depends on the scan method.
SERVICE
This column gives Nmap's interpretation of the service associated with the port.
It is an identification hint, not an absolute guarantee that the expected service is actually running.
Open vs Closed vs Filtered Ports
| State | Meaning |
|---|---|
| Open | A service appears to be accepting connections. |
| Closed | The port is reachable, but no service appears to be listening. |
| Filtered | A filter or firewall prevents Nmap from determining the port state normally. |
TCP and UDP Scanning
Nmap supports both TCP and UDP scanning methods.
TCP Example
nmap -sT 192.168.1.10UDP Example
sudo nmap -sU 192.168.1.10UDP scanning can be slower because UDP does not use the same connection behavior as TCP.
SYN Scan
The -sS option performs a TCP SYN scan.
sudo nmap -sS 192.168.1.10This is a commonly used TCP scanning method for security auditing in authorized environments.
Save Nmap Results to a File
It is useful to save the output so you can compare results later.
Normal Output
nmap -oN scan.txt 192.168.1.10XML Output
nmap -oX scan.xml 192.168.1.10Save Multiple Output Formats
nmap -oA myscan 192.168.1.10Saving scan results can make documentation and comparison much easier.
Useful Nmap Options for Beginners
| Option | Purpose |
|---|---|
| -p | Specify ports |
| -p- | Scan all TCP ports |
| -sV | Service/version detection |
| -O | OS detection attempt |
| -A | Enable several detection features |
| -sn | Host discovery without a port scan |
| -sS | TCP SYN scan |
| -sU | UDP scan |
| -oN | Save normal output |
| -oX | Save XML output |
| -oA | Save output in multiple formats |
Safe Nmap Practice Lab
The best way to learn Nmap is to use a small lab that you control.
Lab Option 1: Scan Your Own Computer
Start with:
nmap localhostThis lets you learn the basic output without scanning another person's machine.
Lab Option 2: Use a Virtual Machine
Create a Linux virtual machine and place it on a private lab network.
Then identify its IP address and scan that machine from your authorized testing system.
For example:
ip addrSuppose your lab machine has an address such as:
192.168.56.101You could then run:
nmap 192.168.56.101Only use an address belonging to your own lab.
What Should You Do After Finding an Open Port?
Finding an open port is not automatically a security vulnerability.
An open port simply indicates that a service appears to be accessible.
The next questions should be:
- What service is running?
- Is the service expected?
- Is remote access actually required?
- Is the service configured securely?
- Is the software maintained and patched?
- Can access be restricted?
This is an important mindset for cybersecurity students: discovery is the beginning of analysis, not the end.
Nmap and Firewalls
Firewalls and network filtering can change what Nmap observes.
For example, a port may appear filtered because a firewall is dropping or restricting traffic.
This is why Nmap results should always be interpreted in context.
Nmap and Service Detection
Suppose Nmap reports:
80/tcp open http
443/tcp open httpsThis suggests that services associated with HTTP and HTTPS appear reachable.
You can then perform additional authorized investigation to understand how those services are configured.
Common Beginner Mistakes
1. Scanning random internet addresses
Do not scan internet systems just because they are publicly reachable.
Public availability does not automatically grant permission to test a system.
2. Treating every open port as a vulnerability
An open port can be completely legitimate and necessary for a service.
3. Ignoring service context
Understanding why a service is running is often more useful than simply finding the port number.
4. Using aggressive scans everywhere
Some scan modes generate more traffic or perform additional probing. Use them only when your authorization allows it.
5. Never documenting results
Save your scan output and record what you found. This helps you compare changes and learn from your results.
Nmap for Cybersecurity Students
Nmap can help you practice several fundamental topics.
| Concept | What Nmap Helps You Understand |
|---|---|
| Networking | Hosts, addresses, ports and protocols |
| TCP | Connection behavior and port states |
| UDP | Connectionless network communication |
| Services | Which services may be exposed |
| Security | Network exposure and attack surface concepts |
| Administration | Inventory and troubleshooting |
Example Learning Exercise
Try this simple sequence in your own lab:
Step 1: Identify your own system
ip addrStep 2: Scan localhost
nmap localhostStep 3: Check service information
nmap -sV localhostStep 4: Scan specific ports
nmap -p 22,80,443 localhostStep 5: Save your results
nmap -oN scan.txt localhostNow compare the output and try to understand why each result appears.
How to Learn Nmap Properly
Do not focus only on memorizing options.
For every scan, ask yourself:
Why did I scan it?
What does the output mean?
Which service is exposed?
Is the exposure expected?
What security control could reduce unnecessary exposure?
This approach helps turn Nmap from a command-line tool into a real learning instrument.
Nmap Cheat Sheet
# Scan localhost
nmap localhost
# Scan a specific host
nmap 192.168.1.10
# Scan specific ports
nmap -p 22,80,443 192.168.1.10
# Scan a range of ports
nmap -p 20-100 192.168.1.10
# Scan all TCP ports
nmap -p- 192.168.1.10
# Detect services
nmap -sV 192.168.1.10
# Attempt OS detection
sudo nmap -O 192.168.1.10
# Enable multiple detection features
nmap -A 192.168.1.10
# Host discovery
nmap -sn 192.168.1.0/24
# TCP SYN scan
sudo nmap -sS 192.168.1.10
# UDP scan
sudo nmap -sU 192.168.1.10
# Save normal output
nmap -oN scan.txt 192.168.1.10
# Save XML output
nmap -oX scan.xml 192.168.1.10Frequently Asked Questions
Is Nmap free?
Nmap is an open-source network scanning and security auditing tool.
Is Nmap used by hackers?
Nmap is used for legitimate purposes such as network administration, security auditing, inventory, troubleshooting, education, and authorized security testing. Like many security tools, it can also be misused, so authorization is essential.
Can Nmap find open ports?
Yes. Port discovery is one of Nmap's primary uses.
Can Nmap find operating systems?
Nmap can attempt operating-system detection using network fingerprinting techniques, but results are not guaranteed to be accurate.
Can I use Nmap on my own computer?
Yes. Scanning your own computer is a good way to learn the basics.
Is scanning a public website always legal?
No. A website being publicly accessible does not automatically mean you are authorized to perform security scanning against it. Use systems and labs where you have explicit permission.
What should I learn before Nmap?
Learn basic networking first, especially IP addresses, TCP, UDP, ports, DNS, routing, and common network services.
What should I learn after Nmap?
Continue with networking analysis, Wireshark, web fundamentals, Linux, service enumeration, system administration, and authorized security labs.
Recommended Reading on CodeWithAV
Cybersecurity Roadmap for Beginners
Linux Commands for Cybersecurity Beginners
Final Thoughts
Nmap is an excellent tool for learning practical networking and security concepts.
Start with localhost and your own virtual machines. Learn what each result means instead of simply running commands from a cheat sheet.
As your knowledge improves, you can use Nmap as part of a broader workflow involving network analysis, service identification, configuration review, documentation, and defensive security.