Port Scanning with Nmap

The Port Scanning Problem

You have identified a target IP address. Before you can attack anything, you need to know which ports are open and what services are listening. Port scanning is the process of probing a host's ports to discover this information. Nmap is the definitive tool for this task.

TCP Connect Scan (-sT)

The TCP connect scan completes the full three-way handshake (SYN → SYN-ACK → ACK). It is the most reliable scan type because it does not require root privileges and works on all networks.

nmap -sT 192.168.1.1

When to use: When you do not have root/administrator privileges, or when reliability is more important than stealth.

SYN Scan (-sS) — The Stealth Scan

The SYN scan (half-open scan) sends a SYN packet and analyzes the response without completing the handshake. If SYN-ACK is received, the port is open. RST is sent to close the connection without the server logging a full connection.

sudo nmap -sS 192.168.1.1

When to use: When you have root privileges and want faster, less detectable scanning. This is Nmap's default scan type when run as root.

UDP Scan (-sU)

TCP scans only check TCP ports. Many critical services use UDP: DNS (53), SNMP (161), TFTP (69), and others. UDP scanning is slower because UDP is connectionless — there is no handshake to confirm a port is open.

sudo nmap -sU 192.168.1.1

When to use: When you need to find UDP services. Always run UDP scans alongside TCP scans for a complete picture.

Other Scan Types

• NULL, FIN, Xmas scans (-sF, -sN, -sX) — Send packets with unusual flag combinations to bypass simple firewalls
• ACK scan (-sA) — Maps firewall ruleset by testing which ports are filtered
• Idle scan (-sI) — Uses a zombie host to scan anonymously
• Window scan (-sW) — Similar to ACK scan but exploits implementation details

Port Selection

By default, Nmap scans the 1,000 most common ports. For a full scan:

# Scan all 65,535 ports
nmap -p- 192.168.1.1

# Scan specific ports
nmap -p 22,80,443,8080 192.168.1.1

# Scan top 100 ports (faster)
map --top-ports 100 192.168.1.1

For a thorough penetration test, always run a full port scan (-p-) in addition to the default scan. Critical services sometimes run on unusual ports.

Why Version Detection Matters

Knowing that port 80 is open tells you little. Knowing that port 80 is running Apache 2.4.41 with OpenSSL 1.1.1 tells you exactly which vulnerabilities to check. Version detection probes open ports to determine the software and version.

Version Detection (-sV)

nmap -sV 192.168.1.1

Nmap sends a series of probes to the open port and analyzes the responses. It matches the responses against a database of service fingerprints (nmap-service-probes) to identify:

• Product name (Apache, nginx, OpenSSH, Microsoft IIS)
• Version number (2.4.41, 1.18.0, 8.0)
• Operating system (sometimes)
• Service type (HTTP, SSH, SMTP)

Output example:

PORT    STATE SERVICE VERSION
22/tcp  open  ssh     OpenSSH 8.0 (protocol 2.0)
80/tcp  open  http    Apache httpd 2.4.41 ((Ubuntu))
443/tcp open  ssl/http Apache httpd 2.4.41 (Ubuntu)

Aggressive Version Detection (--version-all)

If Nmap cannot identify a service with default probes, use aggressive mode:

nmap -sV --version-all 192.168.1.1

This sends every probe in the database, increasing accuracy but also increasing scan time and detectability.

OS Detection (-O)

Nmap can often identify the operating system by analyzing TCP/IP stack behavior:

sudo nmap -O 192.168.1.1

Nmap sends a series of TCP and UDP packets with unusual flag combinations, window sizes, and sequence numbers. Different operating systems respond differently, and Nmap matches these responses against its OS database (nmap-os-db).

Output example:

OS details: Linux 4.15 - 5.6

Using Version Information for Exploitation

Once you have version information, cross-reference with vulnerability databases:

# Search for known vulnerabilities in OpenSSH 8.0
searchsploit OpenSSH 8.0

# Check NSE scripts for the service
nmap -p 22 --script ssh2-enum-algos 192.168.1.1

Nmap Scripting Engine (NSE)

NSE scripts extend Nmap's functionality. They can:

• Detect vulnerabilities (vuln category)
• Enumerate services (discovery category)
• Authenticate and brute-force (auth, brute categories)
• Exploit known vulnerabilities (exploit category)

# Run all safe scripts against the target
nmap -sV --script safe 192.168.1.1

# Run vulnerability detection scripts
nmap -sV --script vuln 192.168.1.1

# Run scripts for a specific service
nmap -p 80 --script http-enum,http-title,http-methods 192.168.1.1

Practical Example: Scanning a Web Server

sudo nmap -sS -sV -O -p- --script vuln,discovery 192.168.1.1

This command:

• Runs a SYN scan (stealthy)
• Detects service versions
• Attempts OS detection
• Scans all ports
• Runs vulnerability and discovery scripts

The output gives you a complete picture of the target's attack surface.

Scan Timing Templates

Nmap's timing templates control scan speed and stealth:

# Aggressive scan for speed
nmap -T4 -A 192.168.1.1

# Slow scan for stealth
nmap -T1 -sS 192.168.1.1

Firewall and IDS Evasion

Fragment packets (-f) — Splits packets into smaller fragments to bypass simple packet filters:

nmap -f 192.168.1.1

Decoy hosts (-D) — Sends spoofed packets from fake sources to hide your real IP:

nmap -D 10.0.0.1,10.0.0.2,ME 192.168.1.1

Source port manipulation (--source-port) — Uses a trusted source port (e.g., 53 for DNS):

nmap --source-port 53 192.168.1.1

Randomize target order (--randomize-hosts) — Scans hosts in random order to avoid pattern detection:

nmap --randomize-hosts -iL targets.txt

Timing and delay — Add delays between probes to avoid rate-based detection:

nmap --scan-delay 5s 192.168.1.1

Interpreting Nmap Output

Nmap scan report for 192.168.1.1
Host is up (0.002s latency).
Not shown: 997 closed ports
PORT    STATE SERVICE VERSION
22/tcp  open  ssh     OpenSSH 8.0
80/tcp  open  http    Apache httpd 2.4.41
443/tcp open  ssl/http Apache httpd 2.4.41
8080/tcp open  http   nginx 1.18.0

Key observations:

• 3 open ports out of 1,000 scanned — relatively small attack surface
• SSH on 22 — check for weak credentials or known vulnerabilities
• HTTP on 80 and 443 — web application testing required
• nginx on 8080 — possibly a proxy or alternate web server

Output Formats

# Normal output
nmap -oN output.txt 192.168.1.1

# XML output (for parsing)
nmap -oX output.xml 192.168.1.1

# Grepable output
nmap -oG output.grep 192.168.1.1

# All formats
nmap -oA output 192.168.1.1

Practical Tips

• Always scan all ports (-p-) — Critical services hide on unusual ports
• Run UDP scans — UDP services are often overlooked
• Use -A for aggressive scanning — Combines OS detection, version detection, script scanning, and traceroute
• Save all results — You will reference them throughout the engagement
• Scan during off-hours — Reduces impact on production systems and lowers detection risk