Nmap Tutorial for Beginners: Scan Safely, Learn Fast
Nmap is the flashlight in your toolkit. This guide shows you how to use it properly—inside a lab, with purpose, and zero drama.
For more details, see our Terms of Service.
Why Nmap, and why safety comes first
Nmap maps networks: hosts, ports, and the services behind them. That visibility is priceless for defenders and red-teamers—but it also creates risk if you point it at systems you don’t own. In the U.S., unauthorized scanning can fall under the CFAA; in the UK, see the Computer Misuse Act. Translation: scan only inside your isolated lab or platforms that explicitly authorize testing.
Quickstart: 10-minute lab discovery
- Confirm your lab subnet (VirtualBox host-only default is often
192.168.56.0/24). Verify withip addr(Linux) or the hypervisor UI. - Discover live hosts (no port info yet):
nmap -sn 192.168.56.0/24 - Service detection on a single host:
nmap -sV 192.168.56.101 - Add OS guess (best effort):
nmap -O 192.168.56.101(requires sudo/root) - Save results for your report:
nmap -sV -oN scan.txt 192.168.56.101
Need safe targets? See Metasploitable & DVWA: Safe Targets.
Core concepts: hosts, ports, services, versions
- Host discovery (
-sn): who’s up? - Port scanning (default TCP SYN/connect): which doors are open?
- Service/version (
-sV): what runs on each port? - OS detection (
-O): best-effort fingerprinting. - Output (
-oN/-oX/-oG): save what you find for later analysis.
Common flags you’ll actually use
| Flag | What it does | When to use |
|---|---|---|
-sn |
Host discovery (no ports) | First pass on a subnet |
-sV |
Service & version detection | Understand what’s listening |
-p |
Port selection (e.g., -p 1-1024) |
Targeted scans, save time |
-O |
OS detection (best effort) | Context for reporting |
-A |
Aggressive: OS, versions, scripts, traceroute | Only inside your lab; noisy but thorough |
-oN/-oX/-oG |
Normal/XML/grepable output | Saving results for reports/tools |
--top-ports |
Scan most common ports | Fast triage (--top-ports 100) |
--reason |
Why Nmap thinks a port is open/closed | Clarity in writeups |
NSE scripts (the safe starter pack)
Nmap Scripting Engine (NSE) automates checks. Start with safe, informational scripts inside your lab:
--script=banner– grab service banners for identification--script=http-title– list page titles on web ports--script=ssh2-enum-algos– enumerate SSH algorithms--script=smb-protocols– identify SMB dialects
Avoid intrusive/exploit scripts on anything except your own intentionally vulnerable targets.
How to read Nmap results like a pro
- Open vs. filtered: “filtered” means a firewall may be blocking packets; try a different timing or confirm in the host firewall.
- Service mislabels: Version detection is heuristic. Validate with banner grabs or application-level checks.
- Corroborate: Cross-check with
curl,telnet, or browser for HTTP(S) ports; usencfor raw TCP. - Context first: An “open” port is not automatically a vulnerability—explain risk + impact + remediation in your report.
Timing profiles (keep it polite, even in a lab)
Nmap timing templates (-T0 to -T5) trade accuracy for speed/noise. In a lab, -T4 is a good balance.
On fragile targets, dial back to -T3 to avoid missing packets or overwhelming services.
-T3(normal): reliable on most networks-T4(aggressive): faster in low-latency lab environments
Turn scans into portfolio gold
Recruiters and clients don’t hire port scanners—they hire communicators. Package your scans into short reports:
- Scope: subnet/hosts, timing, flags used, date/time.
- Findings: services with versions, misconfigurations, surprises.
- Risk & remediation: what matters and how to fix it.
- Evidence: attach
-oN/-oXoutputs.
See From Home Lab to Job-Ready for packaging tips, and build skills legally with Best Legal Platforms.
Troubleshooting: why your scan looks weird
- No hosts found: Wrong subnet/interface. Confirm with
ip addrand your hypervisor’s host-only network range. - Everything filtered: Target firewall, or you’re scanning the wrong adapter. Check lab NICs.
- Duplicate IPs: DHCP overlap in your host-only network; recreate the adapter and restart VMs.
- Slow scans: Use
--top-ports 100or target specific ports (-p 22,80,443).
Copy/paste examples (lab-only)
# Discover hosts
nmap -sn 192.168.56.0/24
# Fast triage on a host
nmap --top-ports 100 -sV 192.168.56.101
# Full common ports + service versions + reasons
nmap -sV --reason -p 1-1024 192.168.56.101
# OS guess + banner grabbing
sudo nmap -O --script=banner 192.168.56.101
# Save outputs
nmap -sV -oN scan.txt -oX scan.xml 192.168.56.101Reminder: keep this inside your lab. For public, use only platforms that grant explicit authorization.
Authoritative references
Where to go next
Build the full dojo: Metasploitable & DVWA Setup, Best Legal Platforms, Best Hypervisors for Ethical Hacking Labs, and From Home Lab to Job-Ready.
