How To Use Nmap: A Quick Beginner's Guide

A computer can run several network services without them being immediately visible to other users. How can you discover which services are accessible and which ports are open?

Nmap (Network Mapper) is a free, open-source tool used to discover devices on a network, scan ports, and identify running services. It is widely used by network administrators, security professionals, and penetration testers to understand a system’s network exposure.

This beginner’s guide covers the essential commands you need to get started.

1. Install Nmap

Download Nmap from its official website: https://nmap.org/download.html

Choose the installer for your operating system. After installation, open PowerShell or Command Prompt on Windows, or a terminal on Linux and macOS.

To check whether Nmap is installed, run:

nmap --version

If the command displays version information, Nmap is available to use.

Important: Scan only devices and networks you own or have explicit permission to test.

2. Run Your First Scan

Start with a basic scan of a device you are authorized to examine:

nmap 192.168.1.20

Replace 192.168.1.20 with your target’s IP address. Nmap attempts to discover whether the host is reachable and, by default, scans the 1,000 most commonly used TCP ports.

The results can reveal which ports appear open, closed, or filtered. Remember that your results will depend on the target, firewall rules, and network conditions.

Understand The Results

Nmap displays a table containing information about the scanned ports.

• PORT: The port number and protocol, such as 80/tcp.
• STATE: Nmap’s assessment of the port.
• SERVICE: The service associated with that port, based initially on Nmap’s service database unless further detection is performed.

Three important states are:

• Open: An application is accepting connections on the port.
• Closed: The target is reachable, but no application is listening on that port.
• Filtered: Nmap cannot determine whether the port is open because network filtering prevents a conclusive response.

These states describe what Nmap can determine from its scan, not an absolute guarantee about the system.

Five Useful Nmap Commands

Find active devices on a Network

nmap -sn 192.168.1.0/24

This performs host discovery without a port scan. The /24 represents a subnet containing 256 IPv4 addresses, from 192.168.1.0 to 192.168.1.255. Not every address necessarily represents a usable host, and some active devices may not respond to discovery probes.

Scan specific ports

nmap -p 22,80,443 192.168.1.20

This checks TCP ports 22, 80, and 443 on the target. These are commonly associated with Secure Shell (SSH), Hypertext Transfer Protocol (HTTP), and Hypertext Transfer Protocol Secure (HTTPS), respectively.

Identify services and versions

nmap -sV 192.168.1.20

The -sV option probes detected open ports to identify services and, where possible, their software versions. This helps administrators investigate potentially outdated services. Version detection is not a guarantee of the exact software version.

Scan all tcp ports

nmap -p- 192.168.1.20

This requests a scan of TCP ports 1 through 65,535 instead of the default selection of common ports. It can take longer, particularly when ports are filtered or the network is slow.

Save the scan results

nmap -oN scan.txt 192.168.1.20

The -oN option saves the normal, human-readable output to scan.txt, making it easier to review the findings later.

What Should You Do Next ?

Review the open ports and check whether the corresponding services are necessary. Investigate unexpected exposure and verify software versions against trusted vendor advisories.

An open port does not automatically mean a vulnerability exists. Likewise, a detected software version alone does not prove that a system is vulnerable.

Conclusion

Nmap helps you understand which devices respond to network probes, which ports are accessible, and which services may be running. Start with a basic scan, learn to interpret the results, and then practise host discovery, targeted port scans, version detection, and saving output.

These fundamentals provide a useful starting point for network administration and authorized security testing.