Product docs and API reference are now on Akamai TechDocs.
Search product docs.
Search for “” in product docs.
Search API reference.
Search for “” in API reference.
Search Results
 results matching 
 results
No Results
Filters
How to Use Nmap for Network Scanning
Traducciones al EspañolEstamos traduciendo nuestros guías y tutoriales al Español. Es posible que usted esté viendo una traducción generada automáticamente. Estamos trabajando con traductores profesionales para verificar las traducciones de nuestro sitio web. Este proyecto es un trabajo en curso.
Nmap is a popular, open source network scanning tool. It has a wide array of scanning options and capabilities, making it highly efficient and adaptable. Nmap helps system administers monitor a network’s host and port usage, and helps security auditors catch potential vulnerabilities. In this guide, learn how to get started using Nmap for your network.
Before You Begin
If you have not already done so, create a Linode account and Compute Instance. See our Getting Started with Linode and Creating a Compute Instance guides.
Follow our Setting Up and Securing a Compute Instance guide to update your system. You may also wish to set the timezone, configure your hostname, create a limited user account, and harden SSH access.
sudo
. If you’re not familiar with the sudo
command, see the Users and Groups
guide.Install Nmap
Install Nmap using your system’s package manager:
sudo apt install nmap
sudo dnf install nmap
Note To install Nmap for another distribution or on Mac or Windows, take a look at Nmap’s official guide to installing Nmap .
If you want to install Nmap from source code, you can follow the steps in Nmap’s guide for installing from source . This may be useful if your Linux distribution’s package manager only provides a much older version of Nmap. However, this is generally not the case with distributions like Alma Linux, CentOS Stream, Debian, Fedora, Rocky Linux, and Ubuntu.
Verify your installation:
nmap
Nmap 7.80 ( https://nmap.org ) ...
Using Nmap
This section provides some explanation of the fundamental scanning features of Nmap and gives practical examples of how to use them.
What Is Host Scanning?
Host scanning is the process of identifying hosts and their current statuses. One of the most useful host scanning procedures is identifying an IP range and scanning that range to see what hosts are there. This kind of host scanning can help keep track of host status and help catch unauthorized hosts on the network.
The steps in this section provide an example of how to run a host scan on a network.
First, identify the IP range to scan. You may already have an IP range in mind, for instance, if your network has a range of permanent public IP addresses. If not, you can use your network’s subnet mask:
ip a
... inet 192.0.2.0/24 brd 192.0.2.255 scope global eth0 ...
Identify the
inet
line in the output. In this example, thenetmask
is shown in CIDR notation. The/24
at the end of the IP address translates to255.255.255.0
. This means that the first three sets of numbers in the IP address (192.0.2
) identify the network. The last set of numbers (.0
) varies for each host.Conduct a ping scan against all of the IP addresses in your network’s range to see what hosts are running:
sudo nmap -sn 192.0.2.0/24
The
-sn
option tells Nmap to conduct a ping scan only, without scanning the hosts’ ports. The/24
has Nmap scan the full range of the last number in the IP address (i.e.0
–255
). See the next section for more information on scanning IP address ranges.Nmap’s output provides the hostname and IP address for each active host. Nmap also provides a MAC address and an educated guess at the operating system:
Starting Nmap 7.80 ( https://nmap.org ) at 2023-09-01 13:15 EDT Nmap scan report for 192.0.2.0 Host is up (0.42s latency). MAC Address: XX:XX:XX:XX:XX:XX (Icann, Iana Department) Nmap scan report for EXAMPLE_HOSTNAME (192.0.2.1) Host is up (0.0045s latency). MAC Address: YY:YY:YY:YY:YY:YY (Icann, Iana Department) ... Nmap scan report for 192.0.2.255 Host is up (0.43s latency). MAC Address: ZZ:ZZ:ZZ:ZZ:ZZ:ZZ (Icann, Iana Department) Nmap scan report for EXAMPLE_HOSTNAME (192.0.2.0) Host is up. Nmap done: 256 IP addresses (256 hosts up) scanned in 6.36 seconds
Often, you may want more details on a particular host or range of hosts. At this point, you would likely want to run a port scan on each of those hosts. Find the steps for doing so in the next section.
What Is Port Scanning?
Port scanning is Nmap’s core feature. It provides information about the state of ports on a given host or range of hosts. This can help evaluate what ports are listening for traffic on a host and provide more details about the host itself.
Nmap evaluates each port as being in one of the following six states:
- Open: Has an application or service actively accepting connections.
- Closed: Accessible, but without an application or service actively listening.
- Filtered: Usage cannot be determined because packets are filtered.
- Unfiltered: Accessible, but cannot be determined as either open or closed.
- Open|Filtered: Either open or filtered, but cannot determine for sure.
- Closed|Filtered: Either closed or filtered, but cannot determine for sure.
In addition, Nmap can attempt to provide more detailed information about what is running on the host. For instance, Nmap can attempt to determine the host’s operating system, or what service is listening on an open port.
Basic Port Scan
Conducting a port scan with Nmap is very simple. Replace 192.0.2.58 in the following command (and all subsequent examples) with the actual IP address you want to scan:
sudo nmap 192.0.2.58
Starting Nmap 7.80 ( https://nmap.org ) at 2023-09-01 13:05 EDT
Nmap scan report for EXAMPLE_HOSTNAME (192.0.2.58)
Host is up (0.0000060s latency).
Not shown: 999 closed ports
PORT STATE SERVICE
22/tcp open ssh
Nmap done: 1 IP address (1 host up) scanned in 0.11 seconds
Here, Nmap shows that port 22
is accessible and has a service (SSH) actively listening for connections.
You can also scan a range of IP addresses. Here are some of the ways to do that, using the example IP address above:
192.0.2.0-128
: Scans hosts on the specified range. In this case, IP addresses ending between 0 and 128.192.0.2.0/24
: Scans hosts for all IP address endings (0
–255
).192.0.0.0/16
: Similar to/24
but also scans the range of the third number in the IP address (i.e. scans all hosts between192.0.0.0
and192.0.255.255
).
Advanced Port Scan
Nmap provides a ton of options to fine-tune scans. Get a full list of options simply by running the nmap
command without specifying addresses or options.
To help you get started, here is a list of some of the most commonly used options:
-p0-
: Causes Nmap to scan every possible TCP port (the default scan includes the 1,000 most commonly used ports).-F
: Causes Nmap to use a “fast” scan, scanning only the top 100 most commonly used ports.-T4
: Adjusts timing parameters (can range from-T0
, the slowest option, to-T5
, the fastest and most aggressive option).-A
: Includes “aggressive” tests with the scan, such as OS and service detection.-v
: Makes Nmap’s output verbose.
Further on, find an example of how to use a few of these together for a more in-depth port scan.
Nmap scans can often take a long time to complete. While a scan is running, you can press the up arrow key to get a status update:
Service scan Timing: About 50.00% done; ETC: 12:00 (0:00:25 remaining)
Here is an example of a useful Nmap command to get an in-depth view of a particular host:
sudo nmap -p0- -A 192.0.2.58
This commands scans all ports on 192.0.2.58 and tries to gather additional details on the host and the ports’ services.
Starting Nmap 7.80 ( https://nmap.org ) at 2023-09-01 13:07 EDT
Nmap scan report for EXAMPLE_HOSTNAME (192.0.2.58)
Host is up (0.00010s latency).
Not shown: 65535 closed ports
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.3 (Ubuntu Linux; protocol 2.0)
Device type: general purpose
Running: Linux 2.6.X
OS CPE: cpe:/o:linux:linux_kernel:2.6.32
OS details: Linux 2.6.32
Network Distance: 0 hops
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 4.22 seconds
Here, Nmap reports on the accessible port it found. It evaluates what service is likely running on that port (OpenSSH) and what OS that the service is running on (Ubuntu Linux). Nmap’s report ends with a further evaluation of the OS running on the host.
Conclusion
You have now started using Nmap to monitor your network. With the information above, you should be fully equipped to use Nmap for the most common network scanning needs.
Also check out the Official Nmap Project Guide to Network Discovery and Security Scanning . It contains a wealth of concepts, command options, and scanning tutorials to deepen your Nmap skills. You can purchase a full-length version of the book (digital or print) from the Nmap website. The link above provides Nmap’s online edition of the book.
More Information
You may wish to consult the following resources for additional information on this topic. While these are provided in the hope that they will be useful, please note that we cannot vouch for the accuracy or timeliness of externally hosted materials.
This page was originally published on