nmap Command on Linux: Port, Service, and Network Scanning

The nmap command on Linux is a powerful tool for discovering open ports on local or remote hosts.

It can be installed with any package manager. Unlike the netstat, ss, and lsof tools that check sockets or open files, nmap searches for open ports using a "trial and error" method, attempting to connect to known ports, and if it finds an open one, it verifies what type of service the port serves.

Using NMAP to Find Open Ports on a Network

To check open ports from 1 to 1000:

$ nmap localhostStarting Nmap 7.70 ( https://nmap.org ) at 2019-10-23 06:01 -03Nmap scan report for localhost (127.0.0.1)Host is up (0.000098s latency).Not shown: 999 closed portsPORT    STATE SERVICE22/tcp  open  sshNmap done: 1 IP address (1 host up) scanned in 0.05 seconds

A small script can be written to compare open ports against a previous file:

First, you must create the previous file to serve as a comparison for the future:

$ nmap localhost | grep open > original

The script below runs nmap and compares the result with the "original" file. If there's a difference, an email will be sent:

#!/bin/bashnmap localhost | grep open > atualdiff original atualif [ $? -eq 0 ]; then     echo “nada mudou”else     mail [email protected] < atualfi

Check Reserved Ports with nmap

The "-v" option checks all reserved TCP ports on the scanme.nmap.org machine in verbose mode:

$ nmap -v  scanme.nmap.org

Starting Nmap 6.40 ( http://nmap.org ) at 2021-12-08 22:01 -03
Initiating Ping Scan at 22:01
Scanning scanme.nmap.org (45.33.32.156) [2 ports]
Completed Ping Scan at 22:01, 0.07s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 22:01
Completed Parallel DNS resolution of 1 host. at 22:01, 0.02s elapsed
Initiating Connect Scan at 22:01
Scanning scanme.nmap.org (45.33.32.156) [1000 ports]
Discovered open port 80/tcp on 45.33.32.156
Discovered open port 22/tcp on 45.33.32.156
Discovered open port 9929/tcp on 45.33.32.156
Discovered open port 31337/tcp on 45.33.32.156
Completed Connect Scan at 22:01, 1.07s elapsed (1000 total ports)
Nmap scan report for scanme.nmap.org (45.33.32.156)
Host is up (0.075s latency).
Not shown: 996 closed ports
PORT      STATE SERVICE
22/tcp    open  ssh
80/tcp    open  http
9929/tcp  open  nping-echo
31337/tcp open  Elite

Read data files from: /usr/bin/../share/nmap
Nmap done: 1 IP address (1 host up) scanned in 1.26 seconds

SYN Scan with nmap

The "-sS" option initiates a stealthy SYN scan on each machine in the /24 network size where the address scanme.nmap.org resides.

The "-O" option will determine which operating system is running on each host that is up. This requires root privileges due to the SYN scan and operating system detection:

$ sudo nmap -sS -O scanme.nmap.org/24
Starting Nmap 6.40 ( http://nmap.org ) at 2021-12-08 22:04 -03
Nmap scan report for scanme.nmap.org (45.33.32.156)
Host is up (0.070s latency).
Not shown: 996 closed ports
PORT      STATE SERVICE
22/tcp    open  ssh
80/tcp    open  http
9929/tcp  open  nping-echo
31337/tcp open  Elite
Device type: general purpose|WAP|webcam|firewall|storage-misc
Running (JUST GUESSING): Linux 2.6.X|3.X|2.4.X (91%), Tandberg embedded (86%), Fortinet Linux 2.6.X (86%), IPFire Linux 2.6.X (85%), Check Point Linux 2.6.X (85%), Axcient embedded (85%)
OS CPE: cpe:/o:linux:linux_kernel:2.6.32 cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:2.4 cpe:/h:tandberg:vcs cpe:/o:fortinet:linux_kernel:2.6 cpe:/o:ipfire:linux:2.6.32 cpe:/o:linux:linux_kernel:2.6.18
Aggressive OS guesses: Linux 2.6.32 - 2.6.35 (91%), Linux 2.6.32 - 2.6.39 (91%), Linux 2.6.32 - 3.0 (90%), Linux 2.6.18 (89%), Linux 3.2 - 3.6 (89%), Linux 2.6.32 (88%), Linux 3.1.9 (88%), Linux 2.6.39 (88%), Linux 2.6.32 - 2.6.33 (88%), Linux 2.6.9 - 2.6.27 (88%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 14 hops
(...)

Check Specific Ports with nmap

The "-sV" option performs host enumeration and a TCP scan on the first half of the 198.116.0.0/16 subnet. This tests if the systems run SSH (22), DNS (53), POP3 (110), or IMAP (143) on their standard ports or anything on port 4564. For any of those ports found open, version detection is used to determine which application is running:

$ nmap -sV -p 22,53,110,143,4564 198.116.0-255.1-127
Starting Nmap 6.40 ( http://nmap.org ) at 2021-12-08 22:08 -03
Nmap scan report for ip-172-30-0-191.ec2.internal (172.30.0.191)
Host is up (0.00016s latency).
PORT     STATE  SERVICE VERSION
22/tcp   open   ssh     OpenSSH 7.4 (protocol 2.0)
53/tcp   closed domain
110/tcp  closed pop3
143/tcp  closed imap
4564/tcp closed unknown
(...)

Random Host Scan with nmap

In this example, nmap randomly chooses 100 hosts and checks for web servers (port 80). Host enumeration is disabled with -Pn:

$ nmap -v -iR 100 -Pn -p 80
Starting Nmap 6.40 ( http://nmap.org ) at 2021-12-08 22:11 -03
Initiating Parallel DNS resolution of 10 hosts. at 22:11
Completed Parallel DNS resolution of 10 hosts. at 22:11, 1.20s elapsed
(...)

Save nmap Data in XML Format

In this example, nmap checks 4096 IPs for any web server (port 80 - without doing ping) and saves the output in XML format:

$ nmap -Pn -p80 -oX pb-port80scan.xml  216.163.128.20/20

Discover if the Target Uses Any Firewall

The "-sA" option scans whether the host uses any linux firewall to filter packets:

$ sudo nmap -sA facebook.comStarting Nmap 6.40 ( http://nmap.org ) at 2021-12-08 22:29 -03Nmap scan report for facebook.com (157.240.229.35)Host is up (0.00055s latency).rDNS record for 157.240.229.35: edge-star-mini-shv-02-iad3.facebook.comAll 1000 scanned ports on facebook.com (157.240.229.35) are filtered

Discover Online Hosts with Ping Scan

The "-sP" option performs a ping type scan on a network:

$ nmap -sP 172.30.0.0/24Starting Nmap 6.40 ( http://nmap.org ) at 2021-12-08 22:31 -03Nmap scan report for go.universobh.com.br (172.30.0.30)Host is up (0.00037s latency).Nmap scan report for ip-172-30-0-191.ec2.internal (172.30.0.191)Host is up (0.00035s latency).Nmap done: 256 IP addresses (2 hosts up) scanned in 5.04 seconds

This type of scan is not always effective, as most networks protect their hosts from ping.

Scan for Possible Open Ports

The "--open" option of nmap shows the possible open ports of a host:

$ nmap --open google.ptStarting Nmap 6.40 ( http://nmap.org ) at 2021-12-08 22:33 -03Nmap scan report for google.pt (172.217.15.99)Host is up (0.015s latency).rDNS record for 172.217.15.99: iad30s21-in-f3.1e100.netNot shown: 998 filtered portsPORT STATE SERVICE80/tcp open http443/tcp open https

Quick Test of Open Ports with nmap

The "-T5" option performs a fast scan of possible open ports:

$ nmap -T5 facebook.comStarting Nmap 6.40 ( http://nmap.org ) at 2021-12-08 22:35 -03Nmap scan report for facebook.com (157.240.229.35)Host is up (0.00068s latency).rDNS record for 157.240.229.35: edge-star-mini-shv-02-iad3.facebook.comNot shown: 996 filtered portsPORT STATE SERVICE80/tcp open http443/tcp open https843/tcp closed unknown5222/tcp closed xmpp-client

Be Careful When Using nmap

Be careful when running nmap on hosts hosted on Amazon AWS, Google Cloud, or Microsoft Azure, as they check logs on their edge firewalls to verify there is no suspicious "PenTest" activity on their networks.

Nmap Quick Reference Guide

Select Targets with NMAP

Single IP scan	nmap 192.168.1.1
Scan a host	nmap www.testhostname.com
Scan an IP range	nmap 192.168.1.1-20
Scan a subnet	nmap 192.168.1.0/24
Scan from a text file	nmap -iL list-of-ips.txt

Select Ports with NMAP

Scan a single port	nmap -p 22 192.168.1.1
Scan a port range	nmap -p 1-100 192.168.1.1
Scan the top 100 ports (fast)	nmap -F 192.168.1.1
Scan all 65535 ports	nmap -p- 192.168.1.1

Select Scan Types with NMAP

Scan using TCP connect	nmap -sT 192.168.1.1
Scan using TCP SYN (default)	nmap -sS 192.168.1.1
Scan UDP ports	nmap -sU -p 123,161,162 192.168.1.1
Scan ports - skip discovery	nmap -Pn -F 192.168.1.1

OS (Operating System) Detection with NMAP

Detect OS and Services	nmap -A 192.168.1.1
Detect services	nmap -sV 192.168.1.1
Detect services aggressively	nmap -sV --version-intensity 5 192.168.1.1
Detect services by banner	nmap -sV --version-intensity 0 192.168.1.1

NMAP Output Formats

Save to file	nmap -oN outputfile.txt 192.168.1.1
Save to XML	nmap -oX outputfile.xml 192.168.1.1
Save to TXT for grep	nmap -oG outputfile.txt 192.168.1.1
Save to all formats	nmap -oA outputfile 192.168.1.1

HTTP Scanning with NMAP

Get HTML page titles	nmap --script=http-title 192.168.1.0/24
Get HTTP headers	nmap --script=http-headers 192.168.1.0/24
Find web apps	nmap --script=http-enum 192.168.1.0/24

Learn much more about Linux in our online course. You can enroll here. If you already have an account, or want to create one, just log in or create your user here.

Like it? Share