Mastering Nmap: Essential Commands for Network Scanning

Nmap (Network Mapper) is one of the most powerful and versatile network scanning tools available to security professionals. Whether you're performing security audits, network inventories, or penetration testing, mastering Nmap commands is essential. In this guide, we'll explore essential Nmap commands and techniques for effective network reconnaissance.

Nmap Basics: Getting Started

Before diving into advanced scanning techniques, let's cover the basic Nmap syntax and some fundamental scan types:

nmap [Scan Type] [Options] {target}

The target can be a single IP address, a hostname, a network range, or multiple hosts specified in different ways. For example: 192.168.1.1, example.com, 192.168.1.1-254, or 192.168.1.0/24.

Essential Nmap Scan Types

These are the most commonly used scan types you should know:

• TCP SYN Scan (-sS): The default and most popular scan. It's relatively stealthy and efficient.
• TCP Connect Scan (-sT): More obvious than SYN scan as it completes the TCP handshake.
• UDP Scan (-sU): For scanning UDP ports, which is often overlooked but critical.
• Ping Scan (-sn): Host discovery without port scanning; just identifies what's online.
• Version Detection (-sV): Determines service versions running on open ports.
• OS Detection (-O): Attempts to identify the operating system on target hosts.

Basic Port Scanning Examples

Here are some practical examples of Nmap commands for different scanning needs:

# Scan a single target
nmap 192.168.1.1

# Scan multiple targets
nmap 192.168.1.1 192.168.1.2

# Scan a range of IPs
nmap 192.168.1.1-50

# Scan a subnet
nmap 192.168.1.0/24

# Scan targets from a file
nmap -iL targets.txt

Port Selection Options

Control which ports Nmap scans with these options:

• Specific ports (-p): Scan only selected ports
• Most common ports (--top-ports): Scan N most common ports
• All ports (-p-): Scan all 65535 ports
• Range of ports (-p1-1000): Scan ports 1-1000

# Scan specific ports
nmap -p 22,80,443 192.168.1.1

# Scan top 100 most common ports
nmap --top-ports 100 192.168.1.1

# Scan all 65535 ports
nmap -p- 192.168.1.1

# Scan range of ports
nmap -p 1-1000 192.168.1.1

Advanced Scanning Techniques

For more comprehensive scanning, combine multiple options:

# Aggressive scan - enables OS detection, version detection, script scanning, and traceroute
nmap -A 192.168.1.1

# Detect service versions
nmap -sV 192.168.1.1

# OS detection
nmap -O 192.168.1.1

# Increase verbosity for more details
nmap -v 192.168.1.1

# Maximum verbosity for debugging
nmap -vv 192.168.1.1

Timing and Performance

Control the speed of your scans with timing templates:

1. -T0 (Paranoid): Very slow, used for IDS evasion
2. -T1 (Sneaky): Slow, for more serious IDS evasion
3. -T2 (Polite): Slows down to use less bandwidth and target resources
4. -T3 (Normal): Default, a balance between accuracy and speed
5. -T4 (Aggressive): Faster, assuming you're on a fast and reliable network
6. -T5 (Insane): Extremely fast, sacrifices accuracy for speed

# Perform an aggressive scan (faster)
nmap -T4 192.168.1.1

# Perform a stealthy, slower scan
nmap -T1 192.168.1.1

Nmap Scripting Engine (NSE)

Nmap's scripting engine allows you to extend its functionality with scripts for various purposes:

• --script=default: Run basic scripts
• --script=vuln: Check for vulnerabilities
• --script=discovery: Discover more information about the network
• --script=safe: Run scripts considered safe (won't crash services)

# Scan for vulnerabilities
nmap --script=vuln 192.168.1.1

# Run default scripts
nmap -sC 192.168.1.1

# Run specific scripts
nmap --script=http-enum,http-headers 192.168.1.1

Output Options

Save scan results in different formats:

• -oN: Normal output
• -oX: XML output
• -oG: Grepable output
• -oA: Save in all formats

# Save results to all formats
nmap -oA scan_results 192.168.1.1

# Save results in XML format
nmap -oX scan_results.xml 192.168.1.1

Firewall and IDS Evasion Techniques

For penetration testing, evade detection with these options:

• -f: Fragment packets
• --mtu: Specify MTU size
• -D: Use decoys (makes scan appear to come from multiple sources)
• --spoof-mac: Spoof your MAC address
• --data-length: Append random data to sent packets

# Fragment packets
nmap -f 192.168.1.1

# Use decoys
nmap -D 10.0.0.1,10.0.0.2,ME 192.168.1.1

# Set specific MTU
nmap --mtu 16 192.168.1.1

Remember that Nmap should only be used on networks you own or have explicit permission to scan. Unauthorized scanning may violate laws and terms of service agreements.

Mastering these Nmap commands will significantly enhance your network scanning capabilities, whether you're an IT professional, security specialist, or networking enthusiast.