The scanner most engineers reach for first. Articles tagged Nmap cover host discovery, port and service detection, timing and NSE scripts, run against real lab targets.
The site already teaches you how to run every nmap scan. This one flips the camera around: what a SYN scan, a UDP scan and a ping sweep actually look like in an IOS XE ACL counter, in syslog and in a packet capture, plus why a slow scan beats most of it.
Find every live host on a subnet with a bash one-liner, and when to reach for nmap -sn instead. Why a down result never means the address is free.
A scan you cannot reproduce is a story, not evidence. The moment an Nmap result matters - a firewall change you signed off on, a rogue service you found on a production VLAN, an asset inventory the audit team will lean
Timing is the lever that decides whether an Nmap scan finishes before your coffee gets cold or runs so slowly it slips under an intrusion-detection sensor. When you are sweeping a /16 for an asset inventory, you want every
Nmap ships a whole family of options with names like fragmentation, decoys, and source-port spoofing, and it is easy to read that list as an attacker's cheat sheet. Flip the framing. As the engineer who owns the
By the time you have found an open port and identified the service behind it, you have answered "what is listening here?" but not "what can it tell me about itself?" That second question is where
Most people scan TCP, get their results in seconds, and stop there. But a huge amount of what runs on a real network lives on UDP: DNS, DHCP, SNMP, NTP, TFTP, IKE. If you only ever scan TCP, you are
Version detection tells you what software a port is running. OS detection (-O) tries to answer a different question: what operating system is the whole host running, even on ports that give nothing away. It does this without logging in
A port number tells you almost nothing on its own. "Port 80 open" could be nginx, Apache, an embedded management interface, or a printer's web UI. "Port 22 open" could be OpenSSH, a Cisco
Nmap does not have one way to scan a TCP port, it has a whole family of them, and each one sets different flags to provoke a different reaction from the target. Knowing which scan type to reach for is
Once you know which hosts are alive, the real work is finding out what each one is listening on. Port scanning is how you build a service inventory, confirm a firewall change did what you expected, and catch the forgotten
Before you scan a single port, you need to know which addresses are actually alive. Blasting a full port scan at every host in a /24 wastes time on dead space and lights up any IDS in the path. Host