Nmap: The Basics

Imagine the scenario where you are connected to a network and using various network resources, such as email and web browsing. Two questions arise. The first is how we can discover other live devices on this network or on other networks. The second is how we can find out the network services running on these live devices; examples include SSH and web servers.

One approach is to do it manually. If asked to uncover which devices are live on the 192.168.0.1/24 network, one can use basic tools such as ping, arp-scan, or some other tool to check the 254 IP addresses. Although this network has 256 IP addresses, we counted 254 IP addresses because two are reserved. Each tool has its limitations. For example, ping won’t give any information if the target system’s firewall blocks ICMP traffic. Moreover, arp-scan only works if your device is connected to the same network, i.e., over Ethernet or WiFi. In brief, this will be a significant waste of time without an advanced and reliable tool. With the right tools and enough time, one would have a list of the live hosts on a target network. We need a flexible tool that can handle the various scenarios.

Discovering the running services on a specific host is equally time-consuming if one relies on manual solutions or inefficient scripts. For instance, one can use telnet to try one port after the other; however, with thousands of ports to scan, this can be a very time-consuming task, even if a script was created to automate the telnet connection attempts.

A very efficient solution that can solve the above two requirements and many more is the Nmap (opens in new tab) network scanner. Nmap is an open-source network scanner that was first published in 1997. Since then, plenty of features and options have been added. It is a powerful and flexible network scanner that can be adapted to various scenarios and setups.

Learning Objectives

This room aims to provide you with the basics necessary to use the Nmap scanner or simply nmap. In particular, you will learn how to:

• Discover live hosts
• Find running services on the live hosts
• Distinguish the different types of port scans
• Detect the versions of the running services
• Control the timing
• Format the output

Room Prerequisites

The user should be familiar with the TCP/IP model, the related concepts, and its various protocols. The following rooms provide the necessary knowledge to make the best use of this room:

• Networking Concepts
• Networking Essentials
• Networking Core Protocols
• Networking Secure Protocols