Nmap Tutorial for Beginners: Scan Networks Like a Pro

Ask a room of penetration testers which tool they have used on every single engagement and one name wins: Nmap. The "Network Mapper" has been the standard way to discover hosts, open ports and running services since 1997, and it is still the first command run in almost every security assessment — and the first tool a defender learns to watch for. This tutorial takes you from a fresh install to the scans professionals actually use, explains exactly what the output is telling you, and covers the legal line you must never cross.

What Nmap actually does

Every service on a network listens on a numbered port — web servers on 80 and 443, SSH on 22, databases on 3306 and 5432, and so on. Nmap sends carefully crafted packets to a target and studies the replies. From those replies it can tell you which hosts are alive, which ports are open, which service and version is answering, and often which operating system is running. It is reconnaissance: the map you draw before doing anything else, whether you are attacking a network with permission or defending your own.

Install and first scan

Nmap is free and ships with Kali Linux and most security distributions; on Windows and macOS it installs from nmap.org, and the graphical front-end is called Zenmap. Point it at the official practice target:

nmap scanme.nmap.org

With no options, Nmap scans the 1,000 most common ports using a TCP connect scan (or a SYN scan if you run it with administrator rights). The output lists each port, its state and the service normally associated with it.

Reading the output: port states

• open — a service accepted the connection. This is your attack surface.
• closed — the host answered, but nothing listens on that port.
• filtered — a firewall is dropping or rejecting the probes, so Nmap cannot tell. Silence is information too.
• unfiltered / open|filtered — seen with certain scan types where the replies are ambiguous; you will meet these as you advance.

The five scans you will use daily

1. Host discovery — who is on this network?

nmap -sn 192.168.1.0/24

The -sn "ping scan" finds live hosts without scanning ports. It is how you inventory your own home or lab network in seconds.

2. Service and version detection

nmap -sV 192.168.1.10

-sV probes each open port and identifies the actual software and version behind it — the detail that turns "port 80 is open" into "Apache 2.4.49 is running", which is what lets you match a target against known vulnerabilities (see our explainer on how CVEs work).

3. Operating system detection

nmap -O 192.168.1.10

-O fingerprints the target's TCP/IP stack and makes an educated guess at the OS. It needs administrator privileges and at least one open and one closed port to work well.

4. The full workup

nmap -A -T4 192.168.1.10

-A enables OS detection, version detection, default scripts and traceroute in one go; -T4 speeds up timing. This is the scan most beginners reach for — powerful, but also the loudest, so use it where you are authorised.

5. Scanning all 65,535 ports

nmap -p- 192.168.1.10

The default scan checks only the top 1,000 ports. -p- checks them all — slower, and the only way to find services hiding on unusual ports.

NSE: where Nmap becomes a platform

The Nmap Scripting Engine (NSE) runs hundreds of built-in scripts against your targets — checking for known vulnerabilities, enumerating shares, testing default credentials on your own systems, and more:

nmap --script vuln 192.168.1.10
nmap --script smb-enum-shares 192.168.1.10

Scripts are grouped into categories such as safe, intrusive, exploit and vuln. On real engagements, start with safe and default; save the intrusive categories for labs and explicitly authorised testing.

The defender's view: your scans are visible

Everything above announces itself. A default Nmap scan lights up firewall logs and intrusion-detection systems, and a SOC analyst's day often includes triaging exactly this kind of noise-that-might-not-be-noise (we walk through that job in a day in the life of a Tier-1 SOC analyst). Defenders reduce what Nmap can learn with firewalls that drop probes, services bound only where needed, and banners stripped of version numbers. Learning to scan teaches you precisely what to hide — which is why this tool sits at the start of both offensive and defensive careers, including our Ethical Hacking from Scratch course.

Your practice plan

Build a tiny lab — two or three virtual machines on a host-only network — then: inventory it with -sn, profile one machine with -sV and -O, find a service on a non-standard port with -p-, and finally run a safe script scan and read every line of output until you can explain it. Do that twice and you already operate Nmap better than most people who list it on their CV.