Complete Nmap Scanning Tutorial – 50+ Commands with Examples

What is Nmap?

Nmap (Network Mapper) is the world's most popular free, open-source network scanning tool. It's used by security professionals to discover hosts, open ports, running services, and OS details on any network.

GitHub: github.com/nmap/nmap · Official: nmap.org

Installation

# Ubuntu / Debian
sudo apt update && sudo apt install nmap

# macOS (Homebrew)
brew install nmap

# Windows (winget)
winget install Nmap

# Verify installation
nmap --version

1. Host Discovery (Ping Scans)

Before scanning ports, identify which hosts are alive on the network:

# Ping a single host (no port scan)
nmap -sn 192.168.1.1

# Ping an entire subnet — discover all live hosts
nmap -sn 192.168.1.0/24

# Ping multiple hosts
nmap -sn 192.168.1.1 192.168.1.2 192.168.1.3

# Ping with custom timeout (5 seconds per host)
nmap -sn --host-timeout 5s 192.168.1.0/24

# ARP ping (faster, local network only)
nmap -sn -PR 192.168.1.0/24

# ICMP ping only
nmap -sn -PE 192.168.1.0/24

# Don't ping — assume host is up (bypass firewalls that block ping)
nmap -Pn 192.168.1.1

2. Port Scanning

# Scan top 1000 most common ports (default)
nmap 192.168.1.1

# Scan ALL 65535 ports (slow but thorough)
nmap -p- 192.168.1.1

# Scan specific ports
nmap -p 22,80,443,8080 192.168.1.1

# Scan a port range
nmap -p 1-1024 192.168.1.1

# Scan only open ports (skip closed/filtered)
nmap -sS --open 192.168.1.1

# UDP port scan (slower, requires root)
nmap -sU -p 53,123,161,162 192.168.1.1

# Scan a subnet for a specific port
nmap -p 22 192.168.1.0/24

# Stealth SYN scan (half-open, requires root)
sudo nmap -sS 192.168.1.1

# Connect scan (no root needed, but more detectable)
nmap -sT 192.168.1.1

# Scan from a file of targets
nmap -iL targets.txt -p 80,443

3. Service & Version Detection

# Detect service versions on open ports
nmap -sV 192.168.1.1

# More aggressive version detection (intensity 0-9)
nmap -sV --version-intensity 9 192.168.1.1

# Light version detection (faster)
nmap -sV --version-light 192.168.1.1

# Run default scripts + version detection
nmap -sC -sV 192.168.1.1

4. OS Detection

# Detect operating system (requires root)
sudo nmap -O 192.168.1.1

# Aggressive mode: OS + version + scripts + traceroute
nmap -A 192.168.1.1

# Full recon (all detection modes)
nmap -sS -sV -O -A 192.168.1.1

5. NSE Scripts (Nmap Scripting Engine)

NSE scripts extend Nmap with powerful vulnerability detection and enumeration capabilities:

# Run default scripts
nmap --script default 192.168.1.1
# Shorthand:
nmap -sC 192.168.1.1

# Run all safe scripts
nmap --script safe 192.168.1.1

# Run vulnerability detection scripts
nmap --script vuln 192.168.1.1

# Run authentication-related scripts
nmap --script auth 192.168.1.1

# Discovery scripts
nmap --script discovery 192.168.1.1

# --- Specific script examples ---

# EternalBlue (MS17-010) vulnerability check
nmap --script smb-vuln-ms17-010.nse -p 445 192.168.1.1

# SMB share enumeration
nmap --script smb-enum-shares -p 445 192.168.1.1

# SMB user enumeration
nmap --script smb-enum-users -p 445 192.168.1.1

# HTTP server enumeration
nmap --script http-enum -p 80 192.168.1.1

# HTTP headers
nmap --script http-headers -p 80,443 192.168.1.1

# SSL cipher enumeration
nmap --script ssl-enum-ciphers -p 443 192.168.1.1

# DNS zone transfer test (security check)
nmap --script dns-zone-transfer -p 53 192.168.1.1

# FTP anonymous login check
nmap --script ftp-anon -p 21 192.168.1.1

# MySQL info
nmap --script mysql-info -p 3306 192.168.1.1

6. Output & Reporting Formats

# Save to plain text
nmap -oN scan.txt 192.168.1.1

# Save to XML (parseable by tools like Metasploit)
nmap -oX scan.xml 192.168.1.1

# Save to grepable format
nmap -oG scan.gnmap 192.168.1.1

# Save ALL formats at once (creates scan.nmap, scan.xml, scan.gnmap)
nmap -oA scanname 192.168.1.1

# Verbose output
nmap -v 192.168.1.1
nmap -vv 192.168.1.1

# Show progress every 5 seconds
nmap --stats-every 5s -p- 192.168.1.1

7. Real-World Scan Scenarios

# Full reconnaissance scan (save all formats)
nmap -sS -sV -O -A --script vuln -oA full-recon 192.168.1.1

# Web server assessment
nmap -p 80,443,8080,8443 -sV --script http-headers,http-enum 192.168.1.1

# Database server check
nmap -p 3306,5432,1433,27017,6379 -sV 192.168.1.1

# SMB security audit
nmap --script smb-security-mode,smb-vuln-ms17-010,smb-enum-shares -p 445 192.168.1.1

# Speed up scan with T4 timing (aggressive, may miss hosts on slow networks)
nmap -T4 --min-rate 1000 -p- 192.168.1.1

# Randomize host order (useful for large subnet scans)
nmap --randomize-hosts 192.168.1.0/24

# Fragment packets to evade simple firewalls
nmap -f 192.168.1.1

# Decoy scan (hide among fake source IPs)
nmap -D ME,192.168.1.5,192.168.1.10 192.168.1.1

8. Practice Resources

• TryHackMe — Beginner-friendly guided labs
• HackTheBox — Intermediate/advanced practice machines
• 30 Days of Nmap (GitHub) — Daily challenge format
• LabEx Cybersecurity Tutorials (GitHub)

Common Nmap Timing Templates