nmap Command in Linux: Port Scanning and Host Discovery Guide

nmap (Network Mapper) discovers live hosts, identifies open ports, and detects which service is running behind each one. It is the standard tool for network inventory, service mapping, troubleshooting, and security reviews.

Install it before starting:

bash

sudo apt install nmap # Ubuntu, Debian<br>sudo dnf install nmap # Fedora, RHEL<br>brew install nmap # macOS<br>How to Use the nmap Command in Linux<br>The syntax is:

bash

nmap [OPTIONS] TARGET…<br>The simplest scan targets a single host:

bash

nmap scanme.nmap.org<br>scanme.nmap.org is the official Nmap test host, authorized for scanning.

When you run nmap without sudo, it uses a TCP connect scan (-sT) — your OS completes the full TCP handshake on its behalf. Running with sudo enables a SYN scan (-sS) by default. SYN scan completes only the first half of the handshake, making it faster and generating less log noise on the target:

bash

sudo nmap 192.168.10.121 # SYN scan by default<br>sudo nmap -sS 192.168.10.121 # explicit SYN scan<br>sudo nmap -sU 192.168.10.121 # UDP scan<br>sudo nmap -6 fd12:3456::1 # IPv6 target<br>Specify target hosts in any of these forms:

bash

nmap 192.168.10.0/24 # CIDR range<br>nmap 192.168.10-12.1 # octet range<br>nmap 192.168.10,11,12.1 # comma-separated octets<br>nmap 192.168.10.0/24 --exclude 192.168.10.5 # exclude a host<br>Before scanning a large or complex range, use -sL to list the resolved targets without sending any probes:

bash

nmap -sL 10.8-10.10,11,12.0/28
This verifies the target list before you commit to a real scan.

Scan Specific Ports and Understand Port States
By default, nmap scans the 1000 most popular ports. These are not the first 1000 consecutive ports — they are the most commonly used ports across the full 1–65389 range. To scan all 65535 ports:

bash

nmap -p- 192.168.10.121
Each result will show one of three port states:

open — a service accepted the connection or probe<br>closed — the host responded but nothing is listening on that port<br>filtered — a firewall or filter blocked the response; nmap cannot determine the actual state<br>Specify ports with -p:

bash

nmap -p 443 192.168.10.121 # single port<br>nmap -p 80,443 192.168.10.121 # multiple ports<br>nmap -p 1-1024 192.168.10.121 # range<br>nmap -p 1-1024,8080,9000 192.168.10.121 # range plus specific ports<br>nmap -p ssh 192.168.10.121 # by service name<br>UDP scans are slower than TCP scans because UDP does not confirm closed ports the same way TCP does — there is no RST packet for closure. Limit UDP scans to only the ports you need:

bash

sudo nmap -sU -p 53,161,500 192.168.10.121<br>Host Discovery: -sn, -Pn, and -n<br>nmap runs host discovery before port scanning by default. Two options change that behavior in opposite directions.

-sn — host discovery only, no port scan:

bash

sudo nmap -sn 192.168.10.0/24<br>Use this to get a fast inventory of live systems on a subnet before deciding what to scan next.

-Pn — skip host discovery entirely; treat every target as online:

bash

sudo nmap -Pn 192.168.10.121<br>This is useful when a host blocks ping and other discovery probes but still has open ports. The tradeoff: on large scans, -Pn forces nmap to attempt the full port scan against every target, including hosts that may be offline. This makes large scans significantly slower. Older documentation uses -P0 or -PN — the current option is -Pn.

-n — disable reverse DNS resolution:

bash

sudo nmap -n 192.168.10.0/16<br>nmap performs a reverse DNS lookup for each discovered host by default. Disabling this with -n can noticeably speed up large range scans.

Detect Services, Versions, and Operating System
Port numbers alone do not always tell you what is running — especially when services use non-standard ports.

-sV adds a VERSION column showing the software name and version string for each open port:

bash

sudo nmap -sV 192.168.10.121<br>-O attempts OS fingerprinting based on how the remote host responds to probe packets:

bash

sudo nmap -O 192.168.10.121<br>When successful, nmap reports the likely OS and kernel version range.

-A runs everything at once: OS detection, version detection, default NSE scripts, and traceroute:

bash

sudo nmap -A 192.168.10.121<br>-A is useful for focused testing but is heavier and slower than a basic scan. Start with individual options and add -A only when you need the full picture.

Save Output and Use the Scripting Engine
Save results to a file so you can review or share them later:

bash<br>nmap -sV 192.168.10.121 -oN results.txt # human-readable<br>nmap -sV 192.168.10.121 -oX results.xml # XML, for parsing or import<br>nmap -sV 192.168.10.121 -oA scan # all three formats at once<br>-oA creates scan.nmap, scan.xml, and scan.gnmap in a single run. 

The grepable format (-oG) is considered deprecated by the Nmap documentation — use XML for automation.

The Nmap Scripting Engine (NSE) extends nmap with hundreds of built-in Lua scripts for deeper inspection:

bash<br>nmap -sV --script http-malware-host scanme.nmap.org

NSE scripts range from passive information gathering to intrusive probes. Always review what a script does before running it against production systems.

Start with nmap target for a quick look, add sudo for SYN scan capability, use -sV to identify services behind open ports, and -oA to save results in all formats at once. Leave a comment below if you run into any issues.