Nmap Basics (Port Scanning)

Relax. We'll talk through this in plain words — no textbook voice.

What you'll walk away with

Understand Nmap Basics (Port Scanning) without the intimidation factor
Get hands-on running tools yourself in an authorized lab environment
Be ready to apply this concept directly in a real assessment/report

Let's think about this for a moment

Nmap (Network Mapper) is a tool that scans an IP range or a single host to find open ports and running services — it's the most commonly used tool during the Active Recon stage (previous lesson) of a pentest/security assessment. A scan result shows three port statuses — Open (a service is running there), Closed (the port is reachable but no service is listening), and Filtered (a firewall is blocking it, so Nmap itself can't determine the real status).

Let's connect it to a real scenario

Run `nmap 192.168.56.101` (the VM's internal IP) against your lab VM (Metasploitable, Basic lesson 4) and you'll likely find ports 21 (FTP), 22 (SSH), 80 (HTTP), and 3306 (MySQL) open, among others — Metasploitable deliberately leaves plenty of vulnerable services running. Keep reminding yourself (Basic lesson 2) that scanning a real system without authorization is a legal offense.

Nmap = a network/port scanning tool (finds open ports/services)
Three port statuses: Open, Closed, Filtered
Only scan your lab VM — never scan a system without authorization

Let's look at an example together

bash

# Basic scan of a single host (your own lab VM)
nmap 192.168.56.101

# Scan a range of your lab network
nmap 192.168.56.0/24

# See what Nmap version you have
nmap --version

You should see

PORT     STATE SERVICE
21/tcp   open  ftp
22/tcp   open  ssh
80/tcp   open  http
3306/tcp open  mysql

Try it in 5 minutes

Run `nmap <lab-vm-ip>` against your lab VM (set up in Basic lesson 4) — look at the port list in the output and jot down notes on which services are running.

A quick word of caution

Running an Nmap scan (especially the aggressive scan options) against a production system without authorization can disrupt network traffic (and can even crash a system in some cases) — only practice this against your lab VM.

Easy traps

Trying Nmap against an unauthorized target (a public website, an ISP's network) — this is a legal violation
Mistaking a 'filtered' status for 'the port is closed' — filtered actually means a firewall is blocking it and Nmap itself can't confirm the real status

Now try it yourself

Run `nmap <lab-vm-ip>` against your lab VM (set up in Basic lesson 4) — look at the port list in the output and jot down notes on which services are running.

You'll know it worked when: PORT STATE SERVICE 21/tcp open ftp 22/tcp open ssh 80/tcp open http 3306/tcp open mysql