nmapScan hosts and ports, detect services
nmap discovers which hosts are up on a network, which ports they expose, and what software answers on them. Use it to audit your own servers' exposure, verify firewall rules from the outside, and inventory a subnet. Only scan networks you own or are authorised to test.
nmap [-sS|-sT|-sU|-sn] [-p PORTS] [-sV] [-O] [-A] [-Pn] [-T0-5] [--open] [-oN|-oG FILE] TARGETSBefore go-live, check which ports a new app server answers on, as seen from another machine in the VPC.
sudoRaw-packet scans (SYN scan, OS detection, ARP discovery) need root. Without it nmap falls back to full TCP connects.
nmap works in phases. Host discovery first: as root on a local subnet it sends ARP requests; otherwise ICMP echo, TCP SYN to 443, TCP ACK to 80 and an ICMP timestamp request, and treats any reply as 'up' (-Pn skips this). Then the port scan. A SYN scan (-sS, root only) crafts raw SYN packets: a SYN-ACK means open (nmap answers with RST so no connection is ever established), a RST means closed, and no reply or an ICMP unreachable after retries means filtered, i.e. a firewall is dropping. Without root, nmap uses connect() for a full handshake (-sT), which is slower and shows up in application logs. -sV then talks to each open port with protocol probes and matches the responses against a signature database; -O fingerprints the TCP/IP stack; -A adds both plus default NSE scripts and traceroute. Timing templates (-T0 to -T5) control parallelism and retries.
-sS / -sTSYN scan (root, default) / full TCP connect scan (default non-root)-sUUDP scan (slow; needs root)-snHost discovery only, no port scan ('ping sweep')-p PORTSPorts: 22,80,443 or 1-1024 or - for all 65535-F / --top-ports NFast: top 100 ports / the N most common-PnTreat hosts as up; skip discovery (ICMP-blocking hosts)-sVService and version detection-OOperating system detection (root)-AAggressive: -sV -O, default scripts and traceroute--openShow only open ports-T4Faster timing (T0 paranoid ... T5 insane)-oN / -oG / -oX FILESave normal, grepable or XML output--script NAMERun NSE scripts, e.g. ssl-cert, http-titleScanning hosts or networks you don't ownUnauthorised scanning breaks most providers' terms and can be illegal; it also trips intrusion detection and gets your IP blocked.
Scan only your own assets, or with written permission and the cloud provider's policy in mind."nmap says the host is down"Discovery probes are often blocked; nmap then skips the host without scanning a single port.
nmap -Pn -p 22,443 hostTrusting the SERVICE column without -sVWithout version detection it's only the usual name for that port number (8080 = http-proxy), not what actually runs there.
nmap -sV -p 8080 hostRunning nmap -p- -T5 -A against production at peak timeAggressive scans open many connections and send odd probes that can upset fragile services and flood logs.
Scan specific ports, use -T3/-T4, and schedule full scans.Try these on a Linux machine of your own. Each task has a hint and a solution.
Scan the 1000 default TCP ports on localhost.
Scan only ports 22, 80 and 443 on localhost, showing only open ones.
Write the command that finds live hosts in 10.0.2.0/24 without scanning ports, and the one that scans all 65535 TCP ports of 10.0.2.15 even if it blocks ping.
nmapScan hosts and ports, detect services
nmap discovers which hosts are up on a network, which ports they expose, and what software answers on them. Use it to audit your own servers' exposure, verify firewall rules from the outside, and inventory a subnet. Only scan networks you own or are authorised to test.
nmap [-sS|-sT|-sU|-sn] [-p PORTS] [-sV] [-O] [-A] [-Pn] [-T0-5] [--open] [-oN|-oG FILE] TARGETSBefore go-live, check which ports a new app server answers on, as seen from another machine in the VPC.
sudoRaw-packet scans (SYN scan, OS detection, ARP discovery) need root. Without it nmap falls back to full TCP connects.
nmap works in phases. Host discovery first: as root on a local subnet it sends ARP requests; otherwise ICMP echo, TCP SYN to 443, TCP ACK to 80 and an ICMP timestamp request, and treats any reply as 'up' (-Pn skips this). Then the port scan. A SYN scan (-sS, root only) crafts raw SYN packets: a SYN-ACK means open (nmap answers with RST so no connection is ever established), a RST means closed, and no reply or an ICMP unreachable after retries means filtered, i.e. a firewall is dropping. Without root, nmap uses connect() for a full handshake (-sT), which is slower and shows up in application logs. -sV then talks to each open port with protocol probes and matches the responses against a signature database; -O fingerprints the TCP/IP stack; -A adds both plus default NSE scripts and traceroute. Timing templates (-T0 to -T5) control parallelism and retries.
-sS / -sTSYN scan (root, default) / full TCP connect scan (default non-root)-sUUDP scan (slow; needs root)-snHost discovery only, no port scan ('ping sweep')-p PORTSPorts: 22,80,443 or 1-1024 or - for all 65535-F / --top-ports NFast: top 100 ports / the N most common-PnTreat hosts as up; skip discovery (ICMP-blocking hosts)-sVService and version detection-OOperating system detection (root)-AAggressive: -sV -O, default scripts and traceroute--openShow only open ports-T4Faster timing (T0 paranoid ... T5 insane)-oN / -oG / -oX FILESave normal, grepable or XML output--script NAMERun NSE scripts, e.g. ssl-cert, http-titleScanning hosts or networks you don't ownUnauthorised scanning breaks most providers' terms and can be illegal; it also trips intrusion detection and gets your IP blocked.
Scan only your own assets, or with written permission and the cloud provider's policy in mind."nmap says the host is down"Discovery probes are often blocked; nmap then skips the host without scanning a single port.
nmap -Pn -p 22,443 hostTrusting the SERVICE column without -sVWithout version detection it's only the usual name for that port number (8080 = http-proxy), not what actually runs there.
nmap -sV -p 8080 hostRunning nmap -p- -T5 -A against production at peak timeAggressive scans open many connections and send odd probes that can upset fragile services and flood logs.
Scan specific ports, use -T3/-T4, and schedule full scans.Try these on a Linux machine of your own. Each task has a hint and a solution.
Scan the 1000 default TCP ports on localhost.
Scan only ports 22, 80 and 443 on localhost, showing only open ones.
Write the command that finds live hosts in 10.0.2.0/24 without scanning ports, and the one that scans all 65535 TCP ports of 10.0.2.15 even if it blocks ping.