If you have spent any time learning networking or cybersecurity, you have probably heard the name Nmap. It comes up in tutorials, certifications, job descriptions, and pretty much every cybersecurity course that takes itself seriously.
But what actually is it? What does it do? And more importantly — how do you use it without accidentally doing something illegal?
This guide answers all of that in plain language. No assumed knowledge, no jargon without explanation.
What Is Nmap?
Nmap stands for Network Mapper. It is a free, open-source tool created by Gordon Lyon in 1997 and still actively maintained today.
At its core, Nmap does one thing: it sends specially crafted packets to a network and analyses the responses to figure out what is there.
Think of it like knocking on every door in a building to find out which ones are open, who is behind them, and what they are doing. Nmap does that — but for networks.
It can tell you:
- Which devices are alive on a network
- Which ports are open on those devices
- What services are running on those ports
- What operating system a device is likely running
- Whether any known vulnerabilities exist on those services
It is used by penetration testers, system administrators, network engineers, and security researchers every single day. If you are heading into any IT security role, you will use Nmap. It is not optional knowledge.
Why Should Beginners Learn Nmap?
Most beginners skip Nmap because it looks intimidating — it runs in a terminal, produces walls of text, and has hundreds of options.
That is exactly why you should learn it early.
Here is the reality: understanding Nmap teaches you how networks actually work, not just how they are supposed to work. When you run a scan and see which ports are open, which are filtered, and which are closed — you start to understand firewalls, TCP/IP, and network architecture in a way that no textbook fully captures.
It also directly maps to real job skills. CompTIA Security+, CEH, OSCP — all of them expect you to understand network scanning. Nmap is the tool they use in the examples.
Is Nmap Legal?
This is the most important section in the guide. Read it carefully.
Nmap itself is completely legal software. You can download it, install it, and use it freely.
What can be illegal is scanning networks you do not own or do not have explicit permission to scan.
In most countries — including Australia, the US, and the UK — unauthorised port scanning can violate computer misuse laws. In Australia, the relevant legislation is the Criminal Code Act 1995 (unauthorised access to computer systems).
The rule is simple:
- Your own home network — scan freely, no issues
- A lab environment you control — completely fine
- A work network — only with written permission from the person responsible
- Any external network you do not own — do not do it
For learning purposes, the safest options are:
- Your own home lab (even a couple of virtual machines)
- Intentionally vulnerable practice environments like TryHackMe or Hack The Box — both are designed for this and give you legal targets to scan
- Metasploitable — a deliberately vulnerable virtual machine you run locally
If you are practising within those boundaries, you are completely fine.
How to Install Nmap
On Windows: Download the installer directly from nmap.org. It includes a graphical interface called Zenmap if you prefer clicking over typing — useful when starting out.
On Linux (Ubuntu/Debian):
sudo apt update
sudo apt install nmap
On macOS:
brew install nmap
Once installed, verify it worked by running:
nmap –version
You should see the version number printed. That means it is working.
Your First Nmap Scan
Let’s start with the most basic possible scan — checking if a host is alive.
nmap 192.168.1.1
This scans the most common 1000 ports on the target and tells you which ones are open.
The output looks something like this:
Starting Nmap 7.95 ( https://nmap.org )
Nmap scan report for 192.168.1.1
Host is up (0.0032s latency).
Not shown: 995 closed ports
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
443/tcp open https
What does this mean?
- PORT — the port number and protocol (tcp or udp)
- STATE — open, closed, or filtered
- SERVICE — what Nmap thinks is running on that port
In this example, ports 22 (SSH), 80 (HTTP), and 443 (HTTPS) are open. That tells you this device is probably a router or server accepting web traffic and remote connections.
Understanding Port States
This is where most beginners get confused. Nmap does not just say “open” or “closed” — it has six possible port states:
| State | What It Means |
| open | A service is actively listening and accepting connections |
| closed | The port is accessible but nothing is listening on it |
| filtered | A firewall is blocking Nmap’s probes — state is unknown |
| unfiltered | Port is accessible but Nmap cannot determine open or closed |
| open|filtered | Could not determine whether open or filtered |
| closed|filtered | Could not determine whether closed or filtered |
For beginners, focus on the first three — open, closed, and filtered. Those are the ones you will see most often.
Filtered is the most interesting one — it means a firewall is in place. You cannot tell what is behind it, but you know something is there protecting it.
Common Nmap Commands for Beginners
You do not need to memorise every flag. These are the ones that actually matter when you are starting out:
Scan a single host:
nmap 192.168.1.1
Scan a range of IP addresses:
nmap 192.168.1.1-254
Scan an entire subnet:
nmap 192.168.1.0/24
Detect service versions (what software is running):
nmap -sV 192.168.1.1
Detect the operating system:
nmap -O 192.168.1.1
Run default scripts (quick vulnerability check):
nmap -sC 192.168.1.1
The most commonly used combination — version detection, default scripts, and a reasonable speed:
nmap -sC -sV -T4 192.168.1.1
This last command is what most security professionals run as their starting point on any engagement. If you remember nothing else, remember that one.
What the -T Flag Means (Timing)
Nmap has a timing scale from T0 to T5:
- T0 — paranoid (extremely slow, used to avoid detection)
- T1 — sneaky
- T2 — polite
- T3 — normal (default)
- T4 — aggressive (faster, good for local networks)
- T5 — insane (fastest, may miss results or crash fragile systems)
For home lab practice, T4 is fine. On production systems or slower networks, use T3 or lower.
How to Save Scan Results
For anything beyond quick practice, save your results. You will want to review them later.
nmap -sC -sV 192.168.1.1 -oN scan_results.txt
This saves the output in a readable text format. There are other formats too:
- -oN — normal readable text
- -oX — XML (useful if feeding results into other tools)
- -oA — saves in all formats simultaneously
Get in the habit of saving results. In any professional context, you need an audit trail of what you scanned, when, and what you found.
Nmap vs Wireshark — What Is the Difference?
If you have already read our Wireshark guide, you might be wondering how these two tools relate to each other.
They are complementary, not competing:
| Nmap | Wireshark | |
| What it does | Scans networks to find hosts, ports, and services | Captures and analyses actual network traffic packets |
| When to use it | Before or at the start of an assessment | During or after to inspect what is happening |
| Skill level | Beginner-friendly | Steeper learning curve |
| Output | Summary of what is open and running | Raw packet-level detail |
A simple way to think about it: Nmap tells you what doors exist. Wireshark shows you what is walking through them.
In a real-world scenario, you would use Nmap first to map the network, then Wireshark to dig into specific traffic that interests you.
Common Beginner Mistakes
1. Scanning networks they do not own Already covered above — but worth repeating. Always scan legally.
2. Using T5 on everything Fast does not always mean better. T5 can overwhelm slow or fragile systems and give you incomplete results. T4 is usually the right call for a home lab.
3. Ignoring filtered ports Beginners often focus only on open ports. Filtered ports are equally important — they tell you where firewalls and security controls exist.
4. Not saving results You will forget what you found within hours. Always save with -oN or -oA.
5. Running Nmap as a regular user instead of root/admin Some scan types (like SYN scans) require elevated privileges. On Linux, run with sudo. On Windows, run as Administrator.
What to Learn Next
Once you are comfortable with basic Nmap scans, the natural next steps are:
- Nmap Scripting Engine (NSE) — Nmap has hundreds of built-in scripts that can check for specific vulnerabilities, brute-force logins, and enumerate services in detail
- Combining Nmap with other tools — feeding Nmap output into Metasploit, for example
- Understanding what each open service means — port 22 open means SSH, but what version? Is it patched?
The goal is not to memorise every flag. The goal is to understand what the output is telling you about the network — and what that means from a security perspective.
Quick Reference — Nmap Commands Worth Remembering
| What you want to do | Command |
| Basic scan of a host | nmap 192.168.1.1 |
| Scan entire subnet | nmap 192.168.1.0/24 |
| Detect service versions | nmap -sV 192.168.1.1 |
| Detect OS | nmap -O 192.168.1.1 |
| Run default scripts | nmap -sC 192.168.1.1 |
| Full standard scan | nmap -sC -sV -T4 192.168.1.1 |
| Save results to file | nmap -sC -sV 192.168.1.1 -oN results.txt |
| Scan without port scan (host discovery only) | nmap -sn 192.168.1.0/24 |
Final Thought
Nmap is one of those tools that looks complicated from the outside and becomes second nature within a few weeks of regular use. The best way to learn it is to set up a small home lab — even two virtual machines — and start scanning.
You do not need expensive hardware. You do not need a course. You need a terminal, a legal target, and the habit of reading the output carefully.
Start with nmap -sC -sV -T4 against your own network. See what comes back. Then ask yourself what each open port means, whether it should be open, and what an attacker might do with it. That question — what would an attacker do with this? — is the mindset that turns a tool user into a security professional.