How to Use Nmap: Practical Guide with Examples

In one line

Nmap is a tool that knocks on all the doors of a computer to see which are open, and then asks each open door what service is behind it.

What this is, for a beginner

Nmap, the Network Mapper, is the standard tool for discovering what is on a network and what services those hosts expose. It works by sending crafted packets and interpreting the responses to tell which hosts are up, which ports are open, and often which software and version is listening. It is almost always the first tool in a real assessment, because you cannot test what you have not mapped.

The core ideas are host discovery (which machines are alive), port scanning (which ports are open), and service and version detection (what is running behind those ports). On top of that, the Nmap Scripting Engine adds thousands of scripts for deeper checks. This guide runs each of these against a target you are allowed to scan.

The legal lab we use: scanme.nmap.org and your own lab

The Nmap project runs scanme.nmap.org specifically so people can practise scanning legally. Otherwise scan only your own machines or lab network.

scanme.nmap.org and your own lab project page →

Full walkthrough: exploiting it step by step

Step 1 — A basic scan

Start with a default scan of the official practice host, which scans the most common ports and reports which are open.

terminal

nmap scanme.nmap.org

Expected result: A list of the most common ports with their state (open, closed, filtered), giving a first picture of the host.

Step 2 — Service and version detection

Add version detection to learn what software and version is behind each open port, which is what turns a port number into an actionable target.

terminal

nmap -sV scanme.nmap.org

Expected result: Open ports annotated with the detected service and version, such as an SSH or HTTP server and its version string.

Step 3 — Scan all ports

The default scans only common ports. Scan the full range when thoroughness matters, accepting that it takes longer.

terminal

nmap -p- scanme.nmap.org

Expected result: Any open ports outside the common set are revealed, since services sometimes hide on unusual ports.

Step 4 — Add OS detection and timing

Combine common options: service detection, OS guessing, default scripts, and a faster timing template, a typical thorough first pass.

terminal

nmap -sV -O -sC -T4 scanme.nmap.org

Expected result: A richer report including a best-guess operating system and the output of default NSE scripts against discovered services.

Step 5 — Use the Nmap Scripting Engine

Run a targeted script for deeper checks, for example enumerating details of a web server. The scripting engine is what makes Nmap far more than a port scanner.

terminal

nmap -p 80 --script http-title scanme.nmap.org

Expected result: The script returns specific information (here, the web page title), showing how NSE extracts detail beyond open-port state.

Free resource

Get the free 35-week ethical hacking roadmap

The exact order I'd learn this in, every vulnerability and tool, week by week, with the labs to practise each one. Enter your email and I'll send it over, plus one practical lesson each week.

How to detect and fix this

How to detect it

From a defender's view, Nmap scans are visible in network logs and to intrusion-detection systems, especially aggressive timing; unexpected scanning of your ranges is worth investigating.
Exposed services that Nmap reveals are your real attack surface; anything open that need not be is a finding in itself.
Version output that shows outdated software points straight at patch priorities.

How to fix it

Reduce attack surface: close or firewall ports that do not need to be reachable, and expose only the services you intend to.
Keep the services that must be exposed patched and hardened, since version detection makes outdated software an obvious target.
Monitor for scanning activity and rate-limit or alert on it as an early warning of reconnaissance.
Segment networks so that even a mapped host cannot freely reach sensitive systems.

Common beginner mistakes

Scanning targets you have no permission to scan; use scanme.nmap.org or your own network only.
Using aggressive timing on fragile networks, which can disrupt services; scale timing to the environment.
Stopping at open ports without version detection, missing the context that makes findings actionable.
Ignoring the scripting engine, which is where much of Nmap's real value lives.

FAQ

Is it legal to use Nmap?

Nmap itself is a legitimate tool used daily by network administrators. Scanning is only legal against systems you own or are authorized to test; the Nmap project provides scanme.nmap.org precisely so people can practise legally. Scanning others without permission can be unlawful.

What is the difference between -sV and -O?

The -sV option detects the service and version behind each open port, while -O attempts to identify the host operating system. They answer different questions and are commonly used together for a fuller picture.

Why scan all ports with -p-?

By default Nmap scans about a thousand common ports. Services sometimes run on unusual ports to avoid notice, so a full scan with -p- ensures you do not miss them, at the cost of a longer scan.

Where to go from here

You just exploited one vulnerability in a lab. Here's the structured path.

Scattered tutorials teach you tricks; they don't make you a pentester. My mentorship is 35 weeks of exactly this, every vulnerability and tool in a deliberate order, on real labs, with one-on-one feedback on your work so your mistakes get caught early instead of becoming habits.

See the mentorship

Keep practising

How to Use Nikto How to Use Gobuster How to Use Wireshark