Nmap for Beginners: Host Discovery and Port Scanning

Nmap – the Network Mapper – is the first tool you run on a penetration test. Before you touch anything else, you need to know what’s actually on the network: which hosts are alive, which ports are open, and what services are running. This guide covers the fundamentals to get you productive quickly.

This is Part 1 of a two-part series. Once you’re comfortable with the basics here, Part 2 covers NSE scripting, evasion techniques, and full pentest workflows.

All examples use a Metasploitable2 VM on a private host-only network. Never run these scans against systems you don’t own or have explicit written permission to test.

Installing Nmap on Kali Linux

Nmap is pre-installed on Kali. Confirm you’re up to date with:

sudo apt update && sudo apt install nmap -y
nmap --version

Host Discovery

Before scanning ports, find out what’s actually alive on the network. The -sn flag runs a ping scan without touching any ports – fast and low-noise.

# Find live hosts on a subnet
sudo nmap -sn 192.168.56.0/24

# Skip host discovery and go straight to port scanning (useful when ICMP is blocked)
sudo nmap -Pn 192.168.56.101

# ARP ping scan - faster on local networks
sudo nmap -PR 192.168.56.0/24

Scan Types

Different scan types work at the packet level in different ways. Understanding what each one does helps you choose the right tool for the situation.

SYN Scan (-sS)

The default when run as root. Nmap sends a SYN packet and waits – a SYN-ACK means the port is open, a RST means it’s closed. It never completes the three-way handshake, so it’s faster and less likely to appear in application logs.

sudo nmap -sS 192.168.56.101

TCP Connect Scan (-sT)

Used when you don’t have root access. Completes the full three-way handshake, which makes it slower and more likely to be logged – but it works without elevated privileges.

nmap -sT 192.168.56.101

UDP Scan (-sU)

Critically overlooked by beginners. DNS (53), SNMP (161), TFTP (69), and NetBIOS (137) all run over UDP. Always include a UDP scan on internal engagements – you’ll find things TCP misses.

sudo nmap -sU --top-ports 50 192.168.56.101

UDP scans are slow by design. Using --top-ports keeps them practical.

Other Scan Types

FIN (-sF), XMAS (-sX), and NULL (-sN) scans can sometimes bypass stateless firewalls by sending unusual flag combinations. The ACK scan (-sA) is useful for mapping firewall rules – it tells you which ports are filtered versus unfiltered, rather than open versus closed.

Service and Version Detection

Knowing a port is open is only the start. Version detection sends probes to identify exactly what’s running – and those version numbers feed directly into your next steps.

# Version detection
sudo nmap -sV 192.168.56.101

# Aggressive: OS detection, version detection, default scripts, traceroute
sudo nmap -A 192.168.56.101

# Increase version detection intensity (0–9, default 7)
sudo nmap -sV --version-intensity 9 192.168.56.101

Against Metasploitable2 you’ll see vsftpd 2.3.4, Samba 3.0.20, and UnrealIRCd 3.2.8.1 – all backdoored or vulnerable versions whose names map directly to Metasploit modules.

OS Detection

Nmap analyses TCP/IP stack behaviour – TTL values, window sizes, and quirks in how a target responds to unusual packets – to fingerprint the operating system.

sudo nmap -O 192.168.56.101

# Guess even with low confidence
sudo nmap -O --osscan-guess 192.168.56.101

Port Selection

By default Nmap scans the top 1,000 most common ports. You can control this precisely.

# Specific ports
nmap -p 22,80,443,8080 192.168.56.101

# All 65,535 ports
nmap -p- 192.168.56.101

# Top 100 most common (fast initial scan)
nmap --top-ports 100 192.168.56.101

Timing Templates

Timing controls how fast Nmap sends packets. Too fast and you saturate the network or trigger IDS; too slow and you’ll be waiting all day.

• -T0 / -T1: Paranoid and sneaky – very slow, for IDS evasion
• -T2: Polite – slows down to avoid bandwidth issues
• -T3: Normal – the default, reasonable balance
• -T4: Aggressive – assumes a fast network, good for internal LAN scans
• -T5: Insane – maximum speed, will cause missed results on slower networks

For most lab and internal work, -T4 is the right choice.

sudo nmap -T4 -A 192.168.56.101

Saving Your Output

Always save scan results. You’ll refer back to them repeatedly during an engagement, and many tools – including Metasploit – can import them directly.

# Normal text output
nmap -oN scan_results.txt 192.168.56.101

# XML output (importable by Metasploit, Dradis, and others)
nmap -oX scan_results.xml 192.168.56.101

# Grepable output
nmap -oG scan_results.gnmap 192.168.56.101

# All three formats at once - use this as your default
sudo nmap -A -oA /tmp/scan-results 192.168.56.101

A Practical Two-Phase Approach

Running a single slow scan against all ports wastes time. The approach professionals actually use is fast discovery first, then targeted depth.

# Phase 1: fast discovery across all ports
sudo nmap -T4 -p- 192.168.56.101 -oN /tmp/fast_scan.txt

# Phase 2: deep scan on the ports you found open
sudo nmap -sC -sV -p 21,22,23,25,80,139,445,3306,8180 192.168.56.101 -oA /tmp/full_scan

What’s Next

Once you’re comfortable with the basics, Part 2 of this series covers the Nmap Scripting Engine (NSE) for vulnerability detection and service enumeration, evasion techniques for bypassing IDS and firewalls, and how to build a full five-phase recon workflow and pipe the results directly into Metasploit.

All examples in this guide are run against Metasploitable2 on a private, isolated lab network. Never run port scans or security tests against systems you don’t own or have explicit written permission to test. Unauthorised scanning is illegal in most jurisdictions.