nmap

~15 min · nmap, port-scan, discovery, ethics

Level 0Pinger

0 XP0/101 lessons0/12 achievements

0/150 XP to next level150 XP to go0% complete

The network mapper

nmap is the canonical tool for discovering devices on a network and probing what services they're running. On your own LAN, it's the fastest way to answer "what's actually plugged in?" and "which ports are open on this machine?"

Scan modes you'll use

Ping scan (-sn) — just discover which IPs are alive. No port scanning. Very fast.
Default scan (no flag) — TCP scan of the most common 1000 ports.
Service detection (-sV) — for each open port, probe to identify what's running.
OS detection (-O) — guess the operating system from TCP/IP fingerprints. Requires root.

Code

Practical nmap usage on YOUR OWN networks·bash

# Install
brew install nmap

# Discover all devices on your LAN — fastest way
nmap -sn 192.168.1.0/24

# Standard scan of one host
nmap 192.168.1.100

# Specific ports only
nmap -p 22,80,443 192.168.1.100

# Service detection — what's actually running
nmap -sV 192.168.1.100

# OS detection (requires root)
sudo nmap -O 192.168.1.100

# Comprehensive — all common ports + service detection
sudo nmap -sV -sC 192.168.1.100

External links

nmap official documentation

Exercise

On your own LAN: nmap -sn 192.168.1.0/24. Walk down the results — can you account for each device? Cross-reference with arp -a from Track 1's MAC lesson. Bonus: pick one of your machines and nmap -sV that-IP — see what services it's actually running. Some of them might be ones you forgot existed.