How to scan a network with Nmap: the commands that matter

Short answer: start with nmap -sn to find live hosts, then nmap -sS -p- --min-rate 1000 to find open ports, then nmap -sV -sC -p <open ports> to identify what is running. Everything else is refinement. Only scan systems you own or have written permission to test.

Enumeration decides engagements. Exploits are the memorable part, but the finding that mattered was almost always visible in a scan somebody read carefully — a forgotten service, a version two years stale, a port that should not have been reachable from that segment.

Nmap is the tool for that, and most people use perhaps five percent of it.

The three-step workflow

Professionals rarely run one clever command. They run three, in order, each narrowing the next.

One: what is alive?

nmap -sn 10.10.0.0/24

Host discovery only, no port scan. On an internal network this is fast and gives you the inventory. Note that -sn relies on hosts responding; a firewalled machine that ignores probes is invisible here, which is why you follow up on ranges you have reason to suspect.

Two: what is open?

nmap -sS -p- --min-rate 1000 -oA scan-full 10.10.0.42

-p- scans all 65,535 ports rather than the default top 1,000. This is the flag that finds the administration interface on port 8443 that everyone forgot. --min-rate 1000 keeps it to minutes rather than hours on a local network. -oA writes all three output formats, which matters more than it sounds — you will want to grep that file six times before the engagement ends.

Three: what is it?

nmap -sV -sC -p 22,80,443,8443 -oA scan-services 10.10.0.42

Version detection plus the default script set, aimed only at the ports you found open. This is the slow, noisy, valuable step, and restricting it to known ports is what keeps it reasonable.

What a SYN scan actually does

-sS sends a SYN packet, and interprets what comes back: SYN/ACK means open, RST means closed, silence means filtered. Crucially, it never completes the handshake — it sends a RST instead of the final ACK.

This matters for two practical reasons. It is faster, because there is no connection to tear down. And historically it avoided application-level logs, since no connection was ever established. On modern networks that second benefit is mostly gone: firewalls and endpoint detection log the attempt regardless. If you need a scan that is quiet in 2026, the answer is timing and volume, not the scan type.

-sS needs root privileges to craft raw packets. Without them Nmap falls back to -sT, a full connect scan that uses the operating system's own network stack — slower, and logged by the target application.

Reading the output properly

Three states, and the third is the interesting one:

• open — something is listening and answered.
• closed — the host answered, nothing is listening on that port. Useful information: the host exists and is reachable.
• filtered — no answer, or an ICMP error. Something between you and the port dropped the packet. This tells you about the firewall, not the service.

A subnet of "filtered" is a segmentation finding in itself. A host with mostly "closed" and three "open" is a well-configured machine. A host answering on 200 ports is either a honeypot or a genuine problem.

Timing, and being quiet

The -T templates run from -T0 (paranoid, one probe every five minutes) to -T5 (insane). Real usage is narrower than the range suggests:

Template	When it is right
-T4	Internal networks. The sensible default.
-T3	The default, and fine over the internet.
-T2	When you have been asked not to disturb fragile equipment.
-T1 and -T0	When avoiding threshold-based detection matters more than finishing this week.

Fragile industrial or medical equipment deserves a note of its own: aggressive scanning has knocked such devices offline, and that is a genuine incident rather than an anecdote. When the scope includes anything with a physical consequence, slow down and say so in the report.

For genuine evasion — fragmentation, decoys, source port manipulation, idle scanning — the techniques exist, they are situational, and they are covered properly in the free Nmap course. The honest summary is that against modern monitoring they buy you less than patience does.

The scripting engine, which is where the value hides

-sC runs the default script category. The engine holds hundreds more, and a handful earn their place in most engagements:

# Enumerate SMB shares and users
nmap --script smb-enum-shares,smb-enum-users -p445 10.10.0.42

# Check TLS configuration and certificate details
nmap --script ssl-enum-ciphers,ssl-cert -p443 target.example.com

# Look for known vulnerabilities matching detected versions
nmap --script vuln -p80,443 10.10.0.42

That last one deserves a caution: vuln scripts are noisy, occasionally intrusive, and they produce false positives that will embarrass you in a report if you paste them without verification. A scanner suggests; a tester confirms.

Nmap or masscan?

Not competitors. Masscan sweeps enormous address spaces at rates Nmap cannot approach, and tells you almost nothing about what it found. The professional pattern for large scopes is to use masscan for discovery, then feed the open ports to Nmap for version detection and scripts.

For anything up to a few hundred hosts, Nmap alone is simpler and sufficient.

The mistakes that produce wrong results

Scanning only the top 1,000 ports. The default. It misses the administration panel on 8443, the database on 5432, the forgotten service on 31337. Run -p- at least once per host that matters.

Trusting version detection blindly. Banners lie, and backported security patches mean a version string can look vulnerable while the service is not. Confirm before reporting.

Scanning from one vantage point. What is reachable from the DMZ is not what is reachable from the user network. Where you scan from is part of the finding — and it is the reason network pivoting changes what a scan can see.

Not reading the packet capture. When results confuse you, watch the traffic. Wireshark alongside Nmap turns "why is this filtered" from a guess into an observation, which is exactly what the free Wireshark course is for.

Scanning something you were not authorised to scan. In several jurisdictions this has been prosecuted as attempted unauthorised access, and your internet provider forbids it regardless. See where to practise legally.

Frequently asked questions

What is the most useful Nmap command?

For a first pass on a host you are authorised to test: nmap -sS -p- --min-rate 1000 -oA scan target, which covers all 65,535 ports and saves the output. Follow it with nmap -sV -sC on only the ports it found open, which is where the identification work happens.

What is the difference between a SYN scan and a connect scan?

A SYN scan sends a SYN and never completes the handshake, so it is faster and historically avoided application logs; it needs root privileges. A connect scan completes the full handshake through the operating system, needs no privileges, and is logged by the target application.

Is Nmap detectable?

Yes, on any monitored network. Firewalls and endpoint detection log connection attempts regardless of scan type, and volume is the giveaway. Slowing down with -T1 or -T2 and reducing the port range defeats simple thresholds; nothing makes scanning invisible to a competent defender. See what it looks like from the defender’s side.

What does “filtered” mean in Nmap results?

No response came back, or an ICMP error did, so something between you and the port dropped the packet — usually a firewall. It tells you about the network path rather than the service, and a subnet that returns mostly filtered results is itself a segmentation finding.

Is it illegal to scan a network with Nmap?

Scanning systems you own or have written authorisation to test is legal. Scanning anything else has been treated as attempted unauthorised access in several jurisdictions, and it breaches most internet providers’ terms of service. Practise in your own lab, where the same skills are learned with no risk.

Nmap or masscan for large networks?

Both, in sequence. Masscan sweeps very large address ranges quickly but reports little detail, so use it for discovery and pass the open ports to Nmap for version detection and scripts. Below a few hundred hosts, Nmap alone is simpler.

Where to go next

The Nmap course is free with an account and goes into the parts this article compresses: the scripting engine, IPv6, timing tuning, evasion and reproducible scan pipelines. Pair it with Wireshark, also free, so you can see what your scans actually send.