Nmap — Signal Toolkit — Hexworth Prime

What It Does

Nmap (Network Mapper) discovers hosts and services on a network by sending specially crafted packets and analyzing the responses. It can tell you which devices are up, what ports they have open, what software and versions are running behind those ports, and even what operating system a target is likely running. It is the single most important reconnaissance tool in cybersecurity.

Why You Need It

Every penetration test, vulnerability assessment, and network audit starts with discovery. You cannot secure what you do not know exists. Nmap is the standard tool for answering "what is on this network?" Referenced in the following Signal guides:

SG-09 — Network scanning and service enumeration
SG-25 — Host discovery and network mapping

CompTIA Security+, PenTest+, and CySA+ all cover Nmap. It appears in nearly every CTF and is the first tool loaded in Kali Linux.

How to Install It

Windows:

Download the installer from nmap.org/download.html
Run the installer. It will include Npcap (required for raw packet operations) and optionally Zenmap (the GUI frontend).
After installation, open Command Prompt or PowerShell and run nmap --version to verify.

Linux (Debian/Ubuntu):

sudo apt update && sudo apt install nmap

Linux (RHEL/Fedora):

sudo dnf install nmap

macOS:

brew install nmap

How to Use It

1. Ping sweep — find live hosts

nmap -sn 192.168.1.0/24

Sends ICMP echo, TCP SYN to 443, TCP ACK to 80, and ICMP timestamp to every address in the subnet. Returns a list of hosts that responded. No port scan — fast and non-intrusive.

2. Service version detection

nmap -sV 10.0.0.5

Probes open ports to determine the service name and version (e.g., Apache httpd 2.4.52, OpenSSH 8.9). Essential for matching services to known CVEs.

3. OS detection

nmap -O 10.0.0.5

Fingerprints the TCP/IP stack to guess the target operating system. Requires at least one open and one closed port to work well. Combine with -sV for better accuracy.

4. Specific port range

nmap -p 1-1024 10.0.0.5          # First 1024 ports
nmap -p 22,80,443,3389 10.0.0.5  # Specific ports only
nmap -p- 10.0.0.5                # All 65535 ports (slow but thorough)

5. Aggressive scan

nmap -A 10.0.0.5

Combines OS detection, version detection, script scanning, and traceroute in one command. Noisy but comprehensive — use in authorized engagements.

6. NSE scripts

nmap --script vuln 10.0.0.5                    # Run all vuln-detection scripts
nmap --script ssl-enum-ciphers -p 443 10.0.0.5 # Enumerate TLS ciphers
nmap --script smb-enum-shares 10.0.0.5         # List SMB shares

7. Output formats

nmap -oN scan.txt 10.0.0.5      # Normal text output
nmap -oX scan.xml 10.0.0.5      # XML (for importing into other tools)
nmap -oA scan_results 10.0.0.5  # All formats at once (.nmap, .xml, .gnmap)

Common Gotchas

Requires root/admin for raw sockets: SYN scans (-sS), OS detection (-O), and many scripts need elevated privileges. Without them, Nmap falls back to a slower TCP connect scan (-sT). On Linux, use sudo. On Windows, run as Administrator.

Scanning without authorization is illegal: Only scan networks you own or have explicit written permission to test. Unauthorized scanning can violate the CFAA (US) and equivalent laws elsewhere. Lab environments and CTF ranges are safe targets.

Firewalls hide results: A host-based firewall can make ports appear "filtered" instead of "closed" or "open." If you expect services but see mostly filtered ports, the target may have a firewall dropping packets silently. Try -Pn to skip host discovery if the target blocks pings.

Full port scans are slow: Scanning all 65,535 ports (-p-) across a large subnet takes hours. Use targeted port ranges or the default top-1000 scan for initial recon, then do full scans on interesting hosts only.

Npcap vs. WinPcap (Windows): Nmap on Windows requires Npcap, not the deprecated WinPcap. If you have WinPcap from an old Wireshark install, uninstall it first. They conflict.