---
{
  "title": "Nmap",
  "summary": "Explore authorized network services while understanding what each option does.",
  "topic": "offensive",
  "level": "Intermediate",
  "updated": "2026-10-12",
  "units": [
    6
  ],
  "aliases": [],
  "sources": [
    {
      "title": "Nmap reference guide",
      "url": "https://nmap.org/book/man.html"
    }
  ],
  "published": "2026-10-02",
  "editorialVersion": 2
}
---

## The idea

Nmap is a network exploration and security assessment tool. It can perform host discovery, port scanning, service detection, and selected script-based checks. Each mode creates different traffic and may have different operational impact. Read current option documentation and scope scripts deliberately rather than running everything by default. Record commands and output, and interpret the results in light of filtering and the chosen network position.

## In practice

In a dedicated lab, a learner scans only the assigned target and saves results for a report, then verifies an unexpected service through approved follow-up.

## A common misunderstanding

Nmap output is not automatic proof of a vulnerability or exact application version. Detection can be uncertain or misleading.

## Check your understanding

What should precede enabling a script category?

**Think it through:** Understanding its actions, permissions, target suitability, and the engagement’s allowed methods.

## Select functions for a defined question

A fictional administrator wants to verify the expected exposure of a training server. Host discovery, transport-port checks, service identification, and script-based assessment are separate functions with different traffic and assumptions. Choose the smallest permitted operation that answers the question rather than enabling every feature because it is available.

Record the vantage point. A result from the same virtual network may differ from a result through a firewall. Packet loss, timing, and target behavior also affect interpretation. The report should preserve target, source context, time, options, and tool version so another reviewer can understand the observation.

Output labels are inferences. An identified service or version can be useful, but may need confirmation from authorized configuration or another observation. Do not attach a vulnerability solely because a guessed version string resembles an affected product.

## Compare observed and intended exposure

Using a designated isolated lab server, write the expected services from its dummy configuration. Compare the authorized scan output with that list and investigate one unexpected result through supported, low-impact follow-up. Explain whether the difference is a configuration issue, an inference limit, or a genuine unexpected service.

Save the raw output and a short interpretation separately. The interpretation should state confidence and limitations rather than treating every line as a confirmed finding. Understand a script's actions and operational impact before using it; categories and defaults do not replace scope review. This workflow makes Nmap a source of inspectable evidence within an assessment, while keeping professional judgment responsible for the conclusion and next action.

## Keep exploring

- [[port-scanning]]
- [[service-enumeration]]
- [[vulnerability-scanning]]