2 AM. Production Alert. Unknown Traffic Spike.
Your monitoring dashboard lights up. Unusual outbound connections from the server. You have no idea what’s listening, what’s exposed, or where the traffic is going. First instinct? Grab Nmap.
I’ve been in that exact situation more than once — sweating through an incident where the fastest path to answers was understanding exactly what was open, what was running, and what shouldn’t be there. Nmap has saved me hours of guessing every single time.
This guide walks through Nmap the way I actually use it: under pressure, with real commands, and with enough context to make fast decisions.
The Real-World Problem: You Don’t Know What’s Exposed
Most security incidents start the same way — someone asks “what ports are open on this server?” and nobody has a clear answer. Maybe the server was handed off between teams. Maybe a developer ran docker run -p 0.0.0.0:5432:5432 during a late-night deploy and forgot about it. Maybe a service restarted with a different config.
Without visibility, you’re flying blind. Blind is dangerous when attackers are actively scanning the same address space you’re responsible for.
This isn’t a technical failure — it’s a process gap. Nobody mapped the attack surface. Nmap fixes that in minutes.
What Nmap Actually Does
Nmap (Network Mapper) sends crafted packets to a target and analyzes the responses. From those responses, it infers which ports are open, what services are running, what OS is likely installed, and whether known vulnerabilities exist.
Three scanning techniques come up in almost every workflow:
- TCP SYN scan (-sS) — sends a SYN, waits for SYN-ACK. Never completes the handshake. Fast, stealthy, and the default when running as root.
- TCP Connect scan (-sT) — completes the full TCP handshake. Slower, more detectable, but works without root privileges.
- UDP scan (-sU) — slower and less reliable, but critical for services like DNS (port 53), SNMP (161), and TFTP (69) that only run over UDP.
Knowing the difference shapes how much noise you’re willing to make on a given network.
Solutions Compared: Basic Scan vs. Full Audit
Option 1: Quick Port Check (Fast, Low Noise)
When you just need to confirm something is open or closed:
# Scan top 1000 ports (default)
nmap 192.168.1.10
# Scan a specific port
nmap -p 22 192.168.1.10
# Scan a range of ports
nmap -p 1-1024 192.168.1.10
# Scan all 65535 ports
nmap -p- 192.168.1.10Your “is it open or not” answer in under 30 seconds. No frills, no unnecessary noise.
Option 2: Service and Version Detection (More Context)
An open port alone tells you almost nothing. What matters is what’s running on it and which version. Old versions mean documented CVEs — and documented CVEs mean working exploits.
# Detect service versions on open ports
nmap -sV 192.168.1.10
# Combine with aggressive detection (more accurate, more noise)
nmap -sV --version-intensity 5 192.168.1.10Version detection has caught more “why is this server acting weird” issues than almost anything else I’ve used. A misconfigured Redis with no auth running on port 6379 — the version string comes back as Redis 4.0.9, exposed to the internet, no password set. That’s an immediate critical finding.
Option 3: OS Detection and Full Fingerprint
# OS detection (requires root/sudo)
sudo nmap -O 192.168.1.10
# Full aggressive scan: version, OS, scripts, traceroute
sudo nmap -A 192.168.1.10-A is the kitchen sink. Version detection, OS guessing, default NSE scripts, traceroute — all at once. Loud and thorough. Exactly what you want when auditing a machine you own but haven’t fully documented.
Option 4: Vulnerability Scanning with NSE Scripts
Nmap’s scripting engine (NSE) is where it stops being just a port scanner. Hundreds of scripts ship with Nmap, covering everything from SSL cert expiry to SMB vulnerabilities.
# Run default safe scripts
nmap -sC 192.168.1.10
# Run vulnerability scripts specifically
nmap --script vuln 192.168.1.10
# Check for specific vulnerabilities (e.g., EternalBlue / MS17-010)
nmap --script smb-vuln-ms17-010 192.168.1.10
# Check SSL/TLS configuration
nmap --script ssl-enum-ciphers -p 443 192.168.1.10
# Check for open HTTP directories
nmap --script http-enum 192.168.1.10During the 2 AM incident I mentioned, running --script vuln on the suspicious host flagged an unpatched SMB service with a known exploit path. One scan. Confusing traffic spike became a clear incident report.
The Incident Response Scan Sequence
When reacting to something unexpected, speed and signal clarity matter more than thoroughness. Here’s the sequence I actually use:
Step 1: Fast Recon (Under 60 Seconds)
# Fastest meaningful scan — top 100 ports, version detection
sudo nmap -F -sV 192.168.1.10Top 100 most common ports with service names. Enough to spot anything obviously wrong before your first coffee of the incident.
Step 2: Full Port Map (2–5 Minutes)
# All ports, SYN scan (stealth), save output
sudo nmap -sS -p- -oN scan_full.txt 192.168.1.10Save with -oN. You’ll need this output for the incident report anyway — capture it now while the scan runs.
Step 3: Deep Dive on Open Ports
# Once you know which ports are open, run scripts only on those
sudo nmap -sV -sC --script vuln -p 22,80,443,3306 192.168.1.10Targeting specific ports keeps the scan fast. It also cuts false positives from scripts hammering closed ports.
Step 4: Subnet-Wide Discovery (If Needed)
# Ping sweep to find all live hosts in a /24
nmap -sn 192.168.1.0/24
# Quick scan all live hosts (combine with grep to filter)
nmap -sV -F 192.168.1.0/24 -oG - | grep "open"Output Formats Worth Knowing
# Normal text output
nmap -oN results.txt target
# XML output (for tools like Metasploit or custom parsers)
nmap -oX results.xml target
# Grepable output (fast filtering)
nmap -oG results.gnmap target
# All three at once
nmap -oA results targetLegal and Ethical Boundaries
Nmap is a diagnostic tool, but scanning networks without authorization is illegal in most jurisdictions. Scan only systems you own or have explicit written permission to test. On production networks, coordinate with your team first — aggressive scans trigger IDS alerts, can overwhelm legacy services, and cause unexpected load spikes.
Practice safely on a dedicated lab. VulnHub or a local VM running Metasploitable gives you legitimate targets to build skills without legal exposure.
Making Nmap Part of Your Routine
The incident that actually made me love Nmap wasn’t the dramatic 2 AM one. It was a routine audit where I found a forgotten test server — default credentials, publicly reachable, still running. Nothing was compromised. But it easily could have been.
Schedule a quick sweep of your infrastructure every few weeks. Wire it into your CI/CD pipeline if you can. Either way, you start catching your own exposure before someone else does.
Nmap answers one question: what’s reachable, and what’s running there? Answer that reliably, and you’re already ahead of most incidents before they start.
