Network Scanning with Nmap: Walkthrough

Network scanning is the foundation of nearly every offensive and defensive security engagement. Before you can assess risk, harden a network, or simulate an attacker's path, you need a clear picture of what is actually reachable, what services are running, and where the weak points might be. Nmap remains the industry standard for this kind of reconnaissance, and understanding it deeply separates junior analysts from seasoned practitioners.

This walkthrough covers Nmap from first principles through advanced scripting and evasion, with real commands you can run in a lab or authorized engagement. At SageFox Cybersecurity, our penetration testers rely on disciplined, methodical scanning as the first phase of every assessment, and this guide reflects that same approach.

What Is Network Scanning and Why Nmap Still Matters

Network scanning is the process of identifying live hosts, open ports, running services, and operating systems across a target network. It answers three core questions: what exists, what is exposed, and what version of software is handling that exposure.

Nmap (Network Mapper) has stayed relevant for over two decades because it is fast, scriptable, actively maintained, and capable of everything from a simple ping sweep to deep service fingerprinting through the Nmap Scripting Engine (NSE). Whether you are doing internal network mapping, external attack surface assessment, or validating firewall rules after a change, Nmap is usually the first tool out of the bag.

If your organization needs a structured, professional network scanning and vulnerability assessment engagement rather than a self-guided lab exercise, SageFox Cybersecurity runs full-scope internal and external assessments using this exact methodology at enterprise scale.

Setting Up a Safe Lab Before You Scan Anything

Before running any of the commands below against a live network, confirm you have explicit written authorization. Scanning networks you do not own or have permission to test can violate computer misuse laws in most jurisdictions.

For practice, spin up a local lab using tools like VirtualBox or a cloud sandbox with intentionally vulnerable machines. A simple setup:

bash

# Install Nmap on Debian/Ubuntu
sudo apt update && sudo apt install nmap -y

# Verify installation and version
nmap --version

Once installed, confirm you can reach your lab target before moving into discovery.

Phase One: Host Discovery

The first step in any scan is figuring out which hosts on a network segment are actually alive. Sending a full port scan against every possible address in a /24 range wastes time if half of them are offline.

Basic Ping Sweep

bash

nmap -sn 192.168.1.0/24

The -sn flag disables port scanning and only performs host discovery, using ICMP echo requests, TCP SYN to port 443, TCP ACK to port 80, and ICMP timestamp requests by default.

Discovery When ICMP Is Blocked

Many corporate networks block ICMP at the host firewall level, which makes a simple ping sweep unreliable. In those cases, force Nmap to rely on TCP or ARP-based discovery instead.

bash

# ARP-based discovery (only works on local subnet)
sudo nmap -sn -PR 192.168.1.0/24

# TCP SYN discovery on common ports, no ping
nmap -sn -PS22,80,443,3389 10.0.0.0/24

ARP scanning is by far the most reliable method on a local segment because ARP requests operate at Layer 2 and are rarely filtered.

Phase Two: Port Scanning Techniques

Once you know which hosts are live, the next step is identifying open ports and the services bound to them. This is where scan type selection actually matters, since different techniques behave differently against firewalls, IDS, and modern endpoint protection.

TCP SYN Scan (The Default Standard)

bash

sudo nmap -sS 192.168.1.10

The SYN scan, often called a half-open scan, sends a SYN packet and analyzes the response without completing the three-way handshake. It is fast, relatively stealthy compared to a full connect scan, and requires root or administrator privileges to craft raw packets.

TCP Connect Scan (No Raw Socket Access Required)

bash

nmap -sT 192.168.1.10

Use this when you lack raw socket privileges, such as scanning from a restricted user account. It completes the full TCP handshake, which is noisier and more likely to be logged.

UDP Scanning

UDP services are frequently overlooked because UDP scanning is slower and less reliable, but DNS, SNMP, NTP, and many industrial protocols run over UDP.

bash

sudo nmap -sU --top-ports 100 192.168.1.10

Because UDP has no handshake, Nmap infers open ports based on the absence of an ICMP port-unreachable response, which introduces false positives. Combining UDP and TCP scans gives a much more complete picture of true exposure. This is one of the most common gaps our team finds during SageFox Cybersecurity network assessments, where clients assume their attack surface is fully mapped but have never scanned UDP services at all.

Scanning Specific Ports vs Full Range

bash

# Scan a specific list of ports
nmap -p 21,22,25,80,443,3306,3389 192.168.1.10

# Scan the entire TCP port range
nmap -p- 192.168.1.10

# Scan the top 1000 most common ports (default behavior)
nmap 192.168.1.10

For time-sensitive engagements, scanning the top 1000 ports first and following up with a full -p- sweep on high-value hosts is a practical compromise between speed and coverage.

Phase Three: Service and Version Detection

Knowing a port is open is only half the story. Identifying the exact service and version running behind it is what turns a scan into actionable intelligence, especially when correlating against known CVEs.

bash

sudo nmap -sV -sS 192.168.1.10

For more aggressive version detection with higher accuracy at the cost of speed:

bash

sudo nmap -sV --version-intensity 9 192.168.1.10

Operating System Fingerprinting

bash

sudo nmap -O 192.168.1.10

OS detection analyzes TCP/IP stack behavior, TTL values, window sizes, and other subtle characteristics to guess the underlying operating system and kernel version. Accuracy improves significantly when at least one open and one closed port are available on the target.

The All-in-One Aggressive Scan

bash

sudo nmap -A -T4 192.168.1.10

The -A flag enables OS detection, version detection, script scanning, and traceroute in a single pass. -T4 sets an aggressive timing template suitable for reliable networks. This is convenient for lab work, but in a live engagement it is often better to run these phases separately for cleaner log correlation and reduced noise.

Phase Four: The Nmap Scripting Engine (NSE)

NSE is where Nmap moves from a port scanner into a genuine vulnerability discovery and enumeration platform. It uses Lua scripts organized into categories: auth, brute, discovery, exploit, malware, safe, version, and vuln, among others.

Running Default Scripts

bash

sudo nmap -sC 192.168.1.10

The default script set runs safe, non-intrusive scripts that pull banner information, enumerate shares, and check for common misconfigurations.

Targeted Vulnerability Scanning

bash

sudo nmap --script vuln 192.168.1.10

The vuln category runs checks against known CVEs and misconfigurations for detected services. It is significantly noisier than the default scripts and should be used carefully in production environments.

SMB Enumeration Example

SMB remains one of the most consistently exploitable services in enterprise environments, particularly on internal assessments.

bash

sudo nmap -p 445 --script smb-os-discovery,smb-enum-shares,smb-enum-users 192.168.1.10

Checking for a Specific Known Vulnerability

bash

sudo nmap -p 445 --script smb-vuln-ms17-010 192.168.1.10

This targets the vulnerability class behind EternalBlue-style SMBv1 exploitation, still found on unpatched legacy systems during internal network assessments far more often than most organizations expect.

HTTP Enumeration

bash

nmap -p 80,443 --script http-title,http-headers,http-methods,http-enum 192.168.1.10

http-enum in particular is useful for identifying common web application paths, admin panels, and backup files left exposed on a server, which frequently becomes the entry point our consultants use during web-facing assessments at SageFox Cybersecurity.

SSL/TLS Configuration Auditing

bash

nmap -p 443 --script ssl-enum-ciphers,ssl-cert 192.168.1.10

This identifies weak cipher suites, expired certificates, and deprecated protocol versions like SSLv3 or TLS 1.0, all common findings in compliance-driven audits.

Firewall and IDS Evasion Techniques

Understanding evasion is essential both for red team engagements and for defenders who need to know what an attacker might attempt against their perimeter. These techniques should only be used in authorized testing.

Fragmenting Packets

bash

sudo nmap -f 192.168.1.10

Packet fragmentation splits the TCP header across multiple IP fragments, which can bypass simple packet-filtering firewalls and older IDS signatures that do not reassemble fragments before inspection.

Decoy Scanning

bash

sudo nmap -D RND:10 192.168.1.10

Decoy scanning generates the appearance of multiple source addresses scanning simultaneously, making it harder for defenders to pinpoint the real origin of the scan from logs alone.

Source Port Manipulation

bash

sudo nmap --source-port 53 192.168.1.10

Some poorly configured firewalls trust traffic originating from specific ports like 53 (DNS) or 88 (Kerberos), assuming it belongs to legitimate infrastructure traffic.

Timing Templates for Stealth

bash

sudo nmap -T2 192.168.1.10

Lower timing templates (T0 and T1) slow scans down dramatically to avoid triggering rate-based IDS alerts, which matters significantly in engagements where detection avoidance is part of the test objective. Organizations evaluating whether their own detection stack would catch this kind of activity often bring in SageFox Cybersecurity for adversary simulation specifically to validate SOC response time.

Output Formats for Reporting and Automation

Raw terminal output is fine for quick lookups, but real engagements require structured, reusable output for reporting and downstream tooling.

bash

# Save in normal, XML, and grepable formats simultaneously
sudo nmap -sV -sC -oA scan_results 192.168.1.10

# Output specifically to XML for parsing into other tools
sudo nmap -sV -oX results.xml 192.168.1.10

The -oA flag writes all three formats at once, and XML output is particularly valuable because it can be parsed programmatically or converted into HTML reports using tools like xsltproc.

bash

xsltproc results.xml -o results.html

Scanning at Scale: Practical Enterprise Workflow

A single-host scan is rarely how real assessments work. Here is a realistic workflow for scanning an internal /16 network efficiently.

bash

# Step 1: Fast host discovery across the full range
sudo nmap -sn -T4 10.0.0.0/16 -oG live_hosts.txt

# Step 2: Extract live IPs
grep "Up" live_hosts.txt | awk '{print $2}' > alive.txt

# Step 3: Fast top-port scan against live hosts only
sudo nmap -iL alive.txt -T4 --top-ports 100 -oA fast_scan

# Step 4: Deep scan on hosts with interesting ports open
sudo nmap -iL priority_targets.txt -A -p- -T3 -oA deep_scan

This staged approach avoids wasting hours scanning every port on every dead IP address, and it mirrors the methodology used in professional-grade external and internal assessments, including the ones performed by the SageFox Cybersecurity team.

Common Mistakes to Avoid

Even experienced analysts fall into predictable traps when scanning networks:

• Running -A against an entire subnet instead of targeted hosts, which generates excessive noise and slows engagements down significantly
• Ignoring UDP scanning entirely and missing exposed DNS, SNMP, or NTP services
• Failing to rerun scans after remediation to confirm findings were actually fixed
• Scanning through a VPN or proxy without accounting for added latency, which skews timing-based results
• Not correlating Nmap version output against a current CVE database, leaving known exploitable versions unflagged in the final report

Key Takeaways

Nmap remains one of the most powerful tools available for understanding what is actually exposed on a network, but its value depends entirely on methodology. Host discovery, layered port scanning, accurate version detection, and targeted NSE scripting together build a complete picture that a single aggressive scan cannot replicate on its own.

Whether you are building internal security operations capability or preparing for a compliance-driven audit, mastering this workflow is a foundational skill. For organizations that need this level of scanning and analysis performed by seasoned professionals against production environments, with proper scoping, safe execution, and detailed reporting, SageFox Cybersecurity provides full network scanning and penetration testing services built on exactly the methodology outlined in this walkthrough.