Nmap Tutorial for Beginners: Top Commands & Scanning Techniques

Nmap (Network Mapper) is a free, open-source port scanner used to discover live hosts, open ports, running services, and operating systems on any network. This nmap tutorial covers the essential commands — from ping sweeps and SYN scans to NSE script automation — so beginners can start practising on legal targets immediately and build skills tested in CEH and OSCP exams.

• Nmap scans the top 1,000 ports by default, covering the vast majority of real-world attack surface.
• SYN scans are faster and stealthier than full TCP connect scans, but they require root/administrator privileges.
• Always get written permission before scanning any network you don’t own.
• Service detection (-sV) and OS fingerprinting (-O) are the two skills most commonly tested in CEH and OSCP exams.
• NSE scripts let you automate vulnerability checks without writing a single line of custom code.

What Nmap Is and Why Every Ethical Hacker Learns It First

Nmap was created by Gordon Lyon (known online as Fyodor) in 1997 and has been actively maintained ever since. According to the SANS Institute’s Penetration Testing Survey Report (2023), Nmap appears in over 90% of professional penetration tester toolkits. That’s not a coincidence.

Port scanning is the very first active reconnaissance step in any engagement. Before you exploit anything, you need to know what’s listening. Nmap answers that question faster and more accurately than almost any other free tool available.

If you’re studying ethical hacking or working toward a certification, getting comfortable with how to use Nmap is non-negotiable. Both the CEH v13 blueprint and the OSCP curriculum list host discovery and port scanning as foundational competencies. You can explore the full CEH v13 syllabus inside 3.0 University’s CEH v13 programme if you want to see exactly where Nmap sits in the exam objectives.

Installing Nmap

On Kali Linux, Nmap comes pre-installed. On Ubuntu or Debian, run sudo apt install nmap. On Windows, download the installer from nmap.org. Mac users can install it via Homebrew with brew install nmap. Check your version with nmap –version before you start, because some NSE scripts depend on a recent release.

If you’re new to Kali, the Kali Linux for beginners guide on 3.0 University covers the terminal basics you’ll need before running your first scan.

Legal Targets for Practice

Scanme.nmap.org is an official practice server maintained by the Nmap project specifically for learners. Hack The Box and TryHackMe both provide isolated lab environments where scanning is explicitly permitted. Use these. Scanning any other network without written authorisation is illegal under India’s IT Act 2000 (Section 43 and Section 66), as well as under the Computer Fraud and Abuse Act in the US. Indian organisations conducting authorised VAPT engagements are also required under CERT-In’s 2022 Directions to maintain documented evidence of all scanning activity — making proper Nmap output saving a compliance requirement, not just good practice.

Core Nmap Commands and Scan Types You Need to Know

This is the practical heart of any nmap tutorial. The commands below are the ones that appear most often in real engagements and in certification exam scenarios. Work through them in order on scanme.nmap.org and you’ll understand what each flag actually does rather than just memorising syntax.

Host Discovery

Before scanning ports, find out which hosts are alive on the network. Use nmap -sn 192.168.1.0/24 for a ping sweep. The -sn flag skips port scanning entirely and just reports which IPs responded. This is fast and low-noise, ideal for mapping a subnet before going deeper.

To scan a single host, the simplest command is just nmap 45.33.32.156 (that’s scanme.nmap.org’s IP). Nmap will scan the top 1,000 TCP ports and return open, closed, or filtered status for each one.

TCP Connect Scan vs SYN Scan

This is one of the most common comparison questions in CEH exams, so understand it properly. A TCP connect scan (-sT) completes the full three-way handshake: SYN, SYN-ACK, ACK. It’s reliable but leaves a clear log entry on the target system because the connection is fully established.

A SYN scan (-sS), sometimes called a “half-open” scan, sends a SYN packet and waits for a SYN-ACK response. If one arrives, Nmap knows the port is open and immediately sends a RST to tear down the connection without completing the handshake. This leaves fewer traces and is significantly faster. It does require root or administrator privileges to run.

Scan Type	Flag	Completes Handshake	Requires Root	Logged by Target	Speed
TCP Connect	-sT	Yes	No	Usually yes	Slower
SYN (Half-open)	-sS	No	Yes	Less likely	Faster
UDP Scan	-sU	N/A	Yes	Varies	Slowest
Null Scan	-sN	No	Yes	Rarely	Fast

Service and Version Detection

Open ports tell you a port is listening. Service detection tells you what is listening. Run nmap -sV 45.33.32.156 and Nmap probes each open port to identify the service name and version number. You might see “OpenSSH 8.9p1” instead of just “port 22 open”. That version string is what you’d then cross-reference against CVE databases.

According to Nmap’s official documentation, the version detection engine uses a database of over 6,500 service signatures to identify software running on open ports. That breadth is why it remains the industry default over simpler tools.

OS Fingerprinting

Add the -O flag to attempt operating system detection. Nmap analyses TCP/IP stack behaviour, TTL values, and window sizes to guess the OS. Results look like “Linux 4.x” or “Windows Server 2019”. It’s not always exact, but it narrows your attack surface research significantly. Combine it with service detection using nmap -sS -sV -O 45.33.32.156 for a thorough initial scan.

Nmap vs Masscan: A Quick Comparison

Masscan can scan the entire IPv4 internet in under six minutes at maximum rate. Nmap can’t match that speed. But Nmap’s accuracy, service detection depth, and NSE scripting capability mean it’s the right tool for targeted assessments. Use Masscan to find live hosts across huge ranges, then hand those IPs to Nmap for detailed analysis. They complement each other rather than compete.

For a broader look at where Nmap fits among other tools, the penetration testing tools overview on 3.0 University covers the full recon-to-exploitation stack.

NSE Scripts and the Nmap Cheat Sheet

The Nmap Scripting Engine (NSE) is what separates casual port scanning from actual vulnerability research. NSE scripts are written in Lua and ship with Nmap in categories like auth, vuln, exploit, discovery, and safe. As of Nmap 7.95, the official distribution includes over 600 scripts.

If you’re preparing for a pentest interview or a CEH practical, this is the section that impresses. Recon skills, including knowing which script to run against which service, are consistently cited by hiring managers as a differentiator between junior and mid-level candidates. According to EC-Council’s 2024 Global Ethical Hacking Workforce Study, hands-on tool proficiency was ranked the top hiring criterion ahead of certifications alone. The ethical hacking techniques and tools guide on 3.0 University goes deeper into how recon fits the full kill chain.

Ready to make NSE scripts part of a structured study plan? 3.0 University’s CEH v13 programme covers Nmap, NSE, and the full EC-Council exam syllabus with hands-on labs.

Most Useful Nmap Commands: Quick Reference Nmap Tutorial Cheat Sheet

Here’s the nmap cheat sheet you’ll actually use in this nmap tutorial, organised by task rather than alphabetically.

Task	Command	Notes
Ping sweep (host discovery)	nmap -sn 192.168.1.0/24	No port scan, just finds live hosts
Default scan (top 1000 ports)	nmap 45.33.32.156	TCP connect or SYN depending on privileges
SYN scan	sudo nmap -sS 45.33.32.156	Requires root; faster and quieter
Service version detection	nmap -sV 45.33.32.156	Identifies software and version on open ports
OS detection	sudo nmap -O 45.33.32.156	Guesses OS from TCP/IP behaviour
Aggressive scan	sudo nmap -A 45.33.32.156	Combines OS, version, script, traceroute
All ports	nmap -p- 45.33.32.156	Scans all 65,535 ports; slow
Specific ports	nmap -p 22,80,443 45.33.32.156	Faster when you know what you’re looking for
UDP scan	sudo nmap -sU 45.33.32.156	Slow but essential for DNS, SNMP, DHCP
Run default NSE scripts	nmap -sC 45.33.32.156	Safe category scripts only
Run specific NSE script	nmap –script http-title 45.33.32.156	Replace http-title with any script name
Save output to file	nmap -oN output.txt 45.33.32.156	Normal format; use -oX for XML
Timing template (faster)	nmap -T4 45.33.32.156	T0 (slowest) to T5 (fastest/noisiest)
Vulnerability scan	sudo nmap –script vuln 45.33.32.156	Runs all vuln-category scripts; noisy

Target Specification Options

Nmap accepts targets in multiple formats. A single IP (192.168.1.1), a CIDR range (192.168.1.0/24), a hyphenated range (192.168.1.1-50), a hostname (scanme.nmap.org), or a text file of targets (nmap -iL targets.txt). That flexibility matters in real engagements where client scope documents list targets in inconsistent formats.

You can also exclude specific hosts from a range using –exclude 192.168.1.5. Useful when a production server in scope needs to be treated carefully to avoid disruption.

Output Formats

Always save your scan output. -oN saves normal human-readable text. -oX saves XML, which tools like Metasploit and Nessus can import directly. -oG saves grepable output for quick command-line filtering. Use -oA basename to save all three formats simultaneously. Under CERT-In’s 2022 Directions, Indian organisations and their VAPT vendors must retain documented evidence of all security testing activity — saving Nmap output in XML format satisfies that requirement and integrates directly with reporting tools used by firms like Lucideus, Sequretek, and TAC Security.

Frequently Asked Questions

How do I use Nmap for beginners?

Start with a simple command against a legal target: nmap scanme.nmap.org. This scans the top 1,000 ports and returns open/closed/filtered status. Read the output carefully before adding more flags. Progress to -sV for service detection, then -O for OS fingerprinting. Practice on TryHackMe or Hack The Box labs where scanning is explicitly permitted.

What are the most useful Nmap commands?

The commands you’ll use most often in this nmap tutorial and in real work are: nmap -sS (SYN scan), nmap -sV (service detection), nmap -O (OS fingerprinting), nmap -A (aggressive scan combining all three), nmap -sC (default scripts), and nmap -p- (all 65,535 ports). Combine flags like nmap -sS -sV -O -T4 for efficient, detailed results on a single target.

Is using Nmap legal?

Nmap itself is legal to download and use. Scanning a network you own or have written permission to test is legal. Scanning networks without authorisation is a criminal offence under India’s IT Act 2000 (Sections 43 and 66) and under similar laws in most countries. Always get explicit written scope approval before running any scan on a client or third-party network.

How do I scan a network with Nmap?

To scan a network range, use CIDR notation: nmap -sn 192.168.1.0/24 discovers live hosts first. Then run nmap -sS -sV 192.168.1.0/24 for a SYN scan with service detection across the subnet. Save results with -oN results.txt. For large networks, increase speed with -T4, but avoid -T5 in production environments as it can cause disruption.

What is the difference between a TCP scan and a SYN scan?

A TCP connect scan (-sT) completes the full three-way handshake, which means the target system logs the connection. A SYN scan (-sS) sends only the initial SYN packet, receives the SYN-ACK if the port is open, then sends a RST to abort before completing the handshake. SYN scans are faster, quieter, and require root privileges. TCP connect scans work without root but are more easily detected.

Nmap is one of those tools that takes about an hour to learn and a career to master. The commands in this nmap tutorial give you a working foundation, but real proficiency comes from running scans in structured lab environments, reading the output critically, and understanding why a port shows as filtered rather than just closed.

Recon skills, including Nmap fluency, are consistently listed as interview requirements for junior penetration tester roles at Indian cybersecurity firms like Lucideus, Sequretek, and TAC Security, as well as at global MSSPs hiring from Indian campuses. According to EC-Council’s 2024 Global Ethical Hacking Workforce Study, hands-on tool proficiency was ranked the top hiring criterion ahead of certifications alone.

If you want to build these skills inside a structured curriculum with CEH v13 exam preparation built in, 3.0 University’s CEH v13 programme is a practical next step. For the broader toolkit context, start with the ethical hacking techniques and tools guide to see how Nmap fits alongside Wireshark, Metasploit, and Burp Suite in a real engagement workflow.

Last updated: July 2026. Reviewed by the 3University editorial team.