Skip to content
Deepak Gupta markRecon Atlas

Port scanning

Nmap

Network scanner that discovers live hosts, open ports, service versions and operating systems, with a Lua scripting engine for extra checks.

ActiveScope a pentestAudit your own exposure

14k stars · last push November 9, 2026 · LicenseRef-NPSL

GitHub repositoryOfficial docs

What it finds

Nmap sends raw IP packets to determine which hosts are up, which ports are open, filtered or closed, and what services and versions listen on them. It can also guess operating systems, detect packet filters, and run Nmap Scripting Engine (NSE) scripts. Output includes an "interesting ports table" plus reverse DNS names, device types and MAC addresses.

  • live hosts
  • open ports
  • port states (open/closed/filtered)
  • service names and versions
  • operating system guesses
  • firewall/packet-filter presence
  • reverse DNS names
  • MAC addresses

Does it touch the target?

Sends traffic to the target's systems. Use only with the owner's permission.

Nmap "uses raw IP packets in novel ways to determine what hosts are available on the network, what services ... those hosts are offering, what operating systems ... they are running" (nmap.org man page). By default it performs a SYN scan, falling back to a connect scan without raw-packet privileges.

API keys: Neither the README nor the man page describes any API key; Nmap scans targets directly.

Install

Install with source
./configure
make
make install

From the project's documentation

Install with source
bzip2 -cd nmap-7.993.tar.bz2 | tar xvf -
cd nmap-7.993
./configure
make
su root
make install

From the project's documentation

Install with package
rpm -vhU https://nmap.org/dist/nmap-7.993-1.x86_64.rpm

From the project's documentation

How to run it

Examples use reserved documentation hosts such as example.com. Replace them with a domain you own or are authorised to test.

Default scan of the Nmap-provided test host
nmap scanme.nmap.org

From the project's documentation

OS and version detection, script scanning and traceroute, faster timing
nmap -A -T4 scanme.nmap.org

From the project's documentation

Verbose scan of reserved TCP ports
nmap -v scanme.nmap.org

From the project's documentation

Host discovery only (no port scan) across private ranges
nmap -v -sn 192.168.0.0/16 10.0.0.0/8

From the project's documentation

Output formats: normal, xml, grepable, script kiddie

Limits the project documents

  • "Most of the scan types are only available to privileged users" because they send raw packets, which "requires root access on Unix systems."
  • Unprivileged users "can only execute connect and FTP bounce scans."
  • Results depend on packets returned by targets or firewalls, which "may be untrustworthy and send responses intended to confuse or mislead Nmap."
  • Legal notices: "Nmap may crash your systems or networks" and "it is often advisable to request permission before doing even a light scan of a network."
  • "Nmap should never be installed with special privileges (e.g. suid root)."
  • scanme.nmap.org permission covers scanning via Nmap only, with no more than "a dozen scans against that host per day."

Deepak's take

Analysis, not documentation

Use it when
Use it when you need depth on a known set of hosts: accurate port states, service versions, OS guesses and NSE script checks on your network.
Skip it when
For very large address ranges where speed matters more than depth, masscan or naabu fit better. Feed their open ports back into Nmap for detail.
What it will miss
It cannot discover hosts or domains you have not already given it, such as unknown subdomains or assets behind other IPs.

Facts read from the project's README and docs on November 10, 2026. Repository data as of November 11, 2026. Licence: LicenseRef-NPSL. Nmap is a trademark or project name of its owners; this library is not affiliated with it.