Skip to content
Learning how to use Nmap to scan your network is the first practical skill every ethical hacker develops — and for good reason. Before you can test anything, you need to know what is there. Nmap answers that question faster and more completely than any other tool available.
This guide covers the 7 most useful Nmap commands for beginners, explains what each one actually shows you, and walks you through reading the output. Everything here runs in your Kali Linux lab — legally, safely, against your own systems. If you want the complete network scanning and enumeration walkthrough, Hands-On Kali Linux for Beginners covers Chapters 4 and 5 in full detail.
What is Nmap and Why Do Beginners Need to Know How to Use It?
Nmap — Network Mapper — is a free, open-source tool that discovers devices on a network and determines what services and ports they are running. It is the starting point for virtually every penetration test and network security audit.
Think of using Nmap to scan a network as taking inventory before you do anything else. A penetration tester who skips the scanning phase is like a surgeon who skips the X-ray. You need the map before you navigate the territory.
Nmap comes pre-installed in Kali Linux. Open your terminal and type nmap --version to confirm it is ready. You should see the version number — as of 2025 Nmap 7.94 or later.
✓ Legal reminder: Every command in this guide should be run against your own machines — your Kali VM, your home router (which you own), or a Metasploitable VM in your lab. Using Nmap against systems you do not own or have written permission to test is illegal in most jurisdictions.
How to Use Nmap to Scan Your Network — 7 Essential Commands
nmap 127.0.0.1Each line is an open port. The port number tells you where the service lives. The service name tells you what's running there. Port 22 open means SSH is enabled — remote access is available. Port 80 open means a web server is running.
-sn flag tells Nmap to find every device on a network without scanning their ports. Fast, quiet, and the right first step when you want to know what's connected.nmap -sn 192.168.1.0/24Replace 192.168.1.0/24 with your actual network range. Find your network range by running ip addr in your Kali terminal and looking at the inet address. The /24 tells Nmap to scan all 254 possible hosts on that subnet.
-sV flag goes beyond port discovery. It probes each open port and tries to identify the exact software and version running on it. This is where scans become actionable intelligence.nmap -sV 192.168.1.1Version numbers are critical for penetration testing. An outdated version of Apache or OpenSSH may have known vulnerabilities. Nmap hands you this information — what you do with it is the next step in the penetration testing process.
-O flag attempts to identify the operating system of the target based on how it responds to specific network probes. Requires root privileges — use sudo.sudo nmap -O 192.168.1.1OS detection is not always accurate — it depends on how the target responds. But when it works, knowing the operating system narrows down which exploits and techniques apply. A Windows target and a Linux target require completely different approaches.
-A flag runs OS detection, version detection, script scanning, and traceroute simultaneously. The most comprehensive single-command scan available — and the most detectable. Use it in your lab only.sudo nmap -A 192.168.1.1The output is extensive — OS details, service versions, script results, and the network path to the target. Great for learning because it shows you everything at once. In a real penetration test you would use targeted scans rather than -A to avoid detection by security monitoring systems.
-p to specify exactly which ports to scan — faster and more targeted when you know what you are looking for.nmap -p 22,80,443,3306,8080 192.168.1.1nmap -p 1-1000 192.168.1.1nmap -p- 192.168.1.1The first example scans specific ports by number. The second scans a range. The third — -p- — scans all 65535 ports. Full port scans take longer but find services running on non-standard ports that default scans miss entirely.
nmap -sV -oN scan_results.txt 192.168.1.1nmap -sV -oX scan_results.xml 192.168.1.1-oN saves in normal readable format. -oX saves as XML which other tools — including Metasploit — can import and parse automatically. The filename appears in your current directory. Check it with cat scan_results.txt.
Understanding Nmap Output — What Do the Port States Mean?
When you use Nmap to scan your network every port it finds is reported as one of three states. Understanding the difference matters:
| State | What It Means | Why It Matters |
|---|---|---|
| open | A service is actively listening and accepting connections on this port | Your primary target — something is running here worth investigating |
| closed | The port is accessible but no service is listening | Not immediately useful but confirms the host is reachable |
| filtered | A firewall or packet filter is blocking Nmap's probes | Something may be running here but it's protected — worth noting |
Common Port Numbers Every Beginner Should Memorize
When reading Nmap scan results you will see the same port numbers repeatedly. Here are the ones that matter most:
| Port | Service | Why It's Interesting |
|---|---|---|
| 21 | FTP | File transfer — often has weak authentication or anonymous access |
| 22 | SSH | Remote access — target for brute-force attacks if using weak passwords |
| 23 | Telnet | Unencrypted remote access — credentials travel in plain text |
| 80 | HTTP | Web server — starting point for web application testing |
| 443 | HTTPS | Encrypted web server — still testable for web vulnerabilities |
| 445 | SMB | Windows file sharing — historically exploitable (MS08-067, EternalBlue) |
| 3306 | MySQL | Database — exposed databases are a critical finding |
| 3389 | RDP | Windows Remote Desktop — common brute-force target |
💡 Pro tip: Save this port table. When you run a Nmap scan and see an unfamiliar port number — look it up immediately. Understanding what service runs on each port is one of the most valuable habits you can build as a beginner.
Combining Nmap with Metasploit — The Natural Next Step
Nmap and Metasploit are designed to work together. Once you have used Nmap to scan your network and identified open ports and service versions, Metasploit uses that information to test whether those services have exploitable vulnerabilities.
The workflow every penetration tester follows:
- Nmap scan — discover what's running and what versions
- Research — look up known vulnerabilities for those service versions
- Metasploit — test whether the vulnerability is exploitable
- Document — record findings for the penetration testing report
You can even import Nmap XML output directly into Metasploit using the db_import command — saving you from re-entering target information manually. This integration is covered in full in Hands-On Kali Linux for Beginners alongside the complete network scanning and enumeration workflow from Chapters 4 and 5.
⚠ One more time — because it matters: Only run Nmap against systems you own or have explicit written permission to test. Your Kali Linux VirtualBox lab, your home router, and Metasploitable are all fair game. Scanning your workplace network, a public IP address, or anyone else's infrastructure without written authorization is illegal and can result in serious consequences.
Ready to go further with Nmap and network scanning?
Chapters 4 and 5 of Hands-On Kali Linux for Beginners cover the complete network scanning and enumeration workflow — from your first Nmap scan through advanced enumeration techniques, with every command explained and every output interpreted.
📞 Amazon Kindle — $7.99 📘 Paperback on Books.by
