Nmap Network Reconnaissance: A Practitioner’s Guide
Your smart friend’s field-tested walkthrough for discovering what’s really on a network.
Let me level with you — Nmap has been my go-to recon tool for years. I’ve used it on everything from internal pentests to massive external asset discovery, and I still learn something new every few months. It’s the Swiss Army knife that’s sharp enough to cut through the noise and actually show you what’s living on your target network.
Here’s what I wish someone had told me when I started: Nmap isn’t just about running a default scan and hoping for the best. It’s about asking the right questions in the right way, at the right time, for the engagement you’re on. Let’s break that down.
📍 Essential Scan Types & When to Use Them
TCP Connect Scan (-sT)
The bread-and-butter. Uses the full three-way handshake and works without raw socket privileges.
nmap -sT 192.168.1.0/24
When to use it:
– When you’re scanning as a non-root user (unprivileged)
– When raw sockets are restricted or monitored by AV/EDR
– Testing Windows targets where some scans behave unpredictably
Trade-off: It’s noisy. Every connection shows up in logs. But sometimes that’s exactly what you want for testing detection controls.
SYN Scan (-sS) — “The Stealth Scan”
Half-open scans. Sends SYN, waits for SYN/ACK, then immediately RSTs before the connection completes.
sudo nmap -sS 10.0.0.1-254
When to use it:
– Default choice for most pentest scenarios requiring root/sudo
– When you need speed and want to avoid completing full TCP handshakes
– Target has logging enabled and you want to minimize evidence (though modern defenses catch this)
Trade-off: Needs root/admin privileges on most systems. Not invisible, just quieter.
UDP Scan (-sU)
UDP is the forgotten often-forgotten cousin of TCP scanning, but it’s where you find critical services like DNS, SNMP, TFTP, and NTP — gold mines for amplification attacks and information disclosure.
sudo nmap -sU --top-ports 50 192.168.1.100
When to use it:
– Scanning DNS servers (53), SNMP (161), DHCP (67/68), NTP (123)
– Looking for forgettable but exploitable services
– Checking for UDP reflection vulnerability potential
Trade-off: UDP scanning is painfully slow. Use --top-ports or -F (fast mode) to stay sane unless you have a specific port list.
Version Detection (-sV)
Once you’ve found open ports, version detection probes them to identify what’s actually running.
nmap -sS -sV --version-intensity 5 192.168.1.50
When to use it:
– After initial port discovery, want to know what’s listening
– Identify outdated/vulnerable server versions
– Comprehensive banner grabbing with service fingerprinting
Intensity level (--version-intensity 0-9): Lower = faster, higher = more aggressive probing. I default to 5 for most scans.
OS Detection (-O)
Fingerprint the target operating system based on TCP/IP stack behavior.
sudo nmap -O 10.0.0.50
When to use it:
– Pre-exploit enumeration — knowing the OS helps prioritize next steps
– Verifying firewall filtering or NAT behavior (sometimes OS detection fails on filtered hosts)
– Asset inventory validation
Gotcha: Needs at least one open AND one closed port. Works best with multiple ports visible. Won’t work well on heavily filtered hosts.
Aggressive Scan (-A)
“The kitchen sink” — enables OS detection, version scanning, script scanning, and traceroute simultaneously.
nmap -A target.com
When to use it: Quick comprehensive recon when staying up late isn’t a concern. Warning: it’s loud and slow — don’t run this against time-sensitive targets without careful consideration.
🔧 Practical Command Examples (That I Actually Use)
Quick Host Discovery (Are You Alive?)
nmap -sn 192.168.1.0/24
Ping scan only. No port scanning. Great for building an initial host list.
For black-box external: Use -PS, -PA, -PU for TCP/UDP ping probes.
sudo nmap -sn -PS22,80,443 203.0.113.0/24
Fast Scan for Large Networks
nmap -sS -T4 --top-ports 100 -oA quick_discovery 10.10.0.0/16
Breakdown:
– -T4: Timing template — speeds up the scan (T0-slowest to T5-insane)
– --top-ports 100: Scan only the 100 most common ports
– -oA quick_discovery: Output in all formats (normal, XML, grepable)
Scale tip: For /16 networks (65536 hosts), scan times can balloon. Consider splitting into chunks and running parallel:
# Run in parallel with GNU parallel
seq 0 255 | parallel -j 10 'nmap -sn 10.10.{}.0/24 -oA subnet_{}'
Focused Service Enumeration
When you’ve found a specific target and want to understand its attack surface:
nmap -sS -sV -p- --min-rate 1000 192.168.1.50
-p-: Scan all 65535 ports (not just top 1000)--min-rate 1000: Enforce minimum packet rate — speeds things up for responsive networks
Safe Web Server Discovery
Check only web-relevant ports for a quick surface map:
nmap -sS -p 80,443,8080,8443,3000,8000,8888 --open 192.168.1.0/24
--open: Show only open ports — reduces noise significantly.
🔬 NSE Scripts for Vulnerability Detection
Nmap Scripting Engine (NSE) is where Nmap transforms from a scanner into a vulnerability discovery juggernaut. Scripts live in /usr/share/nmap/scripts/ and cover everything from brute-force to vulnerability detection to backdoor checks.
Finding Vulnerable Services Quickly
nmap -sV --script vuln 192.168.1.50
--script vuln: Runs all scripts in the vuln category — checks for known vulnerabilities like MS08-067, Shellshock, and others. Great for quick vulnerability sweeps, though not exhaustive.
SSH Security Assessment
nmap -p 22 --script ssh-auth-methods,ssh-hostkey,ssh-brute 10.0.0.5
ssh-auth-methods: Enumerates supported authentication methodsssh-hostkey: Retrieves and displays host keysssh-brute: Attempts brute-force login (use carefully in production!)
SMB Enumeration & Vulnerability Checks
nmap -p 445 --script smb-enum-shares,smb-enum-users,smb-vuln-ms17-010 192.168.1.100
This one’s gold for Windows environments:
– Enumerates shares and users
– Checks for EternalBlue (MS17-010)
HTTP Headers and Security
nmap -p 80,443 --script http-headers,http-security-headers target.com
Quick check for missing security headers like HSTS, X-Frame-Options, etc.
Scan All Default Scripts (Broad Discovery)
nmap -sC -sV 192.168.1.50
-sC: Runs the default script set — safe, informative scripts for common services. Good baseline. Always pair with -sV for proper service fingerprinting.
🎭 Evasion Techniques (Your Ninja Moves)
Now, here’s where things get interesting. Evasion isn’t about being invisible — it’s about blending in, confusing defenders, and making your traffic harder to correlate back to you.
Fragmentation
Split packets into fragments to avoid simple packet filters:
nmap -f -sS 192.168.1.50
-f: Fragments packets into 8-byte chunks (or use -ff for 16-byte). Some firewalls/IDS won’t reassemble for inspection.
Decoy Scans
Make it look like multiple sources are scanning simultaneously:
nmap -D RND:10 -sS 192.168.1.50
-D RND:10: Randomly generates 10 decoy IPs. Your real IP is mixed in with the chaff.
Use with caution: Decoys need to be reachable and alive, or they’ll stand out. Some IDS will flag decoy patterns.
Source Port Manipulation
Legitimate traffic often uses predictable source ports (DNS = 53, HTTP = 80). Some firewalls allow traffic based on source port:
nmap --source-port 53 -sS 192.168.1.50
--source-port 53: Pretend to be DNS traffic. Works on misconfigured stateless firewalls.
Timing Manipulation
Slow things down to avoid triggering rate-based detection:
nmap -T0 -sS 192.168.1.50
-T0: “Paranoid” timing — very slow, serial scan (5 min delay between probes)-T1: Sneaky, 15-second delays-T2: Polite, slower but not crawl-pace
Idle Scan (IPID Manipulation)
The ultimate in attribution evasion — scan using a third-party zombie:
nmap -sI zombie_host.com 192.168.1.50
Your scan traffic appears to originate from the zombie host, not you. Requires finding an exploitable IPID sequence host first.
MAC Address Spoofing
For local LAN scans, change your MAC:
nmap --spoof-mac 0 -sS 192.168.1.50
0: Tells Nmap to generate a random MAC. Or provide a specific MAC address.
📊 Output Parsing & Reporting
Nmap’s output options are your paper trail for findings, evidence, and client deliverables.
Normal Output (Human-Readable)
nmap -oN scan_results.txt 192.168.1.50
Straightforward and readable. Good for documentation.
XML Output (For Tools & Import)
nmap -oX scan_results.xml -sS -sV 192.168.1.0/24
Useful for importing into Splunk, Metasploit, Nessus, or custom analysis scripts.
Grepable Output (For Quick Parsing)
nmap -oG grepable_results.txt -sS 192.168.1.0/24
Easily parseable with grep, awk, cut. Example:
# Extract only hosts with port 22 open
grep "22/open" grepable_results.txt
All Formats (Best for Flexibility)
nmap -oA comprehensive_scan -sS -sV 192.168.1.0/24
Generates all three: .nmap, .xml, .gnmap files in one shot. My standard for any engagement.
Parsing XML with Python
For automation:
import xml.etree.ElementTree as ET
tree = ET.parse('scan_results.xml')
root = tree.getroot()
for host in root.findall('host'):
address = host.find('address').get('addr')
for port in host.findall('.//port'):
port_id = port.get('portid')
state = port.find('state').get('state')
service = port.find('service').get('name', 'unknown')
print(f"{address}:{port_id} - {state} - {service}")
Generating HTML Reports
xsltproc scan.xml -o report.html
Transforms XML output into a basic HTML report. For more polished output, tools like nmap-bootstrap-xsl or nmap-report add formatting.
🧠 Practical Tips from the Field
1. Context matters: Internal scans can be aggressive (-T4, –min-rate). External, especially with Blue Teams watching? Slow and careful wins.
2. Scripts need matching ports: Running --script smb-enum-shares without -p 445 won’t trigger anything. Match scripts to target ports.
3. Save everything: Every engagement, I use -oA. Even if you think it’s a throwaway scan, you’ll want the raw data later when writing the report at 2 AM.
4. Combine thoughtfully: -A is convenient, but rarely the right choice for production environments. Build your scan command around the question you’re asking, not a convenience flag.
5. Test on yourself first: Before running any new scripts or evasion techniques on a client network, spin up a test VM and see what the noise looks like from the Blue Team side.
⚡ Closing Thoughts
Nmap isn’t just a tool — it’s a mindset. The scanner is only as good as your understanding of the network fundamentals underneath. TCP handshake, UDP behavior, ICMP filtering, fragmented packets… those concepts never change, and Nmap just gives you the interface to manipulate them.
Next time you’re facing a target, stop and think: What am I really trying to learn? What’s the smallest move I can make to answer that question without waking the dragon? Start there. Build your command.
And remember: The best pentesters aren’t the ones who know the most flags — they’re the ones asking the best questions.
— mrakashkumar.in
Originally published at acefortis.com
