NMAP FOR BEGINNERS

ABOUT NMAP

NMAP (Network Mapper) is an open-source tool for network discovery and security auditing.

SCANNING WITH NMAP

BASIC HOST SCAN

Ping Scan (Entire subnet scan)

nmap -sn target ip address. 
Example: nmap -sn 192.168.3.1-255

nmap

Multiple Hosts Scan

nmap 192.168.3.1 192.168.3.2 192.168.3.3

nmap multiple scan

Subnet Scan
```
nmap 192.168.3.0/24
```
The result implies that all 1000 ports on the first host exists but they are closed and not accepting connection. Hence, the reason for the “reset” response. The “ignored” message in this case could also be because the ports are filtered by a firewall.

Explanation

The entire subnet scan will return the status (up or down) of all the host on that subnet
The single scan will return status (up or down) of a single host
The multiple host scan will return the status of the specified hosts (up and down). In this case, two of the hosts are up and one of the host has ssh and NRPE (Nagios Remote Plugin Executor) running.

PORT SCANNING

SYN Scan (Default) - Stealthier and widely used scan
```
nmap -sS 192.168.3.1
```
The result revealed the currently open tcp ports (22, 5666) running ssh and nagios respectively. 998 tcp ports are currently closed.
TCP Connect Scan - A fast but more detectable scan
```
nmap -sT 192.168.3.1
```
The result revealed the currently open tcp ports (22, 5666) running ssh and nagios respectively. 998 tcp ports are currently closed. This only scans for TCP Ports.
UDP Connect Scan - UDP Ports discovery
```
nmap -sU 192.168.3.1
```

The result returned 999 closed udp ports and only one (5353) opened port.

Port Range Scan - Use when you don’t need to scan all ports
```
nmap -p 1-10 192.168.3.1
```
The result returns the state of 10 ports and the services running on them.
Specific Ports Scan - For a more specified port
```
nmap -p 22,80,443 192.168.3.1
```
The result returns the state of port 22,80,443 and the services running on them.