Nmap - the Network Mapper

Nmap is one of those tools that a pen-tester can’t live without. It has so many modules and modes, that it does everything. It can scan open ports, identify what services is running on the ports, it even has various scripts that can make your life ultra easy while scanning. No matter, how much I exaggerate, nmap always exceeds your expectations. It’s so good that it is even shown in movies with hacking scenes. If you visit Nmap Official Website, you can know more about it’s development and uses in a orderly manner.

It can be used for the following purposes:

• Real time information of a network
• Detailed information of all the IPs activated on your network
• Number of ports open in a network
• Provide the list of live hosts
• Port, OS and Host scanning

This is the official manual of nmap:

NAME

nmap — Network exploration tool and security / port scanner

SYNOPSIS

nmap [Scan Type…] [Options] {target specification}

DESCRIPTION

Nmap (“Network Mapper”) is an open source tool for network exploration

and security auditing. It was designed to rapidly scan large networks,

although it works fine against single hosts. Nmap uses raw IP packets

in novel ways to determine what hosts are available on the network,

what services (application name and version) those hosts are offering,

what operating systems (and OS versions) they are running, what type of

packet filters/firewalls are in use, and dozens of other

characteristics. While Nmap is commonly used for security audits, many

systems and network administrators find it useful for routine tasks

such as network inventory, managing service upgrade schedules, and

monitoring host or service uptime.

The output from Nmap is a list of scanned targets, with supplemental

information on each depending on the options used. Key among that

information is the “interesting ports table”. That table lists the

port number and protocol, service name, and state. The state is either

open, filtered, closed, or unfiltered. Open means that an application

on the target machine is listening for connections/packets on that

port. Filtered means that a firewall, filter, or other network

obstacle is blocking the port so that Nmap cannot tell whether it is

open or closed. Closed ports have no application listening on them,

though they could open up at any time. Ports are classified as

unfiltered when they are responsive to Nmap’s probes, but Nmap cannot

determine whether they are open or closed. Nmap reports the state

combinations open|filtered and closed|filtered when it cannot determine

which of the two states describe a port. The port table may also

include software version details when version detection has been

requested. When an IP protocol scan is requested (-sO), Nmap provides

information on supported IP protocols rather than listening ports.

In addition to the interesting ports table, Nmap can provide further

information on targets, including reverse DNS names, operating system

guesses, device types, and MAC addresses.

A typical Nmap scan is shown in Example 1. The only Nmap arguments used

in this example are -A, to enable OS and version detection, script

scanning, and trace-route; -T4 for faster execution; and then the

hostname.