How to scan network with nmap on Linux
How to Scan Network with Nmap on Linux
Network mapping and security auditing are essential skills for system administrators, security professionals, and network engineers. Nmap (Network Mapper) is one of the most powerful and versatile network scanning tools available for Linux systems. This comprehensive guide will teach you everything you need to know about using nmap to scan networks effectively and responsibly.
Table of Contents
1. [Introduction to Nmap](#introduction-to-nmap)
2. [Prerequisites and Installation](#prerequisites-and-installation)
3. [Basic Nmap Concepts](#basic-nmap-concepts)
4. [Essential Nmap Commands](#essential-nmap-commands)
5. [Advanced Scanning Techniques](#advanced-scanning-techniques)
6. [Practical Examples and Use Cases](#practical-examples-and-use-cases)
7. [Output Formats and Analysis](#output-formats-and-analysis)
8. [Security Considerations](#security-considerations)
9. [Troubleshooting Common Issues](#troubleshooting-common-issues)
10. [Best Practices and Tips](#best-practices-and-tips)
11. [Conclusion](#conclusion)
Introduction to Nmap
Nmap is a free and open-source network discovery and security auditing tool that has become the de facto standard for network reconnaissance. Originally written by Gordon Lyon (Fyodor), nmap can discover hosts and services on a computer network by sending packets and analyzing the responses.
What Nmap Can Do
- Host Discovery: Identify active devices on a network
- Port Scanning: Determine which ports are open, closed, or filtered
- Service Detection: Identify running services and their versions
- Operating System Detection: Fingerprint target operating systems
- Vulnerability Assessment: Use NSE scripts to detect security issues
- Network Mapping: Create detailed network topology maps
Legal and Ethical Considerations
Before diving into technical details, it's crucial to understand that network scanning should only be performed on networks you own or have explicit permission to test. Unauthorized network scanning can be illegal and may violate computer crime laws in many jurisdictions.
Prerequisites and Installation
System Requirements
- Linux operating system (Ubuntu, CentOS, Debian, Fedora, etc.)
- Root or sudo privileges for certain scan types
- Basic understanding of networking concepts (IP addresses, ports, protocols)
- Command line familiarity
Installing Nmap
Ubuntu/Debian Systems
```bash
sudo apt update
sudo apt install nmap
```
CentOS/RHEL/Fedora Systems
```bash
CentOS/RHEL
sudo yum install nmap
Fedora
sudo dnf install nmap
```
Arch Linux
```bash
sudo pacman -S nmap
```
Compiling from Source
For the latest features, you can compile nmap from source:
```bash
wget https://nmap.org/dist/nmap-7.94.tar.bz2
tar -xjf nmap-7.94.tar.bz2
cd nmap-7.94
./configure
make
sudo make install
```
Verifying Installation
After installation, verify nmap is working correctly:
```bash
nmap --version
```
This should display version information and available features.
Basic Nmap Concepts
Target Specification
Nmap accepts various target formats:
- Single IP: `192.168.1.100`
- IP Range: `192.168.1.1-254`
- CIDR Notation: `192.168.1.0/24`
- Hostname: `example.com`
- Multiple Targets: `192.168.1.1 192.168.1.5 example.com`
Port States
Nmap categorizes ports into six states:
1. Open: Service is actively accepting connections
2. Closed: Port is accessible but no service is listening
3. Filtered: Firewall or filter is blocking access
4. Unfiltered: Port is accessible but state cannot be determined
5. Open|Filtered: Cannot determine if port is open or filtered
6. Closed|Filtered: Cannot determine if port is closed or filtered
Scan Types
Different scan types use various TCP/UDP packet combinations:
- TCP SYN Scan (-sS): Default scan, stealthy and fast
- TCP Connect Scan (-sT): Complete TCP connection
- UDP Scan (-sU): Scans UDP ports
- TCP ACK Scan (-sA): Determines firewall rules
- TCP Window Scan (-sW): Similar to ACK scan with window size analysis
Essential Nmap Commands
Basic Host Discovery
Ping Scan
Discover active hosts without port scanning:
```bash
nmap -sn 192.168.1.0/24
```
This performs a "ping sweep" to identify live hosts on the network.
Skip Host Discovery
Force scanning even if hosts appear down:
```bash
nmap -Pn 192.168.1.100
```
Basic Port Scanning
Default Scan
Scan the most common 1,000 ports:
```bash
nmap 192.168.1.100
```
Scan Specific Ports
```bash
Single port
nmap -p 80 192.168.1.100
Multiple ports
nmap -p 22,80,443 192.168.1.100
Port range
nmap -p 1-1000 192.168.1.100
All ports
nmap -p- 192.168.1.100
```
Fast Scan
Scan only the top 100 most common ports:
```bash
nmap -F 192.168.1.100
```
Service and Version Detection
Service Detection
Identify services running on open ports:
```bash
nmap -sV 192.168.1.100
```
Aggressive Service Detection
More thorough service detection:
```bash
nmap -sV --version-intensity 9 192.168.1.100
```
Operating System Detection
Attempt to identify the target's operating system:
```bash
nmap -O 192.168.1.100
```
Comprehensive Scan
Combine multiple scan types for thorough reconnaissance:
```bash
nmap -A 192.168.1.100
```
This enables OS detection, version detection, script scanning, and traceroute.
Advanced Scanning Techniques
Stealth Scanning
SYN Stealth Scan
The default scan type, less likely to be logged:
```bash
nmap -sS 192.168.1.100
```
FIN Scan
Send FIN packets to evade simple firewalls:
```bash
nmap -sF 192.168.1.100
```
Null Scan
Send packets with no flags set:
```bash
nmap -sN 192.168.1.100
```
Xmas Scan
Send packets with FIN, PSH, and URG flags:
```bash
nmap -sX 192.168.1.100
```
Timing and Performance
Nmap offers six timing templates (0-5):
```bash
Paranoid - Very slow, evades IDS
nmap -T0 192.168.1.100
Sneaky - Slow, evades IDS
nmap -T1 192.168.1.100
Polite - Slower, less bandwidth
nmap -T2 192.168.1.100
Normal - Default timing
nmap -T3 192.168.1.100
Aggressive - Faster, assumes fast network
nmap -T4 192.168.1.100
Insane - Very fast, may miss results
nmap -T5 192.168.1.100
```
Custom Timing Controls
For fine-tuned control over scan timing:
```bash
nmap --min-rate 1000 --max-rate 5000 192.168.1.100
nmap --min-parallelism 10 --max-parallelism 100 192.168.1.100
```
Firewall Evasion
Fragment Packets
Break packets into small fragments:
```bash
nmap -f 192.168.1.100
```
Decoy Scanning
Hide your IP among decoy addresses:
```bash
nmap -D 192.168.1.5,192.168.1.6,192.168.1.7,ME 192.168.1.100
```
Source Port Manipulation
Use a specific source port:
```bash
nmap --source-port 53 192.168.1.100
```
Idle Zombie Scan
Use an idle host as a proxy:
```bash
nmap -sI zombie_host 192.168.1.100
```
Practical Examples and Use Cases
Network Discovery Scenarios
Corporate Network Assessment
Discover all devices on a corporate subnet:
```bash
Quick host discovery
nmap -sn 10.0.0.0/16 > live_hosts.txt
Detailed scan of discovered hosts
nmap -A -T4 -iL live_hosts.txt -oA corporate_scan
```
Home Network Inventory
Map your home network devices:
```bash
Discover devices
nmap -sn 192.168.1.0/24
Identify device types and services
nmap -A -T4 192.168.1.0/24
```
Security Assessment Examples
Web Server Analysis
Comprehensive web server assessment:
```bash
Basic web service scan
nmap -p 80,443,8080,8443 -sV 192.168.1.100
Web vulnerability scripts
nmap --script http-* 192.168.1.100
SSL/TLS analysis
nmap --script ssl-* -p 443 192.168.1.100
```
Database Server Discovery
Find database servers on the network:
```bash
Common database ports
nmap -p 1433,1521,3306,5432,27017 -sV 192.168.1.0/24
Database-specific scripts
nmap --script mysql-* -p 3306 192.168.1.0/24
nmap --script oracle-* -p 1521 192.168.1.0/24
```
Mail Server Assessment
Examine mail server configurations:
```bash
Mail server ports
nmap -p 25,110,143,465,587,993,995 -sV mail.example.com
SMTP enumeration
nmap --script smtp-* -p 25 mail.example.com
IMAP/POP3 analysis
nmap --script imap-,pop3- mail.example.com
```
NSE (Nmap Scripting Engine) Usage
Script Categories
NSE scripts are organized into categories:
- auth: Authentication bypass scripts
- broadcast: Network broadcast discovery
- brute: Brute force attacks
- default: Default scripts run with -sC
- discovery: Network discovery
- dos: Denial of service scripts
- exploit: Exploit scripts
- external: Scripts requiring external resources
- fuzzer: Fuzzing scripts
- intrusive: Intrusive scripts
- malware: Malware detection
- safe: Safe scripts unlikely to cause problems
- version: Version detection enhancement
- vuln: Vulnerability detection
Common NSE Commands
```bash
Run default scripts
nmap -sC 192.168.1.100
Run specific script
nmap --script smb-vuln-ms17-010 192.168.1.100
Run script category
nmap --script vuln 192.168.1.100
Run multiple scripts
nmap --script "http-* and not http-brute" 192.168.1.100
Get script help
nmap --script-help smb-vuln-ms17-010
```
Vulnerability Scanning Examples
```bash
SMB vulnerabilities
nmap --script smb-vuln-* 192.168.1.100
Web application vulnerabilities
nmap --script http-vuln-* 192.168.1.100
SSL/TLS vulnerabilities
nmap --script ssl-enum-ciphers,ssl-heartbleed,ssl-poodle 192.168.1.100
```
Output Formats and Analysis
Output Options
Nmap supports multiple output formats:
Normal Output (-oN)
Human-readable format:
```bash
nmap -oN scan_results.txt 192.168.1.100
```
XML Output (-oX)
Machine-readable XML format:
```bash
nmap -oX scan_results.xml 192.168.1.100
```
Grepable Output (-oG)
Grep-friendly format:
```bash
nmap -oG scan_results.gnmap 192.168.1.100
```
All Formats (-oA)
Save in all three formats:
```bash
nmap -oA complete_scan 192.168.1.100
```
Analyzing Results
Extracting Information with Grep
```bash
Find open HTTP ports
grep "80/open" scan_results.gnmap
Extract IP addresses with open ports
grep "Up" scan_results.gnmap | cut -d' ' -f2
Find specific services
grep -i "apache" scan_results.txt
```
Using XML Output with Tools
Convert XML to HTML report:
```bash
xsltproc scan_results.xml -o scan_report.html
```
Security Considerations
Legal Compliance
- Only scan networks you own or have explicit permission to test
- Understand local and international laws regarding network scanning
- Document authorization before conducting scans
- Be aware that some scan types may trigger security alerts
Responsible Scanning Practices
Rate Limiting
Avoid overwhelming target systems:
```bash
Slow, polite scanning
nmap -T2 --max-rate 100 192.168.1.100
Add delays between probes
nmap --scan-delay 1s 192.168.1.100
```
Minimal Impact Scanning
Use less intrusive scan types when possible:
```bash
SYN scan instead of connect scan
nmap -sS 192.168.1.100
Avoid aggressive timing
nmap -T2 192.168.1.100
```
Avoiding Detection
Randomization
Randomize target and port order:
```bash
nmap --randomize-hosts -p- 192.168.1.0/24
```
Source IP Spoofing
Use decoys to mask your identity:
```bash
nmap -D RND:10 192.168.1.100
```
Troubleshooting Common Issues
Permission Issues
Problem: "Operation not permitted" errors
Solution: Many scan types require root privileges:
```bash
sudo nmap -sS 192.168.1.100
```
Problem: Cannot determine if host is up
Solution: Skip host discovery:
```bash
nmap -Pn 192.168.1.100
```
Network Connectivity Issues
Problem: No results from scan
Troubleshooting steps:
1. Verify network connectivity:
```bash
ping 192.168.1.100
```
2. Check routing:
```bash
traceroute 192.168.1.100
```
3. Try different scan types:
```bash
nmap -sT 192.168.1.100 # TCP connect scan
nmap -sU 192.168.1.100 # UDP scan
```
Performance Issues
Problem: Scans taking too long
Solutions:
1. Use faster timing:
```bash
nmap -T4 192.168.1.100
```
2. Limit port range:
```bash
nmap --top-ports 1000 192.168.1.100
```
3. Increase parallelism:
```bash
nmap --min-parallelism 100 192.168.1.100
```
Problem: Scans failing or incomplete
Solutions:
1. Reduce scan intensity:
```bash
nmap -T2 192.168.1.100
```
2. Add delays:
```bash
nmap --scan-delay 100ms 192.168.1.100
```
Firewall and Filtering Issues
Problem: All ports show as filtered
Solutions:
1. Try different scan types:
```bash
nmap -sF 192.168.1.100 # FIN scan
nmap -sA 192.168.1.100 # ACK scan
```
2. Use fragmentation:
```bash
nmap -f 192.168.1.100
```
3. Change source port:
```bash
nmap --source-port 53 192.168.1.100
```
Best Practices and Tips
Scanning Strategy
Phased Approach
1. Discovery Phase: Identify live hosts
```bash
nmap -sn 192.168.1.0/24
```
2. Port Scanning: Find open ports
```bash
nmap -sS -F target_list.txt
```
3. Service Detection: Identify services
```bash
nmap -sV -p port_list target_list.txt
```
4. Vulnerability Assessment: Run security scripts
```bash
nmap --script vuln target_list.txt
```
Documentation and Reporting
Comprehensive Documentation
Always document your scanning activities:
```bash
Include timestamp and purpose
echo "Scan started: $(date)" > scan_log.txt
echo "Purpose: Monthly security assessment" >> scan_log.txt
nmap -A -oA monthly_scan 192.168.1.0/24
```
Baseline Comparisons
Compare scans over time:
```bash
Create baseline
nmap -oX baseline.xml 192.168.1.0/24
Compare current scan
nmap -oX current.xml 192.168.1.0/24
ndiff baseline.xml current.xml
```
Automation and Scripting
Automated Scanning Scripts
Create scripts for regular assessments:
```bash
#!/bin/bash
network_scan.sh
DATE=$(date +%Y%m%d_%H%M%S)
NETWORK="192.168.1.0/24"
OUTPUT_DIR="/var/log/nmap"
mkdir -p $OUTPUT_DIR
Host discovery
nmap -sn $NETWORK > $OUTPUT_DIR/hosts_$DATE.txt
Port scan
nmap -sS -O -sV -oA $OUTPUT_DIR/portscan_$DATE $NETWORK
Vulnerability scan
nmap --script vuln -oA $OUTPUT_DIR/vulnscan_$DATE $NETWORK
echo "Scan completed: $DATE"
```
Integration with Other Tools
Combine nmap with other security tools:
```bash
Feed results to vulnerability scanners
nmap -oX scan.xml 192.168.1.0/24
Import scan.xml into OpenVAS, Nessus, etc.
Integration with Metasploit
nmap -oX msf_import.xml 192.168.1.0/24
Import into Metasploit workspace
```
Performance Optimization
Network-Specific Tuning
Adjust settings based on network characteristics:
```bash
Fast local network
nmap -T4 --min-rate 1000 192.168.1.0/24
Slow WAN connection
nmap -T2 --max-rate 100 remote_target.com
High-latency satellite link
nmap -T1 --initial-rtt-timeout 2s satellite_target.com
```
Resource Management
Monitor system resources during large scans:
```bash
Limit bandwidth usage
nmap --max-rate 50 large_network.com
Control memory usage
nmap --max-parallelism 10 large_network.com
```
Conclusion
Nmap is an incredibly powerful and versatile network scanning tool that every Linux administrator and security professional should master. This comprehensive guide has covered everything from basic installation and usage to advanced scanning techniques and security considerations.
Key Takeaways
1. Start Simple: Begin with basic scans and gradually incorporate advanced techniques
2. Stay Legal: Always ensure you have permission before scanning networks
3. Document Everything: Maintain detailed records of your scanning activities
4. Practice Regularly: Regular practice with different scenarios improves proficiency
5. Stay Updated: Keep nmap updated to access the latest features and security improvements
Next Steps
To further develop your nmap skills:
1. Explore NSE Scripts: Investigate the hundreds of available NSE scripts
2. Study Network Protocols: Deepen your understanding of TCP/IP, UDP, and other protocols
3. Practice on Test Networks: Set up lab environments for safe experimentation
4. Learn Complementary Tools: Explore tools like Masscan, Zmap, and Unicornscan
5. Contribute to the Community: Share scripts and techniques with the nmap community
Additional Resources
- Official Documentation: https://nmap.org/book/
- NSE Script Database: https://nmap.org/nsedoc/
- Community Forums: https://seclists.org/nmap-dev/
- Training Materials: Various online courses and certifications include nmap training
Remember that network scanning is a powerful capability that comes with significant responsibility. Always use these tools ethically and legally, respecting others' networks and privacy. With proper knowledge and responsible use, nmap becomes an invaluable tool for network security and administration.
By mastering the techniques outlined in this guide, you'll be well-equipped to perform comprehensive network assessments, identify security vulnerabilities, and maintain robust network security postures in your Linux environments.