What is nmap?
Nmap (Network Mapper) is the industry-standard command-line tool for network discovery and security auditing in Linux. System administrators and security professionals use it to scan IP addresses and identify exactly which ports are open, what services are running on those ports, and which operating systems are active on the network.
If you have just set up a new Linux server or are diagnosing firewall issues, running an nmap scan is the fastest way to verify that your services (like SSH, HTTP, or MySQL) are properly exposed or safely hidden.
Step 1: Install nmap
Nmap is not usually installed by default, but it is available in all major repositories.
On Debian, Ubuntu, or Linux Mint:
sudo apt update && sudo apt install nmap
On RHEL, CentOS, or Fedora:
sudo dnf install nmap
Step 2: Scan a Single IP Address
The most basic usage of nmap is to scan a single target to see which of the 1,000 most common ports are open. You can scan an IP address or a hostname.
nmap 192.168.1.50
The output will display a table showing the PORT number, its STATE (open, closed, or filtered), and the SERVICE associated with it.
Note: A port listed as “filtered” means a firewall (like UFW or iptables) is blocking nmap from determining if the port is open or closed.
Step 3: Scan Specific Ports
By default, nmap scans the top 1,000 ports. If you want to check a specific port, such as checking if a web server is running on port 80, use the -p flag.
nmap -p 80 192.168.1.50
You can also scan a range of ports, or a comma-separated list of ports:
nmap -p 22,80,443 192.168.1.50
nmap -p 1-1000 192.168.1.50
If you want to perform a comprehensive scan of all 65,535 possible ports (which will take significantly longer), use a hyphen:
nmap -p- 192.168.1.50
Step 4: Detect Service Versions
Knowing that port 22 is open is helpful, but knowing exactly which version of OpenSSH is running is crucial for security patching. By using the -sV flag, nmap will interrogate the open ports to determine the exact software versions.
nmap -sV 192.168.1.50
The output will add a VERSION column, displaying details like OpenSSH 8.2p1 Ubuntu 4ubuntu0.1 or Apache httpd 2.4.41.
Step 5: Scan an Entire Subnet
If you need to map out your entire local network to find connected devices, you can provide nmap with a CIDR block.
nmap 192.168.1.0/24
This command will scan all 254 usable IP addresses in that subnet. However, doing a full port scan on 254 devices is slow and noisy. If you only want to know which IP addresses are online (without checking their ports), perform a “ping scan” using the -sn flag:
nmap -sn 192.168.1.0/24
Important Legal and Ethical Warning
Nmap is a powerful tool. Scanning your own local network or servers you have explicit permission to audit is completely legal and encouraged. However, using nmap to scan external IP addresses, public servers, or corporate networks that you do not own is generally considered hostile activity and can result in your IP being blacklisted by ISPs or lead to legal consequences.