How to Run a Quick Network Scan with Nmap

Network Mapper (Nmap) remains an essential open-source network discovery and security auditing tool 25 years after its inception. By sending carefully crafted packets and analyzing responses, Nmap allows administrators to rapidly inventory networked devices, identify listening services, and detect security issues.

This comprehensive guide will demonstrate the fundamentals of Nmap scanning techniques to empower IT professionals to safely and efficiently map their networks.

An Introduction to TCP/IP Basics

To understand how Nmap identifies devices and services, you must first grasp the layered TCP/IP model that defines modern networking.

TCP/IP provides end-to-end communication specifying how data should transmit between network hosts. This model contains four layers:

• Link Layer – Transmits binary data over physical mediums like Ethernet or WiFi using MAC addresses.
• Internet Layer – Routes data between networks using IP addresses.
• Transport Layer – Provides port numbers for establishing connections using TCP and UDP protocols.
• Application Layer – Defines high-level protocols like HTTP, SSH, FTP and more.

Nmap utilizes this stack by sending packets to the various layers and analyzing the responses. For example, it can send:

• ICMP echo request to ping the Internet layer and confirm an active host.
• TCP SYN packet to application ports to see if they connect.
• Custom protocol headers that should elicit certain replies.

Based on the replies to these crafted packets, Nmap deduces information about scanned devices. Next, we‘ll overview some fundamental Nmap scan types and usage examples.

Discovering Live Hosts on the Network

One of the most basic Nmap functions is locating live hosts by pinging across an IP range.

The command for simple host discovery is:

nmap -sn 192.168.1.0/24

• -sn disables port scanning and only pings hosts.
• 192.168.1.0/24 specifies the subnet range to scan.

Here is some sample output:

Starting Nmap 7.92 (https://nmap.org) 
Nmap scan report for 192.168.1.1
Host is up (0.0024s latency).
MAC Address: 02:01:0A:01:00:01 (Unknown)
Nmap scan report for 192.168.1.100  
Host is up (0.0030s latency).
MAC Address: 8A:92:2E:EA:00:18 (Custom)
Nmap done: 256 IP addresses (2 hosts up) scanned in 6.29 seconds

This host discovery scan located live devices at 192.168.1.1 and 192.168.1.100 by sending ICMP Echo Request packets and listening for replies.

Administrator tip: Use host discovery to quickly map your subnet by identifying active versus inactive IP addresses. Schedule routine discovery scans to detect new devices on your network.

Now that we can find live hosts, next we‘ll enumerate more details by probing open ports and services.

Enumerating Open Ports and Services

While host discovery provides a quick overview of live devices, administrators need deeper insight. Port scanning sends packets to well-known ports and protocols to determine available services on scanned systems.

For example, to scan a host‘s open TCP ports:

nmap 192.168.1.1

This performs a basic TCP connect scan to 1000 most popular ports. Any ports accepting connections may indicate an associated service running.

Starting Nmap 7.92 (https://nmap.org)
Nmap scan report for 192.168.1.1
Host is up (0.095s latency).
Not shown: 997 closed ports
PORT   STATE SERVICE
21/tcp open  ftp   
80/tcp open  http
443/tcp open https

Nmap done: 1 IP address (1 host up) scanned in 1.90 seconds

This reveals 192.168.1.1 has FTP on 21/tcp, HTTP on 80/tcp, and HTTPS on 443/tcp. Port scanning thus provides Administrators and penetration testers visibility into network assets and attack surface.

You can further enumerate versions and other details by specifying the -sV flag:

nmap -sV 192.168.1.1

This performs service detection by sending protocol-specific headers to elicit more details beyond open ports. Identifying exact versions empowers assessing vulnerabilities specific to dated software.

Speeding Up Scans for Rapid Discovery

While comprehensive scans provide useful detail, scanning entire subnets or ranges can take extensive time to fully complete.

Luckily, Nmap offers arguments for accelerating discovery by limiting host probing or only checking common targets.

Useful options include:

• -F: Fast scan checks only 100 popular ports.
• --min-rate <num>: Send packets no slower than per second.
• -T<0-5>: Set timing template from 0 (slow) to 5 (insane speed).
• -Pn: Skip host discovery and assume all hosts are up.

For example, to scan 1000 TCP ports rapidly:

nmap -T4 --top-ports 1000 192.168.1.0/24

And to check only 100 common ports on found hosts:

nmap -Pn -F 192.168.1.0/24

Tuning Nmap arguments allows you to tailor functionality for quick results when you prioritize speed over completeness.

Administrator tip: Scan your core network weekly with -F --min-rate 300 for speed. Then quarterly perform a -T4 --version-all -p- comprehensive scan to audit for gaps.

Saving Nmap Output for Documentation

Documenting findings remains crucial for administrators tracking assets and changes. Luckily, Nmap enables exporting results in standard formats.

Basic save options include:

• -oN: Saves scan in normal format.
• -oX: Saves scan in XML format.
• -oG: Saves in grepable format.
• -oA: Saves in all major formats.

For example, to export an XML and text file:

nmap 192.168.1.1 -oX scan.xml -oN scan.txt 

You can also specify a base filename prefix for automatic extensions:

nmap 192.168.1.1 -oA scan

This outputs scan.nmap, scan.xml and scan.gnmap for the script kiddie, XML parser, and grep fans respectively.

Documenting Nmap scans over time provides administrators visibility into network changes. For example, upon discovering "rogue" services, past scans prove precisely when they first appeared.

Auditing Security with Nmap Scripting Engine

While basic scanning reveals open ports and services, administrators need to audit configurations and find vulnerabilities. This is where Nmap Scripting Engine (NSE) comes in.

NSE scripts allow querying services for info, detecting security issues, and automating checks for compliance and hardening. With over 550 scripts bundled, NSE significantly extends Nmap capabilities.

Some examples include:

• Vuln scanning – Identifies issues like MS08-067, Heartbleed, and more.
• Version info – Queries services for detailed patch levels and configurations (e.g HTTP server headers).
• Authentication – Attempts logins with credentials or password lists via protocols. Useful for both pen testing and validating proper access controls.
• Policy compliance – Checks open ports/services against security standards like PCI-DSS or CIS benchmarks.
• Brute forcing – Tries username and password lists across services to identify weak credentials.

To leverage these scripts, use the --script option followed by a script name, category, expression or default for all scripts:

nmap --script default,safe 192.168.1.1

This executes all default and safe category scripts against the target host(s).

Specific useful checks include:

nmap -sV --script=banner,http-headers 192.168.1.1

This grabs verbose service banners and HTTP headers for profiling.

Combined with scheduling, NSE automates recurring security and policy checks to identify gaps before attackers do.

Scanning Responsibly for Admins and Pen Testers

Nmap provides penetration testers useful reconnaissance to identify company attack surface and vulnerabilities. Meanwhile, Net Admins leverage Nmap to harden assets based on findings.

However, scanning networks without permission remains illegal in most jurisdictions. So ensure you only scan hosts you own or have explicit approval for, such as signed penetration testing contracts.

In general:

• Get written permission – Only scan networks owned or contracted.
• Use least intrusive options – Prefer non-intrusive ping sweeps, version scans before attempting exploitation.
• Scan during maintenance windows – Avoid scanning production networks during peak hours when possible.
• Limit scan rates – Configure Nmap to match target capacity to avoid outages.
• Delete raw traffic captures after review – Only retain relevant extracted metadata.
• Disclose critical findings responsibly – Alert owners in a timely manner per agreements.

Following these ethical hacking principles applies equally to open-source tools like Nmap. Remember that with great power comes great responsibility.

Alternative Tools for Faster Scanning

While Nmap remains the industry standard all-in-one scanner, alternatives exist for specific use cases. When Nmap lacks speed or scalability for your goals, consider options like:

• Masscan – Scales using custom packet generation/handling to scan the entire public IPv4 Internet in under 6 minutes. However, lacks detailed service detection and NSE scripts. Mostly for sweeping enormous ranges to feed into other tools.
• ZMap – Designed for high-speed IPv4 network survey scanning by academics and researchers. Leverages stealthy probes but omit service/vuln detection.
• RustScan – Extremely quick port scanner for CIDR ranges written in Rust. Works as wrapper around Nmap or Masscan.

Understand these tools focus solely on Internet-scale host discovery and port surveys. For enumerating service details and assessing security posture, Nmap remains unmatched. Integrating other scanners that feed IPs into Nmap combines scalability with Nmap‘s finesse and scripts.

Limitations of Nmap Scanning

Despite Nmap‘s powerful capabilities, blind spots remain that could overlook assets or issues. Be aware that Nmap:

• Struggles enumerating IPv6 networks due to fragmentation handling limits.
• Won‘t identify NAT‘d or dual-homed devices with privately routed IPs.
• Misses devices not operational during brief scan windows.
• Cannot assess vulnerabilities lacking NSE scripts.
• Provides only point-in-time analysis, missing short-lived services.
• Faces difficulty accurately identifying rare proprietary services.

Integrating Nmap scanning into continuous monitoring supplements occasional overviews. Combine with vulnerability scanners, packet capture, endpoint management, and other tools to minimize blindspots.

For complex assessments, also consider commercial products like:

• Nessus
• Qualys
• Rapid7 InsightVM

These build on Nmap host/service discovery with expanded vulnerability checks, cyber exposure metrics, and full enterprise-class reporting.

Further Reading for Nmap Mastery

Hopefully this guide provided a practical introduction to utilizing Nmap for administering and securing networks. However, many more advanced options exist for exploiting the full Nmap potential.

Some recommended resources include:

• Nmap Network Scanning PDF by Nmap authors for comprehensive features overview
• Nmap Reference Guide for up-to-date usage details
• Nmap YouTube Channel covering scripting and case studies
• SANS SEC560 Course with dedicated Nmap section
• Black Hills Red Team Village for advanced workshops

With over 25 years of open-source development, Nmap growth shows no signs of slowing thanks to an enthusiastic community deploying it worldwide. Stay on top of modern Nmap advances to utilize the latest techniques for robust discovery, compliance checks, penetration testing or infrastructure management.

Conclusion

In closing, Nmap provides an essential free and open source utility for network discovery, security auditing, and administration via accurate host probing, service detection, and vulnerability scanning. Leverage it‘s simple but powerful options for enumerating networked assets and changes over time. Carefully and legally deploy Nmap for audits, pen tests, documentation, hardening and more.

With this comprehensive guide, IT professionals now understand how to productively utilize Nmap for critical scanning operations to reveal network devices, services, configurations and weaknesses − vital visibility enabling infrastructure management and security.