Nmap fundamentals
Who is on the network and which ports are open?
Level 101 · 16 lessons · 18 practice labs
Lessons
Meeting Nmap
- Nmap install and first scan: You will install nmap, run your first scan on your own lab network, and learn to read what the output means.
- Nmap help and command syntax: --help and the man page: You will recognise the parts of an Nmap command and look up any unfamiliar option in --help and the man page.
- Nmap verbosity: -v, --reason and --packet-trace: You will read from Nmap’s verbosity and --reason output why a port was reported open or filtered.
- Nmap targets: name, range, CIDR, file, exclusion: You will learn to give Nmap its scan targets by name, address range, CIDR notation or file, and to exclude machines you are not allowed to scan.
- Permission to scan: your own network, the lab and written approval
- Short task: run your first scan on the lab network and read the output
Ports and protocols
- Nmap port states: open, closed, filtered: You will tell apart the open, closed and filtered (blocked by a firewall) ports that Nmap reports, and understand what each state says from a defender's view.
- The TCP handshake and Nmap SYN scans: You will understand how a TCP connection is set up (the handshake), how an Nmap SYN scan uses it, and how it appears to a defender in logs.
- Nmap UDP scans: You will learn why Nmap finds UDP services slower and harder to scan, and how to check UDP services such as DNS on your own network.
- Short task: explain the port states of three targets
Identifying and recording
- Nmap service and version detection: You will understand how nmap identifies the service and version behind a port, and why the results should be compared against your inventory.
- Nmap OS detection: You will learn what traces let Nmap guess a machine's operating system, how reliable that guess is, and how it helps you spot unexpected systems.
- Basic Nmap NSE scripts: You will use nmap's built-in script engine (NSE) to check your own lab systems for common misconfigurations and interpret the findings.
- Nmap output formats: You will learn to save Nmap scan results in normal, XML and machine-readable formats, and which format suits which job.
- Processing Nmap output with grep and awk: You will learn to pull only the needed lines and columns out of large Nmap results with grep and awk and produce a short list.
- Capstone: scan an office network and report with Nmap: You will scan a fictional company's office network with Nmap within agreed scope, list the open services, and write a short report recommending which to close.
Practice labs
- Run your first scan and explain every line of the output: Scan the single server in Mavikaya Lojistik's lab network and write up the host, port and service lines of the output in your own words.
- Prove the reason behind every port verdict in the scan: Run a verbose scan with reasons against Tarçınlı Fırın's server and record why each port shows its state, quoting the evidence line.
- Find the gap between the scan and the documented service list: Compare Gelincik Okulları's documented service list with your own scan, find the undocumented service and add it to the inventory.
- Scan the approved target list from a file: Put the addresses from the scope document into a target file, scan only that list and show no out-of-scope address appears in the results.
- Scan a subnet without touching the excluded production servers: Scan Ayçiçeği Gıda's subnet while excluding the two production servers named in the rules of engagement, and verify from the log that no packets reached them.
- Fix a scan command that drifts out of scope: Detect that a teammate's CIDR and range expressions exceed the scope, fix the command and write the reasoning into the scope note.
- Classify the port states of three targets: Separate open, closed and filtered ports on three lab targets and prepare a short table explaining each state.
- Compare a half-open scan with a full connect scan: Scan the same server with both scan types, determine which leaves a trace in the server log and record the difference in a finding note.
- Prove which firewall rule causes a filtered port: Examine the ports that appear filtered on Kumsal Turizm's server with packet traces, find the responsible rule and mark it in the rule table.
- Add the server's UDP services to the inventory: Scan the most common UDP ports on the lab server and record the open DNS and NTP services in the inventory table.
- Resolve UDP ports that are open-or-filtered: Run a second scan with version detection on the ambiguous UDP ports and prove which ones are actually open.
- Find and close a forgotten UDP management service: Find an undocumented UDP management service on Ilgıntepe Tekstil's server, disable it and rescan to verify it is closed.
- Build a service and version table for the open ports: Run version detection on the lab server and record the service name and version for each open port in a table.
- Confirm or refute the OS guess: Compare the OS guesses for two targets with the real information on the hosts and note the confidence and any mismatch.
- Find an outdated service, update it and re-verify: Spot the service running an unsupported version on Narçiçeği Eczaneleri's server, apply the update and confirm the new version with a scan.
- Save a scan in three formats and pick the right one: Save the same scan in normal, grepable and XML format and justify which one to use for reporting and automation.
- Filter an open-port list out of scan output: Process grepable output with grep and awk and turn it into a one-line-per-host table of open ports.
- Scan an office network and write a one-page report: Scan Sedirli Hukuk Bürosu's lab network, rank the unnecessary open services and prepare a one-page report with closing recommendations.
About this course
Who is on the network and which ports are open?
What you will learn
- Meeting Nmap
- Ports and protocols
- Identifying and recording
Prerequisites
No prior knowledge is needed; the course starts from zero.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at beginner level; every term is explained where it first appears.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.