Nmap: host discovery and port scanning
Scan types, timing and stealth, reading the results.
Level 201 · 17 lessons · 18 practice labs
Lessons
Finding live hosts
- Finding the live devices on your own network with Nmap: On your own lab network you learn to find out with nmap which devices are up and why a network inventory matters.
- Nmap: discovery with ARP and ICMP: You will understand how Nmap discovers devices on a local network with ARP and ICMP, and how it looks from the defender's side.
- Host discovery with Nmap when ICMP is blocked: TCP/UDP probes and -Pn: You will find your own live devices that do not answer ping by using TCP and UDP probes in Nmap.
- Host discovery on an IPv6 network
- Short task: find the live hosts on a subnet where ICMP is blocked
Port scanning
- Nmap TCP connect and SYN scans: You will understand the difference between Nmap's TCP connect and SYN scans, what traces they leave on your own system, and how they show in logs.
- Nmap UDP port scanning: You learn why Nmap checks UDP ports more slowly and with more difficulty, and how to audit which UDP services are left open on your own servers.
- Interpreting Nmap port states: You will understand what nmap's open, closed and filtered port states mean and what you can conclude from a result.
- Nmap port lists, ranges and the most common ports: You learn to choose which ports Nmap checks as a list, a range or the most common ones, and to set a scope suited to your own audit.
- Nmap timing templates and parallelism: You learn how Nmap's scan speed settings change the load on the network and servers, and how to scan your own systems without causing harm.
- Reading how a firewall shapes the scan result
- Short task: work out which rule causes the filtered ports
Inventory
- Parsing Nmap output: normal, grepable, XML: You learn to save nmap results as normal, grep-friendly and XML output and to process them with scripts.
- Building a subnet inventory with Nmap: You learn to use Nmap to build a tidy inventory of all devices and open ports on your own subnet and to spot anything unexpected.
- Managing a large Nmap scope: target order, chunking and resuming: You learn to scan a large target list safely by ordering it, splitting it into chunks and resuming an interrupted scan.
- Comparing two scans: changes with ndiff
- Capstone: a corporate network inventory and open-port report with Nmap: With permission, you scan a fictional company's lab network with Nmap and write a short report showing the device inventory and unnecessary open ports.
Practice labs
- Inventory live devices on the local network with ARP: Run ARP-based discovery on the lab LAN and record each device found with its address, hardware address and vendor.
- Find live hosts in a subnet where ICMP is blocked: Find live hosts in Pusulaya Sigorta's ICMP-blocking subnet with TCP and UDP probes and report the difference from plain ping results.
- Find the server that hides from discovery and inventory it: Reveal a server that the default discovery misses using different probe types, explain why and add it to the inventory.
- List IPv6 neighbours and match them to the inventory: Find the IPv6 link-local addresses in the lab network and match each to a device in the IPv4 inventory.
- Find a service exposed only over IPv6: Scan Göktaşı Yazılım's server over IPv4 and IPv6 separately, detect the service open only over IPv6 and write it up as a finding.
- Close an IPv6 firewall gap and re-verify: Add the missing rules on a server whose IPv4 rules were never mirrored to IPv6 and verify the same port view over both protocols with a scan.
- Compare a top-ports scan with a full port scan: Scan the same target with the top thousand ports and with all ports, and note the service that only the full scan finds.
- Inventory a management service hidden on a high port: Find the management interface running on a non-standard port on Akçakavak Lojistik's server, identify its version and notify its owner.
- Merge TCP and UDP results into one port map: Run TCP and UDP scans on a three-server lab network and merge them into a map that separates approved and unapproved ports per server.
- Tune scan speed to the network policy: Choose timing settings that respect the packets-per-second limit in the rules of engagement and show from the log that the scan stays within it.
- Resume an interrupted wide scan where it left off: Resume the interrupted scan of Karaçam Mobilya's wide address range and verify against the target list that no subnet was skipped.
- Prepare a scan plan that splits a large scope into batches: Write a plan setting target order, batch size and rate limit for Selvikent Belediyesi's six subnets, and run the first batch.
- Produce a subnet inventory from XML output: Parse the scan XML into a CSV inventory with address, open port and service columns for each host.
- Assign an owner to every device in the inventory: Join Lodoskaya Denizcilik's subnet inventory with the owner list and report the ownerless devices in a separate table.
- Prepare the corporate open-port report: Inventory Erguvan Sigorta's two subnets, rank the open ports that break policy and write a report naming who must fix each.
- Find the port that opened between two scans: Compare yesterday's and today's scan XMLs with ndiff and log the newly opened port as a change.
- Find the device that joined the network and check its approval: Identify the new device from the difference of two weekly scans, check it against the change requests and open a finding if unapproved.
- Prove closure with a post-fix scan: Three open ports from Çamlıbel Su İdaresi's report are said to be closed; rescan, produce the diff and write back the one that is still open.
About this course
Scan types, timing and stealth, reading the results.
What you will learn
- Finding live hosts
- Port scanning
- Inventory
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.