Nmap (Network Mapper) is a free, open-source network scanner used to discover hosts and services on a computer network. It sends specially crafted packets to target hosts and analyses the responses to map live systems, open TCP and UDP ports, running services, software versions and, with OS fingerprinting, the likely operating system. It is a standard first step in network reconnaissance and security auditing.
Last updated: 6 August 2026
Security teams use Nmap to inventory what is exposed on a network: which hosts are up, which ports are open, and what is listening on them. A pentester runs it early to find an SSH service on 22, a web server on 80/443, or an unexpected database on 3306. Its NSE scripting engine extends it to version detection, misconfiguration checks and specific vulnerability probes. Sysadmins also use it to audit their own firewalls and confirm services are not unexpectedly reachable.
Linux · Windows · macOS · BSD
Open source (Nmap Public Source License, based on GPLv2)
nmap 192.168.1.0/24Ping-scan an entire subnet to list which hosts are up.
nmap -sV -sC 10.10.10.5Detect service versions and run the default NSE script set against a host.
nmap -p- 10.10.10.5Scan all 65535 TCP ports instead of the default top 1000.
nmap -A -T4 target.tldAggressive scan: OS detection, version detection, scripts and traceroute at faster timing.
nmap -sn 192.168.1.0/24Host discovery only (no port scan) to map live devices quickly.
nmap -sU --top-ports 20 10.10.10.5Scan the 20 most common UDP ports (UDP is slow, so limit the range).
nmap --script vuln 10.10.10.5Run the NSE vulnerability-detection script category against a target.
Scan only networks and hosts you own or have explicit written permission to test. In India, port-scanning or probing systems you do not own can be treated as unauthorised access under Section 43 and Section 66 of the IT Act 2000. Even a bare port scan of a third party can trigger abuse complaints. Keep scope and authorisation in writing.
Nmap infers state from responses, so firewalls, rate-limiting and filtered ports can produce misleading or incomplete results. OS and version detection are best-effort guesses, not proof. Aggressive scans are noisy and easily logged by IDS. It maps exposure but does not itself exploit anything.
| Tool | Pick it when |
|---|---|
| Masscan | You need to scan huge address ranges or the whole internet at very high packet rates. |
| RustScan | You want to find open ports extremely fast and then hand them to Nmap for detail. |
| Angry IP Scanner | You want a simple, GUI host/port sweep on a local network. |
| Zenmap | You want Nmap itself with a graphical front end and saved scan profiles. |
| Naabu | You want a fast, scriptable port scanner that fits into automated recon pipelines. |
Ethical Hacking Course (6 months) — reconnaissance and scanning module
We are not affiliated with, endorsed by, or a reseller for the vendors of any tool on this site.
Free counselling call. We will tell you honestly whether a full course is worth it for what you actually want to do.
Call +91 75175 72000