Nmap Port Scanning for Beginners: Practical Guide with Real Outputs

When you first open a terminal and decide to learn network security, Nmap is almost always the first tool people tell you to install. But most tutorials dump thirty command-line flags on you at once, without explaining what actually happens across the wire when you hit Enter.

In this guide, we will step through how Nmap actually talks to a target machine, the four scan flags you will use 90% of the time, and how to read the terminal output so you know what services are running.

1. The First Test: Scanning an Authorized Target

If you do not have a home lab running yet, the creators of Nmap maintain an official server specifically for testing scans. You can point your terminal at scanme.nmap.org without getting in trouble.

Here is the most basic scan you can run:

nmap scanme.nmap.org

When you run this bare command, Nmap scans the top 1,000 most common TCP ports. It does not scan all 65,535 ports by default because scanning every single port on a remote server would take several minutes.

2. Understanding the Output States

Once the scan completes, you will see a small table in your terminal. Here is what an actual result looks like:

PORT    STATE SERVICE
22/tcp  open  ssh
80/tcp  open  http
9929/tcp open  nping-echo

Each port will report one of three main states:

• open: An application on the target machine is actively listening for incoming connections on that port (like a web server on port 80).
• closed: The target received our probe packet, but no service is listening on that port. It sends back a quick reset packet to tell us nothing is there.
• filtered: A firewall or packet filter blocked our packet or dropped the response. Nmap cannot tell if the port is open or closed because no answer ever came back.

3. Finding Live Hosts on Your Local Network (-sn)

Before you scan ports on an entire subnet, you should first check which IP addresses are actually powered on. Scanning ports on fifty offline machines will waste huge amounts of time waiting for timeouts.

Use the -sn flag (historically known as a ping sweep) to check for responsive hosts without touching their ports:

sudo nmap -sn 192.168.1.0/24

In less than ten seconds, Nmap will return a clean list of every active phone, laptop, and smart TV on your local network along with their MAC addresses and hardware vendors.

4. The SYN Stealth Scan (-sS) vs Normal Scan (-sT)

If you run Nmap without root privileges, your operating system forces Nmap to perform a full TCP connect scan (-sT). That means your computer completes the full three-way handshake: it sends a SYN, receives a SYN-ACK, and sends an ACK. This establishes a real connection that gets logged by most web applications.

When you run Nmap with sudo, it defaults to the SYN Stealth scan (-sS):

sudo nmap -sS 192.168.1.50

In a SYN scan, Nmap sends the initial probe (SYN), waits for the target to say "Yes, I am open" (SYN-ACK), and then immediately sends back a reset packet (RST) instead of completing the connection. The target port is verified as open, but the connection was never finalized, keeping it out of many basic application logs.

5. Detecting Exact Service Versions (-sV)

Knowing port 80 is open only tells you there is a web server. But is it running Apache 2.4.41? Nginx 1.18? Or an outdated Python web script from 2018?

Add the -sV flag to inspect service banners and find the exact software version:

sudo nmap -sV -p 22,80,443 192.168.1.50

Nmap will send custom banner probes to those specific ports and report the exact daemon name, such as OpenSSH 8.9p1 Ubuntu or Apache httpd 2.4.52. This is where security auditors find out if software needs to be patched against known vulnerabilities.

6. The Everyday Workhorse Command

When you are practicing on a HackTheBox machine or auditing your own test server, here is the balanced command string used by real practitioners:

sudo nmap -sC -sV -T4 192.168.1.50 -oN initial_scan.txt

Here is what each flag does:

• -sC: Runs the default set of safe, non-destructive Nmap scripts to gather useful headers and TLS certificate details.
• -sV: Extracts service version numbers.
• -T4: Sets the timing speed to aggressive so you do not wait all afternoon on a fast, reliable local network.
• -oN initial_scan.txt: Saves the output directly into a clean text file so you never lose your findings when you close your terminal window.

7. Scanning All 65,535 Ports (-p-)

Remember that standard scans only inspect the top 1,000 ports. Administrators frequently move SSH from port 22 to port 2222, or run development dashboards on port 8080 or port 9000.

To make sure you never miss a hidden service, run a full sweep across all ports:

sudo nmap -p- -T4 192.168.1.50

Quick Reference Cheatsheet

• nmap target: Quick scan of the top 1,000 TCP ports.
• sudo nmap -sn 192.168.1.0/24: Find all active devices on your local network.
• sudo nmap -sS target: Fast, half-open SYN stealth scan.
• nmap -p 80,443,8080 target: Scan only specific ports.
• nmap -sV -p 80 target: Identify exact service and version numbers.
• nmap -oN results.txt target: Save output to a readable text file.

Summary

Network scanning is not about memorizing fifty obscure flags. It is about working in a sensible order: find out who is online first, check which ports are listening, pull the exact service versions, and save your notes in a file.

Try running your first ping sweep on your home router today, or test against scanme.nmap.org. If you run into any weird port states or timeout errors, feel free to drop a message to our community page!