Nmap

Nmap, short for Network Mapper, is an open source tool used to explore and map computer networks, and to discover the devices and services present on them.

Written by Gordon Lyon, also known as Fyodor, and released in 1997, it is used by system administrators, security researchers and testers alike to understand what a network actually exposes.

It has been in continuous development ever since, which is part of why it is still the default answer to the question of what is running on this network.

What it does

Port scanning. It determines which ports on a target are open, closed or filtered, which is the first thing anybody needs to know about a host, on either side of an engagement.

Service detection. It identifies the services and applications behind those ports, including software versions, which is what connects a host to a publicly known vulnerability.

Operating system detection. By comparing how a host responds against a database of known behaviours, it infers the operating system. This is fingerprinting, and it works because implementations differ in details nobody chose to publish.

Scan tuning. It offers a wide range of scan types and timing options, from slow and quiet to fast and loud, including the SYN scan that does not complete the TCP handshake.

A worked example

An administrator wants to know what their own infrastructure exposes.

They run a SYN scan across an internal range, at an aggressive timing template, covering the full port range:

nmap -sS -T4 -p 1-65535 192.168.1.0/24

What comes back is a list of the hosts found, the ports open on each, and the services detected behind them. What makes it useful is comparing that list with the list of what was supposed to be there, because the interesting entries are always the ones nobody expected.

Two things worth being explicit about

The first is legal and contractual. Scanning a network you do not own or have not been authorised to test is not a neutral act, and the fact that a scan is passive from the operator’s point of view does not make it invisible: it appears in the target’s logs and it generates alerts. On a legitimate engagement, what makes it acceptable is written authorisation and an agreed scope, which is what rules of engagement are for.

The second is about what the results mean. A port scan is a snapshot of one moment from one vantage point. Firewalls, load balancers and cloud security groups make the same host look different depending on where the scan came from, and a filtered port is not the same as a closed one. Reading a scan as if it were a complete inventory is a mistake; treating it as one input into attack surface management is not.

Where to read more

nmap.org: the official site and the reference documentation, including the full option list and the scripting engine.

Nmap Network Scanning, by Gordon Lyon: the book, covering everything from the basics through to advanced scanning technique.