Skip to content
HackIndex logo

HackIndex

Port Scanning with Nmap

4 min read Mar 16, 2026

Port scanning identifies which TCP and UDP ports are open on a target host. Open ports indicate running services — each one is a potential attack surface. The output feeds directly into service-specific enumeration and vulnerability discovery.

Run host discovery first to confirm the target is alive before port scanning. See ICMP Host Discovery and Ping Sweeps.

Fast Initial Scan

Start with a fast scan of the most common ports to get immediate results:

┌──(kali㉿kali)-[~]
└─$ nmap -T4 -F $TARGET_IP

-F scans the top 100 ports. -T4 increases timing for faster results on a reliable network. This gives you something to work with in under 30 seconds while a full scan runs in the background.

Full TCP Port Scan

Scan all 65535 ports to avoid missing services on non-standard ports:

┌──(kali㉿kali)-[~]
└─$ nmap -p- --min-rate 5000 -T4 $TARGET_IP

--min-rate 5000 pushes nmap to send at least 5000 packets per second. Adjust down on unstable or rate-limited networks. This is the scan to run on every target — services on high ports are missed by default scans constantly.

TCP SYN Scan

The default and most reliable scan type. Sends a SYN packet and records the response without completing the handshake:

┌──(kali㉿kali)-[~]
└─$ nmap -sS -p- $TARGET_IP

Requires root. Without root, nmap falls back to a TCP connect scan (-sT) which completes the full handshake and is slightly louder.

Service Version Detection

Once you have a list of open ports, run version detection against them:

┌──(kali㉿kali)-[~]
└─$ nmap -sV -p $PORT,$PORT,$PORT $TARGET_IP 
PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.11
80/tcp   open  http    Apache httpd 2.4.41
3306/tcp open  mysql   MySQL 5.7.42

Version information feeds directly into CVE matching and service-specific enumeration. Always run -sV on confirmed open ports before moving on.

OS Detection

┌──(kali㉿kali)-[~]
└─$ nmap -O $TARGET_IP

Requires root. nmap fingerprints the OS based on TCP/IP stack behaviour. The result is a best-guess with a confidence percentage — treat it as directional, not definitive.

Combined version and OS detection:

┌──(kali㉿kali)-[~]
└─$ nmap -sV -O $TARGET_IP

Combined Scan — Open Ports Then Deep Scan

A reliable two-phase approach: fast full port scan first, then detailed scan on confirmed open ports only.

┌──(kali㉿kali)-[~]
└─$ nmap -p- --min-rate 5000 -T4 $TARGET_IP -oG /tmp/ports.txt
┌──(kali㉿kali)-[~]
└─$ ports=$(grep -oP '\d+/open' /tmp/ports.txt | cut -d/ -f1 | tr '\n' ',')
┌──(kali㉿kali)-[~]
└─$ nmap -sV -sC -O -p $ports $TARGET_IP

-sC runs the default NSE scripts against detected services. This combination gives full coverage without wasting time running scripts against every port.

UDP Scanning

UDP services are missed by all TCP scans. Common high-value UDP ports worth checking explicitly:

┌──(kali㉿kali)-[~]
└─$ nmap -sU -p 53,67,68,69,111,123,161,162,500,514,623,1194 $TARGET_IP

Full UDP scans are slow — each closed port waits for an ICMP port unreachable response with a default timeout. Target specific ports unless you have time for a full sweep.

Saving Output

Always save scan output. Grepable format is easiest to parse:

┌──(kali㉿kali)-[~]
└─$ nmap -p- --min-rate 5000 $TARGET_IP -oA /tmp/nmap_full

-oA saves three formats simultaneously: normal (.nmap), grepable (.gnmap), and XML (.xml). The XML output is compatible with tools like Metasploit and searchsploit.

Scanning Multiple Hosts

Pass a file of targets:

┌──(kali㉿kali)-[~]
└─$ nmap -iL /tmp/hosts.txt -p- --min-rate 5000 -oA /tmp/nmap_sweep

Or scan an entire subnet:

┌──(kali㉿kali)-[~]
└─$ nmap -p- --min-rate 5000 $TARGET_IP/24 -oA /tmp/nmap_subnet

Reading Results

Open ports are the primary output. For each open port:

  • Note the port number and service name

  • Check the version string for specific software and version

  • Match against service-specific enumeration pages for next steps

  • High ports (above 1024) with unfamiliar services are worth investigating first — they are most likely to be custom or misconfigured applications

Filtered ports mean a firewall is blocking the probe but the host may still be running a service there. Try from a different source address or use a different probe type if filtered ports are significant.

References