# Port Scanning with Nmap

> Discover live hosts, open ports, and running services using Nmap's scan techniques, flags, and output formats for effective network enumeration.

- **URL:** https://hackindex.io/services/hosts/enumeration/port-scanning
- **Path:** Hosts > Enumeration
- **Up:** [Enumeration](https://hackindex.io/services/hosts/enumeration.md)
- **Published:** 2026-03-16
- **Updated:** 2026-08-17

Port scanning identifies which TCP and UDP ports are open on a target host. Open ports indicate running services: each one is a potential attack surface. The output feeds directly into service-specific enumeration and vulnerability discovery.

Run host discovery first to confirm the target is alive before port scanning. See [ICMP Host Discovery and Ping Sweeps](https://hackindex.io/services/hosts/enumeration/icmp-host-discovery-and-ping-sweeps).

## Nmap port scanning: fast initial scan

Start with a fast scan of the most common ports to get immediate results:

```bash
nmap -T4 -F $TARGET_IP
```

`-F` scans the top 100 ports. `-T4` increases timing for faster results on a reliable network. This gives you something to work with in under 30 seconds while a full scan runs in the background.

## Full TCP Port Scan

Scan all 65535 ports to avoid missing services on non-standard ports:

```bash
nmap -p- --min-rate 5000 -T4 $TARGET_IP
```

`--min-rate 5000` pushes nmap to send at least 5000 packets per second. Adjust down on unstable or rate-limited networks. This is the scan to run on every target: services on high ports are missed by default scans constantly.

## TCP SYN Scan

The default and most reliable scan type. Sends a SYN packet and records the response without completing the handshake:

```bash
nmap -sS -p- $TARGET_IP
```

Requires root. Without root, nmap falls back to a TCP connect scan (`-sT`) which completes the full handshake and is slightly louder.

## Service Version Detection

Once you have a list of open ports, run version detection against them:

```bash
nmap -sV -p $PORT,$PORT,$PORT $TARGET_IP
# PORT     STATE SERVICE VERSION
# 22/tcp   open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.11
# 80/tcp   open  http    Apache httpd 2.4.41
# 3306/tcp open  mysql   MySQL 5.7.42
```

Version information feeds directly into CVE matching and service-specific enumeration. Always run `-sV` on confirmed open ports before moving on.

## OS Detection

```bash
nmap -O $TARGET_IP
```

Requires root. nmap fingerprints the OS based on TCP/IP stack behaviour. The result is a best-guess with a confidence percentage: treat it as directional, not definitive.

Combined version and OS detection:

```bash
nmap -sV -O $TARGET_IP
```

## Combined Scan: Open Ports Then Deep Scan

A reliable two-phase approach: fast full port scan first, then detailed scan on confirmed open ports only.

```bash
nmap -p- --min-rate 5000 -T4 $TARGET_IP -oG /tmp/ports.txt
ports=$(grep -oP '\d+/open' /tmp/ports.txt | cut -d/ -f1 | tr '\n' ',')
nmap -sV -sC -O -p $ports $TARGET_IP
```

`-sC` runs the default NSE scripts against detected services. This combination gives full coverage without wasting time running scripts against every port.

## UDP Scanning

UDP services are missed by all TCP scans. Common high-value UDP ports worth checking explicitly:

```bash
nmap -sU -p 53,67,68,69,111,123,161,162,500,514,623,1194 $TARGET_IP
```

Full UDP scans are slow: each closed port waits for an ICMP port unreachable response with a default timeout. Target specific ports unless you have time for a full sweep.

## Saving Output

Always save scan output. Grepable format is easiest to parse:

```bash
nmap -p- --min-rate 5000 $TARGET_IP -oA /tmp/nmap_full
```

`-oA` saves three formats simultaneously: normal (`.nmap`), grepable (`.gnmap`), and XML (`.xml`). The XML output is compatible with tools like Metasploit and searchsploit.

## Scanning Multiple Hosts

Pass a file of targets:

```bash
nmap -iL /tmp/hosts.txt -p- --min-rate 5000 -oA /tmp/nmap_sweep
```

Or scan an entire subnet:

```bash
nmap -p- --min-rate 5000 $TARGET_IP/24 -oA /tmp/nmap_subnet
```

## Reading Results

Open ports are the primary output. For each open port:

- Note the port number and service name
- Check the version string for specific software and version
- Match against service-specific enumeration pages for next steps
- High ports (above 1024) with unfamiliar services are worth investigating first: they are most likely to be custom or misconfigured applications

Filtered ports mean a firewall is blocking the probe but the host may still be running a service there. Try from a different source address or use a different probe type if filtered ports are significant.

## References

- [Nmap Reference Guide](https://nmap.org/book/man.html) - Official nmap manual covering all scan types, timing options, output formats, and flags.
- [Nmap Network Scanning](https://nmap.org/book/toc.html) - Official Guide Comprehensive reference for nmap usage including port scanning techniques and interpretation.