Mastering Nmap: The Ultimate Tutorial for Windows, Linux, and macOS (2026)

In the complex world of enterprise networking and offensive cybersecurity, reliable information is essential. Whether you are a system administrator monitoring a local office network, a DevOps engineer auditing cloud configurations, or a penetration tester seeking vulnerabilities on a target perimeter, you need a reliable way to map networks and identify active, listening services.

This is where Nmap (Network Mapper) excels as an industry standard.

Nmap is an undisputed industry-standard, open-source tool for network discovery and security auditing. It is utilized by everyone from students learning basic networking to cybersecurity professionals conducting reconnaissance on infrastructure. If you intend to have a career in cybersecurity, mastering Nmap is highly recommended.

In this tutorial, we will demystify how Nmap’s packet engine works. We will guide you step-by-step through installing it on Windows, Linux, and macOS. Most importantly, we will provide you with over 20 practical command-line examples that you can start using on your authorized networks today, including firewall evasion tactics and utilizing the Nmap Scripting Engine (NSE).

1. The Core Engine: What is Nmap and How Does It Work?

Nmap was originally written and released by security researcher Gordon Lyon (known online as “Fyodor”) in late 1997. Since then, it has grown into one of the most powerful network scanning tools available.

At its core, Nmap works by generating and sending specific raw IP packets to target hosts across a network. It then analyzes the timing and structure of the responses (or the lack of responses) to determine:

• Live Host Discovery: Whether a device is powered on and responding on the network.
• Open Port Enumeration: Which network ports (out of the 65,535 possible TCP and UDP ports) are open and accepting incoming connections.
• Service Versioning: The name and version number of the software applications listening on open ports (e.g., instead of just “Port 80 is open”, it states “Apache HTTP Server version 2.4.49 is running”).
• OS Fingerprinting: The Operating System and kernel version running on the target device, determined by analyzing how the host’s TCP/IP stack responds to specific packets.
• Firewall Evasion and Detection: Whether network filters, Intrusion Detection Systems (IDS), or firewalls are blocking your probes.

Understanding the 6 Nmap Port States

When Nmap scans a target, it classifies each port into one of six states. Understanding these states is critical for analysis:

1. Open: A software application on the target machine is actively accepting incoming TCP connections, UDP datagrams, or SCTP associations on this port.
2. Closed: The port is accessible (it receives and responds to Nmap’s probe packets), but there is no software application listening on it. This proves the host is online, but the service is inactive.
3. Filtered: Nmap cannot determine whether the port is open or closed. This happens because a firewall, a router rule, or a host-based filter is intercepting and dropping Nmap’s probes without sending a response back.
4. Unfiltered: The port is accessible, but Nmap cannot determine if it is open or closed. This state usually occurs when running ACK scans designed to map firewall rulesets.
5. Open|Filtered: Nmap is unable to distinguish between an open port and a filtered port. This often occurs when running UDP scans, as UDP is a connectionless protocol that frequently does not respond.
6. Closed|Filtered: Nmap is unable to distinguish between a closed port and a filtered port.

2. Installation: Getting Nmap on Your Machine

Nmap is cross-platform and runs natively on Linux, macOS, and Windows. Here is how to install it.

1. Installing Nmap on Linux

Most major Linux distributions include Nmap in their official package repositories. Open your terminal and run the command matching your distribution:

Debian / Ubuntu / Kali / Linux Mint

sudo apt update
sudo apt install nmap -y

Red Hat / CentOS / Fedora Enterprise

sudo dnf install nmap -y

Arch Linux / Manjaro / BlackArch

sudo pacman -S nmap --noconfirm

To verify the installation and check the version, run:

nmap --version

2. Installing Nmap on macOS (Apple Silicon & Intel)

An easy way to install Nmap on a Mac is by using Homebrew, a popular command-line package manager for macOS.

1. Open your macOS Terminal.
2. Run the following installation command:

   brew install nmap

Alternatively, if you prefer not to use a command-line package manager, you can download the official .dmg installer from the Official Nmap Download Page, open it, and follow the setup wizard.

3. Installing Nmap on Windows 11/10

On Windows, the Nmap installation package includes both the command-line utility and Zenmap, a graphical user interface.

1. Navigate to the Nmap Download Page.
2. Download the latest stable Windows .exe installer (e.g., nmap-7.94-setup.exe).
3. Run the executable installer. During the setup wizard, ensure that Npcap is checked and installed. (Npcap is a network driver that gives Nmap the ability to capture and transmit raw network packets on Windows).
4. Once installed, open an Administrator Command Prompt (CMD) or PowerShell window and verify the installation:

   nmap --version

3. The Core Fundamentals: Basic Nmap Command Syntax

The basic syntax for running Nmap is simple, but allows for complexity:

nmap [Scan Type Flags] [Options] [Target Specification]

• The Target Specification can be diverse. It can be a single IPv4 address (192.168.1.10), a domain name (targetcompany.com), a subnet in CIDR notation (10.0.0.0/8), or a range of IP addresses (192.168.1.1-50).

4. Practical Nmap Command Examples

[!WARNING] Ethical & Legal Warning: You must only scan target networks, domains, and devices that you own, or that you have explicit authorization to scan. Port scanning without permission can be viewed as malicious activity.

For safe testing and learning purposes, the creators of Nmap provide an authorized target domain you can scan: scanme.nmap.org.

Phase 1: Host Discovery and Sweeping (Finding the Targets)

1. Scan a Single Host or Domain

The simplest Nmap scan. It resolves the DNS host name, runs a ping to verify the host is online, and scans the 1,000 most common TCP ports.

nmap scanme.nmap.org
# Or using an IP address:
nmap 192.168.1.100

2. The Ping Sweep (Host Discovery Only) -sn

If you are auditing a network and only want to know which devices are powered on and connected (without scanning their ports), use the -sn option (formerly known as -sP). This sends ICMP ping requests to the subnet.

nmap -sn 192.168.1.0/24

3. Scan a Target List from a Text File -iL

If you have a text file containing IP addresses that need to be scanned, you can feed that file directly into Nmap. Create a file called corporate_targets.txt:

10.0.5.22
192.168.100.50
172.16.0.0/16

Run the batch scan:

nmap -iL corporate_targets.txt

Phase 2: Port Scanning Techniques

4. The TCP SYN Scan (The Industry Standard) -sS

This is the default scan if you are running Nmap as a privileged Root/Administrator user. It is known as the “half-open” stealth scan. The Mechanics: Nmap sends a SYN packet to the target port. The target server replies with a SYN-ACK packet, indicating the port is open and ready to connect. Before the connection is fully made, Nmap drops the connection by sending an RST (Reset) packet. Why it matters: Because a full TCP connection is not established, the target application often fails to log the connection in its access logs, making the scan stealthier.

sudo nmap -sS 192.168.1.100

5. The TCP Connect Scan -sT

If you do not have root or administrator privileges, Nmap defaults to a TCP Connect Scan. It asks your operating system to establish a full connection by completing the TCP three-way handshake. The Trade-off: This scan is more visible and is typically logged by the target’s firewall, Intrusion Detection System, and the application running on the port.

nmap -sT 192.168.1.100

6. The UDP Port Scan -sU

Many network services use UDP instead of TCP (e.g., DNS port 53, DHCP port 67, SNMP port 161). To scan for UDP ports, use the -sU flag. Note: Because UDP is a connectionless protocol that does not guarantee delivery, UDP scans can be slow and less reliable than TCP scans. A full UDP port scan can take a significant amount of time.

sudo nmap -sU 192.168.1.100

7. Scanning Specific Port Ranges -p

By default, Nmap scans the top 1,000 most common ports. To audit specific services, you can control the port ranges.

# Scan only the web ports (HTTP/HTTPS)
nmap -p 80,443 192.168.1.100

# Scan a range of common ports
nmap -p 1-1024 192.168.1.100

# Scan all 65,535 possible TCP ports
nmap -p- 192.168.1.100

8. The Fast Port Scan -F

If you need quicker results, the -F flag commands Nmap to scan only the top 100 most common ports. This makes the scan significantly faster.

nmap -F 192.168.1.100

Phase 3: Fingerprinting and Analysis

Finding an open port is more useful when you know what software is running on it.

9. Service Version Detection -sV

If you find Port 22 open, it is likely SSH. To find out what version is running, use the -sV option. Nmap interrogates the port and compares responses to its database to identify the software version. This can help determine if a service is vulnerable to known exploits.

nmap -sV 192.168.1.100

10. Operating System (OS) Detection -O

Nmap can analyze the characteristics of TCP packet replies to fingerprint the target’s operating system. It compares metrics like TTL (Time to Live) and TCP Window sizes to its database of operating systems.

sudo nmap -O 192.168.1.100

11. The Aggressive Scan -A

The aggressive scan flag (-A) combines several features into one command. It enables OS detection (-O), Service version detection (-sV), Script scanning (-sC), and Traceroute. This scan is easily detectable by network monitoring tools, but it provides a comprehensive set of information.

sudo nmap -A 192.168.1.100

Phase 4: Output and Documentation

It is helpful to save your scan results for future offline analysis and reporting.

12. Saving to Multiple File Formats

Nmap allows you to output to several different file formats.

# Save in normal text format (readable by humans)
nmap -oN scan_report.txt 192.168.1.100

# Save in structured XML format (useful for importing into other tools)
nmap -oX scan_report.xml 192.168.1.100

# Save in a greppable format (ideal for parsing with grep or awk)
nmap -oG scan_report.gnmap 192.168.1.100

# Save in all three formats simultaneously
nmap -oA my_corporate_scan 192.168.1.100

5. The Nmap Scripting Engine (NSE)

The Nmap Scripting Engine (NSE) is one of Nmap’s most powerful features. It extends Nmap’s capabilities beyond simple port scanning. The NSE allows users to write and execute scripts (in Lua) to automate tasks like checking for default credentials, discovering web directories, or identifying specific vulnerabilities.

13. Running Default Scripts -sC

This runs a collection of default, generally safe scripts against the target. They typically avoid invasive actions while gathering useful information.

nmap -sC 192.168.1.100

14. Running Vulnerability Scripts

This commands Nmap to load scripts in the “vuln” category and test the target for known vulnerabilities.

nmap --script vuln 192.168.1.100

15. Running Specific Scripts

If you want to run a specific script, such as checking if an FTP server allows anonymous logins:

nmap --script ftp-anon -p 21 192.168.1.100

6. Evasion and Bypassing Firewalls

When scanning secure network environments, standard Nmap scans may be blocked or dropped by firewalls. In these cases, evasion tactics can be utilized.

16. Bypassing Ping Blocks -Pn

Many firewalls are configured to block incoming ICMP ping requests. If Nmap sends a ping and receives no response, it may assume the host is offline and skip the port scan. The -Pn flag tells Nmap to skip the ping phase and assume the host is online, proceeding with the port scan. This is useful when scanning external IP addresses.

nmap -Pn 192.168.1.100

17. Packet Fragmentation -f

The -f flag fragments TCP headers into smaller chunks (typically 8 bytes) and sends them across the network. Because the packets are fragmented, some Intrusion Detection Systems (IDS) may struggle to reassemble them and identify the scan signature, potentially allowing the scan to bypass filters.

sudo nmap -f 192.168.1.100

18. Decoy Scanning -D

The -D flag allows you to specify decoy IP addresses. Nmap will send port scans from these spoofed addresses alongside your real IP address. The target’s logs will show multiple systems scanning simultaneously, making it more difficult to identify the true source of the scan.

sudo nmap -D 10.0.0.5,192.168.1.200,172.16.0.50,ME 192.168.1.100

Frequently Asked Questions (FAQ)

What is Nmap and what is its primary use?

Nmap (Network Mapper) is an open-source tool used for network discovery and security auditing. It generates and sends raw IP packets to map networks, identify live hosts, and discover open ports and services.

How do I install Nmap on a Linux system?

On Debian/Ubuntu-based distributions, you can install Nmap using the command sudo apt install nmap -y. For Red Hat/CentOS, use sudo dnf install nmap -y, and for Arch Linux, use sudo pacman -S nmap.

What does the -Pn flag do in an Nmap scan?

The -Pn flag instructs Nmap to skip the initial ping phase and assume the target host is online. This is particularly useful for bypassing firewalls that block ICMP ping requests.

What is the Nmap Scripting Engine (NSE)?

The Nmap Scripting Engine (NSE) is a powerful feature that allows users to write and execute Lua scripts to automate advanced network tasks, such as discovering web directories or identifying specific vulnerabilities.

What is a TCP SYN scan (-sS) and why is it used?

A TCP SYN scan, also known as a “half-open” stealth scan, sends a SYN packet to a port but resets the connection before completing the three-way handshake. This technique is often used because it is stealthier and less likely to be logged by the target application.

Conclusion

Nmap is a foundational tool for network administrators and cybersecurity professionals. By understanding the mechanics of packet manipulation, utilizing scanning options like OS identification, and leveraging the Nmap Scripting Engine, you can map and audit network environments.

However, always remember to obtain explicit permission before executing scans against targets on the public internet or private networks. Stay curious, scan responsibly, and secure your perimeter.