Security tips / Networking

Nmap for Network Admins: Audit Your Own Network in 10 Commands

PPosted by PeregrinoTech · October 20, 2026 · 5 min read

Every intrusion starts with reconnaissance. Before an attacker touches anything, they map the network: which devices exist, what ports are open, what software answers. The tool they almost always use for that is Nmap.

Which means you should use it first. An hour with Nmap on your own network will show you the devices nobody remembers installing, the services nobody meant to expose, and the one server still running something from 2016.

Before you start

• Only scan networks you own or have written permission to scan. Scanning someone else’s network is illegal in most countries, and it looks identical to an attack. This is not a formality.
• Tell your security team or your managed service provider before you scan. Intrusion detection systems will light up.
• Install Nmap from nmap.org/download. On Windows the installer includes Npcap, which Nmap needs to work. On Linux: sudo apt install nmap. On macOS: brew install nmap.
• Run it from an elevated prompt (Administrator on Windows, sudo on Linux and macOS). Several scan types need raw network access.
• Find your network range first. On Windows, ipconfig; on Linux or macOS, ip addr or ifconfig. If your address is 192.168.1.37 with mask 255.255.255.0, your range is 192.168.1.0/24.

1. Find every device: the ping sweep

nmap -sn 192.168.1.0/24

-sn means “no port scan, just tell me who is there”. It returns every responding device with its IP and, on a local network, its MAC address and the manufacturer. This list is your inventory. Anything you cannot name is your first job.

Practical tip: save the result and compare it next month. New devices that nobody added are worth a conversation.

2. Scan one device, the common ports

nmap 192.168.1.10

With no options, Nmap checks the 1,000 most common TCP ports and reports which are open and what service usually lives there. This is the thirty-second check for a single machine.

3. Scan every port

nmap -p- 192.168.1.10

-p- means all 65,535 TCP ports. It takes longer, but malware and remote-access tools deliberately use unusual high ports precisely because the default scan skips them. Run this on anything important.

4. Find out what software is answering

nmap -sV 192.168.1.10

-sV sends probes to each open port and identifies the software and version: OpenSSH 8.9, Apache httpd 2.4.52, Microsoft IIS 10.0. Version numbers are what you match against vulnerability announcements.

5. Guess the operating system

nmap -O 192.168.1.10

-O fingerprints the operating system from how the device responds. It is not perfect, but “Linux 2.6.x” on a device that is supposed to be a modern Windows server tells you something, and “embedded” often means a printer, camera or smart device.

6. The everything scan for one host

nmap -A -T4 192.168.1.10

-A turns on version detection, OS detection, default scripts and traceroute together. -T4 speeds it up (fine on a local network; use -T3 over VPN or Wi-Fi if results look incomplete). This is the command to run when you want a full picture of one machine.

7. Sweep the network for the ports that matter

nmap -p 21,22,23,80,443,445,3389,5900,8080 192.168.1.0/24 --open

The ports that attackers go for first: FTP (21), SSH (22), Telnet (23), web (80, 443, 8080), Windows file sharing (445), Remote Desktop (3389), VNC (5900). --open hides closed ports so the output is readable.

What to look for: Telnet open anywhere (it sends passwords in clear text), RDP or VNC on machines that should not be remote-controllable, and web admin pages on devices like printers and cameras.

8. Check for the most common exposures with scripts

nmap -sV --script=default,vuln 192.168.1.10

Nmap ships with hundreds of scripts. default runs the safe, informative ones (banner grabs, SSL certificate details, SMB information). vuln checks for well-known vulnerabilities. It is noisy and can be slow, so run it on one host at a time, not the whole network.

A quieter, targeted example that checks whether a Windows machine still allows the SMBv1 protocol that WannaCry abused:

nmap -p 445 --script smb-protocols 192.168.1.10

9. Scan UDP too

nmap -sU --top-ports 20 192.168.1.10

Everything above is TCP. DNS, SNMP, NTP and several management protocols run on UDP, and SNMP in particular (port 161) with the default community string public gives away an alarming amount about a device. UDP scanning is slow, so --top-ports 20 keeps it practical.

10. Save everything in every format

nmap -sV -p- -oA audit-$(date +%F) 192.168.1.0/24

-oA writes three files: a human-readable .nmap, a grep-friendly .gnmap and an .xml you can load into other tools. Keep them. Next month’s scan compared with this month’s is how you spot change, and change is where the problems are. On Windows, replace $(date +%F) with a date you type.

Reading the results: what the states mean

State	Meaning
open	A service is listening. This is what you care about.
closed	Reachable, but nothing listening on that port.
filtered	A firewall dropped the probe. Nmap cannot tell.
open|filtered	Common for UDP. Might be open, might be filtered.

Common mistakes

• Scanning from the wrong place. Scanning from inside the network shows what an insider sees. Scanning your public IP from outside (from a home connection, say) shows what the internet sees. Do both.
• Trusting a single scan. Devices sleep, laptops leave. Scan at different times of day.
• Running vuln scripts against production during business hours. Some probes can upset fragile services. Test windows exist for a reason.
• Finding things and not fixing them. The scan is the easy part. Make a list, assign an owner, close the port or patch the service.

FAQ

Is Nmap legal?

The tool is legal everywhere. Using it on networks you do not own or have permission to test is not. Get the permission in writing.

Why does my scan show nothing for some devices?

Phones and many laptops block ping. Add -Pn to skip the “is it alive” check and scan anyway. It takes longer.

Is there a graphical version?

Yes. Zenmap is installed with Nmap on Windows and gives you the same scans with buttons and a topology map. The command line is faster once you know these ten.

How often should I scan?

Monthly for a small business, weekly for anything handling sensitive data, and immediately after any change to the firewall or any new device.

Final thoughts

Nobody gets to decide whether their network is scanned. The only choice is who scans it first. Ten commands, an hour a month, and a saved copy of each result will put you ahead of most of the attackers who try.

Useful resources

• Nmap reference guide
• Nmap scripting engine docs
• CISA: free cyber hygiene vulnerability scanning for US organizations

Know the attack. Own the defense.

Tagged:NmapNetworkingVulnerability managementBlue team