How to Scan Nmap Ports
To scan Nmap ports on a remote system, enter the following in the terminal:
sudo nmap 192.168.0.1Replace the IP address with the IP address of the system you’re testing. This is the basic format for Nmap, and it will return information about the ports on that system.
In addition to scanning by IP address, you can also use the following commands to specify a target:
To scan a host:
nmap www.hostname.comTo scan a range of IP addresses (.1 – .10):
nmap 192.168.0.1-10To run Nmap on a subnet:
nmap 192.168.0.1/13To scan targets from a text file:
nmap –iL textlist.txtNote: The developers at nmap.org provide a test server that you can experiment on, located at scanme.nmap.org. You can use this to test your Nmap utility.
Scan a Single Port, All Ports, or Series
Nmap commands can be used to scan a single port or a series of ports:
Scan port 80 on the target system:
nmap –p 80 192.168.0.1Scan ports 1 through 200 on the target system:
nmap –p 1-200 192.168.0.1Scan (Fast) the most common ports:
nmap –F 192.168.0.1To scan all ports (1 – 65535):
nmap –p– 192.168.0.1 Other Types of Nmap Port Scans
Different types of scans can be performed:
To scan using TCP connect (it takes longer, but is more likely to connect):
nmap –sT 192.168.0.1To perform the default SYN scan (it tests by performing only half of the TCP handshake):
nmap –sS 192.168.0.1To instruct Nmap to scan UDP ports instead of TCP ports (the –p switch specifies ports 80, 130, and 255 in this example):
nmap –sU –p 80,130,255 192.168.0.1Run a fast scan on the target system, but bypass host discovery. (Host discovery uses ping, but many server firewalls do not respond to ping requests. This option forces the test without waiting for a reply that may not be coming):
nmap –Pn –F 192.168.0.1 The nmap utility can be used to detect the operating system of a particular target:
nmap –A 192.168.0.1It can also be used to probe for the services that might be using different ports:
nmap –sV 192.168.0.1Note: The –sV option can be tuned to be more or less aggressive in its scan. Use the ––version-intensity 2 option to specify the level of testing. Replace the number 2 with a number from 0 (light testing) to 9 (run all probes). The more intense the testing, the longer the scan will take.
Common Ports
Here is a brief list of standard ports and their designations:
- 21 – FTP
- 22 – SSH
- 25 – SMTP (sending email)
- 53 – DNS (domain name service)
- 80 – HTTP (web server)
- 110 – POP3 (email inbox)
- 123 – NTP (Network Time Protocol)
- 143 – IMAP (email inbox)
- 443 – HTTPS (secure web server)
- 465 – SMTPS (send secure email)
- 631 – CUPS (print server)
- 993 – IMAPS (secure email inbox)
- 995 – POP3 (secure email inbox)
