LFCE 100 🐧 nmap — Network Scanning - KandZ

⏱️ Estimated read: 12 min | |

nmap is the network exploration and security auditing tool that answers the question “what is on this network?” The previous chapters covered the tools that examine the traffic and the sockets on a single host; this chapter covers the tool that examines the hosts themselves: which hosts are up, which ports are open, which services are running, and which operating systems are listening. The LFCE exam expects the candidate to monitor and troubleshoot network performance, and nmap is the first tool that an administrator reaches for when the network inventory is unknown or the firewall rule is suspected.

Quick How-To Guides & Fast FixesNeed a quick fix or step-by-step solution? Browse our fast answers on HowTo.KandZ.me:

Operating Systems CLI →Dev Environment Languages →Web Network Tools →Security Accounts →Security Access Tech →Device Phone Basics →Social Messaging →Digital Files Media →

The scan is built from the target specification and the scan type. The target can be a single host, a CIDR block, a range, or a list, and the scan type determines which packets are sent and which responses are interpreted . The default scan, when no options are given, performs the host discovery with the TCP ACK to port 80 and the ICMP, and then scans the top 1000 ports with the SYN scan if the user is root, or the connect scan if the user is not . The -sS option is the SYN scan, the -sT is the connect scan, and the -sU is the UDP scan. The -sV probes the open ports to determine the service and the version, and the -O guesses the operating system .

Key point: The port state is the most important output. open means an application is listening, closed means no application is listening but the host is reachable, and filtered means a firewall or a filter is blocking the probe so that nmap cannot tell whether the port is open or closed . The open|filtered and closed|filtered states are reported when the probe is ambiguous. The -Pn option skips the host discovery and treats every target as online, which is the mechanism for the hosts that block the ICMP and the TCP ACK probes but still respond to the port scans.

Why nmap requires the target specification and the scan type

The target-specification problem.

nmap accepts a single host, a hostname, a CIDR block (192.168.1.0/24), a range (192.168.1.1-50), a comma-separated list (192.168.1.1,2,3), or a combination of these . The -sL list scan prints the targets without sending a single packet, which is the mechanism for verifying the target specification before the real scan . The -iL <file> option reads the targets from a file, which is the mechanism for the large inventories.

The scan-type problem.

The default scan is the SYN scan when the user is root and the connect scan when the user is not . The SYN scan sends the SYN packet and interprets the SYN-ACK as open and the RST as closed, and it never completes the handshake, which makes it stealthier and faster. The connect scan completes the full TCP handshake, which is slower and more likely to be logged. The UDP scan is slow and unreliable because the UDP has no handshake and the closed ports may not respond. The choice of the scan type depends on the privilege and the goal.

The host-discovery problem.

nmap performs the host discovery before the port scan by default, which avoids wasting the time on the hosts that are not online . The discovery sends the ICMP echo, the TCP SYN to the ports 80 and 443, and the ARP on the local network. The -Pn option skips the discovery and treats every target as online, which is the mechanism for the hosts that block the discovery probes but still respond to the port scans . The -sn option performs only the discovery and no port scan, which is the mechanism for the network inventory.

a. The target specification and the host discovery

The target can be a single host, a CIDR block, a range, or a list.

# Scan a single host
nmap scanme.nmap.org

# Scan a CIDR block
nmap 192.168.1.0/24

# Scan a range
nmap 192.168.1.1-50

# Scan a comma-separated list
nmap 192.168.1.1,2,3

# List scan: print the targets without scanning
nmap -sL 192.168.1.0/24

# Ping scan: only the host discovery
nmap -sn 192.168.1.0/24

The nmap 192.168.1.0/24 scans the 256 addresses in the block, and the 192.168.1.1-50 scans the 50 addresses in the range . The -sL prints the targets without sending a packet, and the -sn performs only the discovery and reports the hosts that responded . The -sn is the mechanism for the network inventory, and the -sL is the mechanism for the target verification.

The -Pn option skips the discovery.

# Treat every target as online
nmap -Pn 192.168.1.50

The -Pn tells nmap to scan the ports without the discovery, which is the mechanism for the hosts that block the ICMP and the TCP ACK probes . Without the -Pn, the scan reports the host as down and skips the port scan, which is the common surprise when the firewall blocks the discovery but the ports are open.

b. The port scan types

The -sS is the SYN scan, the -sT is the connect scan, and the -sU is the UDP scan.

# SYN scan (requires root)
sudo nmap -sS 192.168.1.50

# Connect scan (no root required)
nmap -sT 192.168.1.50

# UDP scan
sudo nmap -sU 192.168.1.50

# Scan specific ports
nmap -p 22,80,443 192.168.1.50

# Scan a port range
nmap -p 1-1000 192.168.1.50

# Fast scan (top 100 ports)
nmap -F 192.168.1.50

The -sS sends the SYN and interprets the response without completing the handshake, which is the fast and stealthy scan . The -sT completes the handshake, which is slower but does not require the root. The -sU sends the UDP probes, which is slow and the results are often the open|filtered state. The -p selects the ports, and the -F scans the top 100 ports instead of the default 1000 .

The -sV probes the open ports to determine the service and the version, and the -O guesses the operating system.

# Service and version detection
sudo nmap -sV 192.168.1.50

# OS detection
sudo nmap -O 192.168.1.50

# Aggressive scan: OS, version, scripts, traceroute
sudo nmap -A 192.168.1.50

The -sV sends the probes and matches the responses against the service fingerprints, which is the mechanism that turns the open port into the identified service . The -O sends the TCP and the UDP probes to the closed and the open ports and compares the responses against the OS fingerprints. The -A combines the OS detection, the version detection, the script scanning, and the traceroute, which is the comprehensive scan .

c. The port states and the output interpretation

The port state is the key output. The open, closed, filtered, and unfiltered are the four states, and the open|filtered and closed|filtered are the ambiguous combinations.

# The typical nmap output
PORT     STATE    SERVICE     VERSION
22/tcp   open     ssh         OpenSSH 8.9p1
80/tcp   open     http        nginx 1.18.0
443/tcp  open     ssl/http    nginx 1.18.0
3306/tcp filtered mysql

The open means the application is listening, and the closed means the host is reachable but no application is listening . The filtered means the firewall or the filter is blocking the probe, and nmap cannot determine the state. The unfiltered means the port is responsive but nmap cannot tell whether it is open or closed . The open|filtered is the common result of the UDP scan, where the lack of the response is ambiguous between the open port and the filtered port.

The --reason option shows why nmap assigned the state, which is the mechanism for the interpretation.

# Show the reason for the state
sudo nmap --reason -sS 192.168.1.50

The --reason output shows the probe and the response that produced the state, which is the mechanism that distinguishes the filtered from the closed and the open .

Complete Example Session

# ============================================
# PART 1: LIST THE TARGETS
# ============================================
nmap -sL 192.168.1.0/24
# Output lists the 256 addresses without scanning

# ============================================
# PART 2: PING SCAN
# ============================================
nmap -sn 192.168.1.0/24
# Output lists the hosts that responded

# ============================================
# PART 3: SYN SCAN
# ============================================
sudo nmap -sS 192.168.1.50
# Output shows the open, closed, and filtered ports

# ============================================
# PART 4: SERVICE DETECTION
# ============================================
sudo nmap -sV 192.168.1.50
# Output shows the service and the version

# ============================================
# PART 5: OS DETECTION
# ============================================
sudo nmap -O 192.168.1.50
# Output shows the OS guess

# ============================================
# PART 6: AGGRESSIVE SCAN
# ============================================
sudo nmap -A 192.168.1.50
# Output shows the OS, the version, the scripts, and the traceroute

# ============================================
# PART 7: SPECIFIC PORTS
# ============================================
nmap -p 22,80,443 192.168.1.50
# Output shows only the three ports

# ============================================
# PART 8: UDP SCAN
# ============================================
sudo nmap -sU -p 53,123 192.168.1.50
# Output shows the UDP port states

# ============================================
# PART 9: SKIP THE DISCOVERY
# ============================================
sudo nmap -Pn -p 80 192.168.1.50
# The scan runs even if the host does not respond to the discovery

# ============================================
# PART 10: SHOW THE REASON
# ============================================
sudo nmap --reason -sS 192.168.1.50
# Output shows why each port received its state

The ten parts demonstrate the nmap surface: the list scan, the ping scan, the SYN scan, the service detection, the OS detection, the aggressive scan, the specific ports, the UDP scan, the discovery skip, and the reason. The critical interpretation is Part 10: the --reason output shows the probe and the response that produced the state, which is the mechanism that distinguishes the filtered from the closed.

Quick Reference

Target Specification

Form	Example
Single host	`nmap 192.168.1.50`
CIDR	`nmap 192.168.1.0/24`
Range	`nmap 192.168.1.1-50`
List	`nmap 192.168.1.1,2,3`
File	`nmap -iL targets.txt`
List only	`nmap -sL 192.168.1.0/24`

Scan Types

Option	Scan
`-sS`	TCP SYN (root)
`-sT`	TCP connect (no root)
`-sU`	UDP
`-sn`	Ping scan only
`-Pn`	Skip host discovery
`-sV`	Service/version detection
`-O`	OS detection
`-A`	Aggressive (OS, version, scripts)

Port Selection

Option	Purpose
`-p 22,80`	Specific ports
`-p 1-1000`	Range
`-F`	Top 100 ports
`--top-ports 10`	Top N ports

Port States

State	Meaning
`open`	Application listening
`closed`	No application, host reachable
`filtered`	Firewall blocking the probe
`unfiltered`	Responsive, state unknown
`open\|filtered`	Ambiguous (UDP common)

Best Practices

✅ Do This:

# Verify the targets before the scan
nmap -sL 192.168.1.0/24                                        # ✅

# Use the SYN scan as root for the speed
sudo nmap -sS 192.168.1.50                                     # ✅

# Use the service detection to identify the services
sudo nmap -sV 192.168.1.50                                     # ✅

# Use -Pn when the host blocks the discovery
sudo nmap -Pn -p 80 192.168.1.50                               # ✅

# Use --reason to interpret the state
sudo nmap --reason -sS 192.168.1.50                            # ✅

# Scan only the hosts you own or have the permission to scan
# Scanning the others is illegal in many jurisdictions         # ✅

❌ Don’t Do This:

# Scan without the permission
nmap 8.8.8.8    # Illegal in many jurisdictions                 # ❌

# Assume the filtered port is closed
# The firewall may be blocking the probe, not the port         # ❌

# Use the connect scan as root when the SYN scan is available
nmap -sT 192.168.1.50    # Slower and more likely to be logged # ❌

# Skip the host discovery on the local network
nmap -Pn 192.168.1.0/24    # Scans the dead hosts too           # ❌

# Ignore the --reason when the state is ambiguous
# The open|filtered needs the interpretation                   # ❌

Common Pitfalls

Pitfall	Why It Happens	Fix
Host reported as down	The discovery probes are blocked	Use `-Pn`
The port is filtered	The firewall blocks the probe	Check the firewall, use `--reason`
The scan is slow	The UDP scan or the connect scan	Use `-sS` and `-F`
The service is not identified	No `-sV`	Add `-sV`
The OS is not detected	The host has too few open ports	Add the open port with `-O`

Real-World Examples

1. Scan a host

nmap 192.168.1.50

2. Scan a subnet

nmap 192.168.1.0/24

3. Ping scan

nmap -sn 192.168.1.0/24

4. SYN scan

sudo nmap -sS 192.168.1.50

5. Service detection

sudo nmap -sV 192.168.1.50

6. OS detection

sudo nmap -O 192.168.1.50

7. Aggressive scan

sudo nmap -A 192.168.1.50

8. Specific ports

nmap -p 22,80,443 192.168.1.50

9. Skip discovery

sudo nmap -Pn -p 80 192.168.1.50

10. Show the reason

sudo nmap --reason -sS 192.168.1.50

Visual

The Port States

┌──────────────────────────────────────────────────────────────┐
│  THE FOUR PORT STATES                                        │
│                                                              │
│  open:                                                       │
│  ┌────────────────────────────────────────────────────────┐  │
│  │ The application is listening and the probe received    │  │
│  │ the positive response.                                 │  │
│  └────────────────────────────────────────────────────────┘  │
│                                                              │
│  closed:                                                     │
│  ┌────────────────────────────────────────────────────────┐  │
│  │ The host is reachable, but no application is listening │  │
│  │ on the port. The RST is returned.                      │  │
│  └────────────────────────────────────────────────────────┘  │
│                                                              │
│  filtered:                                                   │
│  ┌────────────────────────────────────────────────────────┐  │
│  │ A firewall or a filter is blocking the probe, so nmap  │  │
│  │ cannot tell whether the port is open or closed.        │  │
│  └────────────────────────────────────────────────────────┘  │
│                                                              │
│  unfiltered:                                                 │
│  ┌────────────────────────────────────────────────────────┐  │
│  │ The port is responsive, but nmap cannot determine the  │  │
│  │ state. The ACK scan produces this state.               │  │
│  └────────────────────────────────────────────────────────┘  │
└──────────────────────────────────────────────────────────────┘

The Scan Flow

┌──────────────────────────────────────────────────────────────┐
│  nmap PERFORMS THE DISCOVERY, THEN THE PORT SCAN             │
│                                                              │
│  1. Host discovery (ICMP, TCP ACK, ARP)                      │
│       │                                                      │
│       ▼                                                      │
│  2. If the host is up → port scan                            │
│       │                                                      │
│       ▼                                                      │
│  3. The port scan (SYN, connect, or UDP)                     │
│       │                                                      │
│       ▼                                                      │
│  4. The state classification                                 │
│                                                              │
│  -Pn skips step 1 and treats every target as online.         │
└──────────────────────────────────────────────────────────────┘

The Target Specification

┌──────────────────────────────────────────────────────────────┐
│  nmap ACCEPTS THE FLEXIBLE TARGETS                           │
│                                                              │
│  nmap 192.168.1.0/24        ← the CIDR block                 │
│  nmap 192.168.1.1-50        ← the range                      │
│  nmap 192.168.1.1,2,3       ← the list                       │
│  nmap -iL targets.txt       ← the file                       │
│  nmap -sL 192.168.1.0/24    ← the list scan (no packets)     │
│                                                              │
│  The -sL is the target verification before the real scan.    │
└──────────────────────────────────────────────────────────────┘

Summary

Item	Value
Tool	`nmap` (Network Mapper)
Target	Host, CIDR, range, list, file
List scan	`-sL`
Ping scan	`-sn`
SYN scan	`-sS` (root)
Connect scan	`-sT`
UDP scan	`-sU`
Service detection	`-sV`
OS detection	`-O`
Aggressive	`-A`
Port selection	`-p`, `-F`
Skip discovery	`-Pn`
Reason	`--reason`

Key takeaways:

nmap is the network exploration and security auditing tool. It determines the hosts that are up, the ports that are open, the services that are running, and the operating systems that are listening. The scan is built from the target specification and the scan type .
The port state is the key output. The open means the application is listening, the closed means the host is reachable but no application is listening, and the filtered means the firewall is blocking the probe. The open|filtered is the common UDP result .
The SYN scan is the default when the user is root. The -sS sends the SYN and interprets the response without completing the handshake, which is fast and stealthy. The -sT completes the handshake and does not require the root, but it is slower and more likely to be logged .
The -Pn option skips the host discovery. A host that blocks the ICMP and the TCP ACK probes is reported as down, and the port scan is skipped. The -Pn treats every target as online and scans the ports regardless .
The -sV and the -O identify the service and the OS. The -sV probes the open ports and matches the responses against the service fingerprints, and the -O compares the responses against the OS fingerprints. The -A combines both with the script scanning and the traceroute .
The --reason option shows why the state was assigned. It is the mechanism that distinguishes the filtered from the closed and the open, and it is the first option to add when the output is ambiguous .
The scan requires the permission. Scanning the hosts that you do not own or have the written permission to scan is illegal in many jurisdictions. The -sL list scan is the safe way to verify the target specification before the real scan .

Remember: nmap is the tool that answers “what is on this network.” The target specification selects the hosts, and the scan type selects the probes. The port state is the key output: the open, the closed, the filtered, and the unfiltered. The -sS is the fast SYN scan, the -sV is the service detection, and the -O is the OS detection. The -Pn skips the discovery, and the --reason explains the state. The result is the inventory of the network, the audit of the exposed services, and the first step of the vulnerability assessment.

Was this helpful?

Stop using slow, ad-bloated tool sites! 🤮

🔎 Search “KandZ Tools” on Google to use many professional utilities for free.

KandZ.me is the ultimate minimalist hub for:
✅ Finance (Mortgage, Interest, Inflation)
✅ Tech (Base64, JSON, Dev Suite, IP)
✅ Health (BMI, BMR, TDEE)
✅ Productivity (Timer, Workspace, QR)

⚡️ Fast & Private
🔒 No data leaves your device
💎 100% Free

🔗 Use it now: https://tools.kandz.me
🔖 Bookmark it—you’ll need it later!