👉 Overview
👀 What ?
Nmap is a free and open-source network scanner created by Gordon Lyon. It is used to discover hosts and services on a computer network, thus providing a 'map' of the network.
🧐 Why ?
Understanding Nmap is crucial due to its versatility in various cybersecurity tasks including network inventory, managing service upgrade schedules, and monitoring host or service uptime. It's particularly useful in scanning large networks, but can also be used for single hosts. Network administrators should be interested in this tool as it can help identify unsecured points of entry in the network.
⛏️ How ?
To use Nmap, first install the software from the Nmap website. Then, open a command prompt and type 'nmap' followed by the command line switches you want to use and the IP addresses of the hosts you want to scan. For example, 'nmap -sS 192.168.1.0/24' will perform a SYN scan on all hosts in the 192.168.1.0 - 192.168.1.255 IP range.
⏳ When ?
Nmap was first released in September 1997, and has since become a standard tool in both network administration and cybersecurity practices due to its powerful scanning capabilities.
⚙️ Technical Explanations
Nmap, or Network Mapper, operates by sending specially crafted packets to a specified target host and then analyzing the responses. This allows users to conduct different types of scans based on their needs. For instance, a SYN scan (-sS) is used to check if a host is active and which ports are open, while a Ping scan (-sP) is used to detect if the target host is reachable.
One of Nmap's key features is its ability to probe computer networks. This includes host discovery, which identifies devices on the network, and service and operating system detection, which determines what services the hosts are offering and what operating systems they are running. These features can be further expanded with scripts that provide more advanced service detection, vulnerability detection, and other features.
Nmap is also designed to adapt to various network conditions. This includes adjusting to factors such as latency, which is the delay before a transfer of data begins following an instruction for its transfer, and congestion, which occurs when a network node or link carries so much data that it may deteriorate network service quality, typically under the phenomenon of network congestion.
In essence, Nmap is a highly versatile tool that provides comprehensive information about network status, serving as a crucial component in network administration and cybersecurity.
A detailed example of using Nmap might be scanning a local network to discover active hosts and open ports. Here's how that could be done:
- First, open your command prompt or terminal.
- Next, you might want to discover which hosts are active on your network. To do this, you can use the Nmap Ping scan command. If your local network is, for example, 192.168.1.0/24, you would type:
nmap -sn 192.168.1.0/24
The -sn option tells Nmap to perform a Ping scan, which will simply identify which hosts are online. The 192.168.1.0/24 is the IP address range you're scanning.
- Once you've identified an active host, you might want to know what ports are open on that host. For that, you can use the SYN scan command. If the IP address of the host you want to scan is, for example, 192.168.1.5, you would type:
nmap -sS 192.168.1.5
The -sS option tells Nmap to perform a SYN scan, which checks for open ports. The 192.168.1.5 is the IP address of the host you're scanning.
- Upon receiving the scan results, you'll see a list of open ports on the target host. This information can then be used to understand the network services running on those ports.
Please remember, Nmap should be used responsibly and only on networks where you have permission to perform these actions.