Which Nmap scan is best?

With root access, the SYN scan (sS) is faster and quieter; the full TCP scan (sT) is more compatible but slower.

What do port states (open/closed/filtered) mean?

An "open" port means a service is listening on it; "closed" means reachable but without a service; "filtered" usually means a firewall sends no response.

Why is a scan sometimes slow or less accurate?

Firewalls, rate limiting and packet loss change the results. Adjusting timing (such as T4) or a fragmented scan sometimes helps.

Is port scanning a crime?

Unauthorized scanning of other people's systems is a crime in many countries; always get written permission from the network owner before any scan.

Nmap Tutorial: Port Scanning, Service and OS Detection

Reconnaissance is the first phase of any penetration test. Nmap tells you which hosts are alive, which ports are open, and which service is running behind each — information that underpins every later step.

Scanning Live Hosts: Know Your Network

The simplest start is checking the whole network:

nmap -sn 192.168.1.0/24

This command lists online hosts only, without port scanning. If you want specific ports:

nmap -p 1-1024 192.168.1.20

Port Scanning: Full TCP or Fast SYN

Full connection scan: nmap -sT target
Half-open SYN scan (faster and quieter): nmap -sS target
Specific ports: -p 22,443,3389, or -p- for all ports

SYN scanning requires root access and is the most common choice in real-world engagements.

Service and Version Detection with -sV

Once an open port is found, knowing which software, with which version, is running is critical:

nmap -sV target

The service version helps you find documented weaknesses; a step that, after reconnaissance, is continued in Metasploit Tutorial.

OS Detection and a Comprehensive Scan

Operating system: nmap -O target
Everything combined for one machine: nmap -A target (service + version + OS + route)

For a single target, -A gives the best results; on the whole network it can be noisy and time-consuming.

Outputs and Reporting

For documentation during a penetration test:

Text output: nmap -oN out.txt target
XML output: nmap -oX out.xml target
Grepable output: nmap -oG out.grep target

XML output is useful for tools and the final report, and Grepable output is useful for scripting.

Always Respect the Legality of Scanning

Scanning a network you don't own, without permission, is both an ethical error and a legal violation. Even authorized scans are usually performed within a defined IP range and an announced time window.

Suggested Exercise

Set up a few test machines with different services (web, SSH, FTP) and, based only on the Nmap output, guess which service with which version is running; this skill is the foundation of finding real vulnerabilities. Prepare the practice environment in Installing Kali Linux.