Vol. I · No. 46The command line sectionSat, 10 Oct 2026
Linux · reachability

nmap

what is open on that host

nmap — network mapper — probes a host’s ports and reports which are open, closed or filtered. Asked to, it also identifies the service and version behind each open port. It is how administrators check what their own machines expose.

Scan your own server from outside: what nmap sees is what an attacker sees.

Default scan
Top 1000 TCP ports
of 65535
States
open, closed, filtered
filtered means no reply
Versions
-sV
asks each service what it is
Permission
Required
scan only what you may

At the terminal

Read the session first, then the notes: each numbered line in the output is answered by the note with the same number.

user@netflow — bashnmap
$ nmap -sV 192.168.1.20
1Nmap scan report for fileserver (192.168.1.20)
Host is up (0.00041s latency).
2Not shown: 997 closed tcp ports (conn-refused)
3PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 9.6p1 Ubuntu 3ubuntu13.5
80/tcp open http nginx 1.24.0
4445/tcp open netbios-ssn Samba smbd 4.6.2
Nmap done: 1 IP address (1 host up) scanned in 11.42 seconds
Illustrative session · names, sizes and dates are examples, and every address is from a documentation or private range
Reading the output

What the numbered lines are telling you

1
The target, and that it answered

The host is up and replied in under a millisecond, so it is on the local network.

2
What is not listed

997 of the 1000 ports tried were closed: the host replied, but nothing was listening.

3
The table of open ports

Port and protocol, state, the service usually found there, and — because of -sV — the software and version actually answering.

4
A file-sharing service

Port 445 is SMB. Fine on a file server inside a network; it should never be reachable from the internet.

Switches

A switch changes how the command behaves. These are the ones used day to day; man nmap lists the rest. Single-letter switches can usually be joined, so -l -a may be written -la.

-sV
Detect the service and version on each open port.
-sn
Host discovery only: no port scan.
-p PORTS
Ports to scan: 22,80 or 1-1000. -p- means all.
-sS
TCP SYN scan, the default as root.
-sU
Scan UDP ports.
-O
Guess the operating system. Needs root.
-A
Aggressive: versions, OS, scripts and traceroute together.
-Pn
Skip the ping and treat the host as up.
-oN FILE
Save the output to a file.

Variations worth knowing

The same tool, pointed at a narrower question. These four cover most of what it is reached for day to day.

nmap -sn 192.168.1.0/24

Finds which hosts on a network are up, without scanning ports.

nmap -p 22,80,443 192.168.1.20

Scans only the ports named.

nmap -p- 192.168.1.20

Scans all 65535 TCP ports.

sudo nmap -sU --top-ports 20 192.168.1.20

Scans the twenty most common UDP ports.

In cybersecurity

Scanning is the first step of an attack and the first step of a defence — what differs is permission.

Only scan what you are authorised to

Scanning networks you do not own or have written permission to test can break the law and will trip intrusion detection. Practise on your own machines or a lab.

Audit yourself regularly

Scan your servers from outside the firewall and compare with the previous result. A newly open port is either a mistake or an intrusion.

Version strings invite attack

What -sV reads is what an attacker matches against known vulnerabilities. Keep services patched, and close what is not needed.

Protocols it shows

TCPUDPICMPIPv4

Read alongside

ncOpens raw TCP or UDP connections: tests whether a port is open, and sends or listens for data.ssLists the sockets on a host — what is listening on which port, which connections are open, and which process owns each.