You just deployed a new server, and someone on your team asks a simple question: which ports are actually open on it? Guessing from the firewall config is risky, so you want to check from the outside. This post shows you the Nmap commands I’d reach for to answer that, from a quick first scan to version detection, scripts, timing and reports.

Mastering Nmap mostly comes down to knowing a handful of flags and when to use them. One rule before we start: only scan machines and networks you own or have written permission to test.

Install Nmap and run your first scan

Nmap is in the default repositories of most Linux distributions. On a Debian-based system like Ubuntu, install it with:

sudo apt-get install nmap

Once it finishes, nmap --version should print the installed version. For Windows, macOS or other platforms, grab an installer from the official Nmap download page.

The basic syntax for a quick scan looks like this:

nmap target_ip

By default, Nmap checks the 1,000 most common TCP ports on the target. That’s fine for a first look, but it can miss services running on unusual ports.

Scan specific ports or all of them

The -p flag tells Nmap exactly which ports to check, which makes scans faster and more focused.

To scan only SSH, HTTP and HTTPS, run:

nmap -p 22,80,443 target_ip

Nmap reports each port as open, closed or filtered. Replace target_ip with an IP address or hostname.

To scan all 65,535 TCP ports, run:

nmap -p- target_ip

This takes a lot longer than the default scan, but it’s the only way to be sure nothing is hiding on a high port. If you run it over SSH, start it inside a tmux session so a dropped connection doesn’t kill the scan.

For an aggressive scan, run:

nmap -A target_ip

The -A flag turns on OS detection, version detection, default scripts and traceroute in one go. It’s noisy and slower, so I’d save it for hosts you’re allowed to probe in depth.

Format and filter Nmap output

Saving results to a file means you can compare scans later instead of scrolling back through your terminal. You can also pipe the output through grep to pull out only the lines you care about:

nmap -A target_ip -oN scan_results.txt

A handy trick is to grep for open so you see only the ports that answered, without the closed and filtered noise.

Detect services and versions with Nmap

Version detection tells you not just that port 80 is open, but which web server and version is listening there. Add version detection to your scan like this:

nmap -sV target_ip

Check the VERSION column in the output. An old version number there is usually your first lead when hunting for unpatched software.

Mastering Nmap’s scripting engine (NSE)

The Nmap Scripting Engine (NSE) is a built-in system that runs small Lua scripts during a scan to gather extra details or check for known issues. Run specific scripts for more detailed information:

nmap --script vuln target_ip

Scripts live in Nmap’s scripts directory, and you can browse them by category, such as default, safe or vuln. Stick to the safe ones unless you know what a script does.

Tune scan timing and performance

Timing templates control how fast Nmap sends probes, from -T0 (paranoid) and -T1 (sneaky) up to -T5 (insane). -T3 is the default, and -T4 is a solid choice on a fast, reliable network:

nmap -T4 target_ip

Slow templates are gentler on fragile networks and less likely to trip alarms. Fast ones save time but can miss ports on a busy or lossy link, so drop back a level if results look patchy.

Test filtered ports and firewall rules

A filtered port is one where Nmap can’t tell if it’s open or closed, because a firewall is dropping the probes. Nmap has options to test how well your firewall holds up against that kind of probing:

nmap --unprivileged target_ip

Use these against your own firewall to confirm your rules work the way you think. If you just set up something like a WireGuard VPN, it’s a quick way to check that only the ports you meant to expose are reachable.

Save scans as XML for reports

XML output is the format to use when you want to feed Nmap results into other tools, like vulnerability scanners or a reporting script. Enable XML output like this:

nmap -A -oX scan_results.xml target_ip

Keep these files with a date in the name. Comparing this week’s scan to last month’s is the fastest way to spot a port that opened when nobody expected it.

Make Nmap part of your routine

Nmap is most useful when you run it regularly, not just once. I’d suggest scanning every new server right after you deploy it. If you automate deployments, for example an Nginx deployment with Ansible, a quick nmap -p- your_server afterward confirms you didn’t leave anything exposed.

Adapt these commands to your own setup, and always respect the rules and permissions of the networks you scan.

Happy (and ethical) scanning! 🔍