Types of Nmap scans and best practices | TechTarget (2024)

Nmap scanning techniques

Lockheed Martin, a well-known defense company, developed the Cyber Kill Chain model to trace the stages of a cyber attack. The first stage is reconnaissance. Network teams conduct network reconnaissance when performing network scans, and bad actors use it to gather information about attack targets. Nmap is a common tool used during the reconnaissance stage.

Conducting a scan helps determine what is running on a computer or network, such as opened ports, services and applications. Nmap establishes a TCP connection using Internet Control Message Protocol, TCP or User Datagram Protocol messages to gather information during the scan.

Nmap offers various scanning techniques. Here are four of the most common types of scans. For more advanced scans, network admins can use the Lua programming language within Nmap to write scripts.

1. TCP SYN scan

A TCP SYN scan is a stealth scan used to determine if ports on a target system are open, closed or filtered. Nmap sends a SYN packet to the target and waits for a response. If the target responds with a SYN/ACK packet, the port is considered open and ready to establish a connection. These connection attempts might not appear in logs, depending on network configurations. If the target responds with an RST packet, the port is closed.

Here is the command to perform a TCP SYN scan:

sudo nmap -sS <<Target_computer_ip_address>>

After the scan, the screen displays information about the port, state and services, as seen in Figure 2.

2. Version detection scan

A version detection scan gathers details about the services and applications running on identified open ports. The scan sends probes to open ports and receives responses from the services on those ports, garnering information about the type of services running.

Here is the command to run a version detection scan:

sudo nmap -sV <<Target_computer_ip address>>

In Figure 3, the version detection scan displays a version of Amazon CloudFront with Apache HTTP Server, a web service that speeds up the distribution of static and dynamic content, running on open ports.

3. OS detection scan

An OS detection scan discovers which OS a target network or computer is running. Nmap sends TCP packets with specific characteristics, probes to the target host and determines the OS based on the host's responses. Advanced options of the scan can also detect the specific OS version and potential security risks. This information is useful during network reconnaissance.

Here is the command to run an OS detection scan:

sudo nmap -O <<Target_computer_ip_address>>

In Figure 4, the scan discovered a Microsoft OS.

4. Vulnerability scan

A vulnerability scan detects Common Vulnerabilities and Exposures (CVEs) to discover if a target is vulnerable to attacks. Use -Pn to skip a ping scan, and add --script vuln to run vulnerability detection scripts against the target host.

Here is the command to run a vulnerability scan:

nmap -Pn --script vuln <<Target_computer_ip_address>>

The scan shows the Samba heap overflow vulnerability, CVE-2012-1182, on a Windows 10 system. This information is helpful for network admins to know what is happening on a network or target computer and avoid data leaks with vulnerable systems.

Best practices for network vulnerability discovery

Some companies might prohibit network scanning unless they have an agreement or defined scope with the team performing the scans. Additionally, each country has its own laws and security frameworks. Network admins should always ensure they have proper authorization before running Nmap scans on a network, as unauthorized scanning can lead to legal consequences.

Here are some best practices for successful network vulnerability discovery:

• Choose the right tool. The first step before conducting a scan is to choose a tool that suits your needs. Nmap is commonly used due to its scan accuracy.
• Plan the scan. Always communicate with stakeholders before conducting a scan. It's possible to receive unexpected results without clear goals, scope and duration.
• Run the scan. After planning, choose the type of scan, the targeted IP address, the IP address range -- if it's for the entire network -- and vulnerabilities to detect.
• Scan frequently. Always refer to company policy to plan how often -- and what -- to scan. Is the scan weekly or monthly?
• Analyze the vulnerabilities. Always review the scan and assess which CVEs pose the most risk of data leaks based on their severity.
• Document the scan. After the scan, it's paramount to document. Each scan contains similarities, and documentation helps teams understand previous and future scans.

Nmap is a well-known tool for detecting network vulnerabilities. Network teams can take advantage of the tool by defining a scope for accurate scans, talking with different stakeholders and measuring results for safer networks.