Nmap for Network Reconnaissance: A Hands-On Scanning Guide

Nmap (Network Mapper) is the open-source tool security teams use to discover live hosts, open ports, running services, and software versions on a network they are authorised to test. For Indian SMBs, running Nmap against your own infrastructure is the fastest way to see what an attacker sees before they see it: exposed admin panels, forgotten test servers, outdated services, and misconfigured firewalls. This guide walks through host discovery, port scanning types, service and version detection, NSE scripts, timing controls, and output formats — with authorised-use framing throughout, because scanning any network without written permission is illegal under India's IT Act, 2000.

Why Network Reconnaissance Matters for Indian SMBs

Most SMB breaches don't start with a zero-day exploit. They start with something boring: an open RDP port, an unpatched service still listening on a forgotten subdomain, or a default admin console nobody remembered to close. Reconnaissance with Nmap surfaces exactly this kind of exposure — the low-hanging fruit that attackers scan the entire internet for, automatically, every day.

Setting Up: Authorised Scope First

Before opening a terminal, define scope in writing: which IP ranges, domains, and time windows are in bounds, who to notify if something breaks, and an emergency stop procedure. This isn't bureaucracy — production scans have crashed fragile IoT devices and legacy print servers. A documented scope protects both the tester and the business. CERT-In publishes periodic advisories on scanning-related incidents and vulnerable configurations that Indian organisations should track alongside their own testing schedule.

nmap -sn 192.168.1.0/24

That single command is host discovery — a "ping sweep" that tells you which of the 254 addresses in that subnet are actually alive, without touching a single port yet.

Host Discovery: Finding What's Actually Live

Host discovery answers the first recon question: what's on this network? Nmap has several discovery techniques because a straight ICMP ping is often blocked by host or network firewalls.

1. -sn — ping scan only, no port scan. Fast enumeration of live hosts.
2. -PS — TCP SYN ping on specified ports, useful when ICMP is filtered.
3. -PA — TCP ACK ping, can slip past stateless firewalls that only block SYN.
4. -PU — UDP ping, catches hosts that drop ICMP/TCP probes but respond to UDP.
5. -PR — ARP ping, the most reliable method on a local Ethernet segment.

Port Scanning Types: SYN, TCP Connect, and UDP

Once you know what's alive, the next question is what's listening. Nmap supports several scan techniques, each with different trade-offs in speed, stealth, and privilege requirements.

nmap -sS -p- 10.0.0.5

-p- scans all 65,535 TCP ports rather than the default top-1000, which matters because attackers routinely find services running on non-standard high ports specifically to avoid casual scans.

UDP scanning deserves separate attention because it's slower and noisier, but it's where DNS, SNMP, and NTP misconfigurations hide — services that are frequently forgotten during hardening:

nmap -sU --top-ports 100 10.0.0.5

Service and Version Detection

Knowing a port is open isn't enough — you need to know what's actually running on it, and which version, because vulnerability research is version-specific.

nmap -sV -sC --version-intensity 5 10.0.0.5

-sV probes open ports with a database of service signatures to identify the application and version. Combined with -sC (the default NSE script set) and -A (aggressive mode, which adds OS detection and traceroute), you get a fairly complete picture of the target in one pass:

nmap -sV -sC -A -p 22,80,443,3389 10.0.0.5

This is typically where an internal team stops — and it's also exactly where the gaps start, because a point-in-time scan only shows what's exposed the moment you run it.

NSE Scripts: Extending Nmap Beyond Port States

The Nmap Scripting Engine (NSE) is what turns Nmap from a port scanner into a lightweight vulnerability and misconfiguration checker. Scripts are organised into categories: auth, default, discovery, intrusive, safe, vuln, and more.

nmap --script vuln -p 443 10.0.0.5

The vuln category checks for known misconfigurations and exposures — expired TLS certificates, weak cipher suites, directory listing, default credentials on common admin panels. The safe category is non-intrusive and won't risk crashing a service, which matters for production scans against fragile legacy systems.

Timing and Stealth: Not Tipping Off Detection Systems

Nmap's timing templates (-T0 through -T5) control how aggressively it paces packets. -T0 (paranoid) sends one probe every five minutes and is used to evade intrusion detection systems during red-team engagements; -T4 (aggressive) is the common default for routine internal scans against systems that can handle the load.

nmap -sS -T3 -p 1-1000 10.0.0.5

Stealth isn't only about speed — fragmenting packets (-f), spoofing the source port (--source-port 53), and randomising scan order (--randomize-hosts) can all help simulate how a real attacker probes a network, which is valuable for testing whether your monitoring actually catches reconnaissance in progress.

Output Formats: Making Scans Usable

Raw terminal output doesn't scale past a handful of hosts. Nmap supports structured export formats that feed into reports, dashboards, or diffing tools to track change over time.

1. -oN — normal output, human-readable text.
2. -oX — XML output, the format most automation and reporting tools consume.
3. -oG — grepable output, useful for quick command-line filtering.
4. -oA — writes all three formats simultaneously with one base filename.

nmap -sS -sV -oA weekly-scan 10.0.0.0/24

Saving XML output and diffing it week-over-week is a simple, low-cost way to catch configuration drift — a new port that quietly opened, a service that upgraded (or didn't), a host that appeared on the network without anyone provisioning it.

These figures are drawn from the Verizon Data Breach Investigations Report, the industry's most cited annual breach dataset, and reinforce why continuous discovery of exposed services — not a one-time scan — needs to be part of any SMB's baseline hygiene.

Defensive Detection: Spotting Nmap Scans Against You

Understanding reconnaissance from the defender's side matters just as much as running the scan. SYN scans against a monitored network typically show up as a burst of half-open connections from a single source IP across many destination ports in a short window — a pattern most intrusion detection systems and modern firewalls can flag with connection-rate thresholds. UDP scans against closed ports often trigger a flood of ICMP "port unreachable" responses, another detectable signature.

Why an External VAPT Catches What Internal Scans Miss

An internal team running Nmap on a schedule is a good habit, but it has structural blind spots. The person running the scan usually already knows the network topology, which unconsciously narrows what they look for. Internal scans are also typically run from inside the corporate network, which means they never see the environment the way an actual external attacker does — from the public internet, against whatever is actually reachable, with no prior knowledge of the architecture.

A proper external VAPT engagement — reconnaissance, vulnerability assessment, and authorised exploitation attempts performed by an independent third party, delivered with a CERT-In empanelled partner where regulatory submission is required — combines Nmap-style discovery with manual verification, business-logic testing, and exploitation validation that automated scanning alone doesn't reach. That combination is what turns a list of open ports into a prioritised, actionable remediation plan.

A Practical First Scan Checklist

For an SMB security or dev team running their first authorised internal recon pass, a sensible sequence looks like this:

1. Confirm written authorisation and defined scope.
2. Run host discovery (-sn) to map live assets.
3. Run a full-port SYN scan (-sS -p-) against each live host.
4. Layer in UDP scanning (-sU --top-ports 100) for commonly missed services.
5. Run service/version detection (-sV) and default NSE scripts (-sC) on open ports.
6. Save output in XML (-oX) for tracking and comparison over time.
7. Review findings against a known-good baseline and flag anything unexpected.

Next Steps

Nmap is a foundational skill, not a complete security programme. Used correctly and only against authorised assets, it gives you the same starting visibility an attacker has. Pair routine internal scanning with a periodic external VAPT to catch what a single tool, run from a single vantage point, structurally cannot.

Ready to see what's actually exposed on your network? Get a free VAPT scan, or browse the Bachao.AI blog for more hands-on security guides. If your organisation handles personal data under India's new privacy law, also review our DPDP compliance guide.