Map Your Network with Nmap

Discover active hosts, open ports, and services on your network using Nmap.

Introduction

30 Second Summary

Every device connected to your home network is a potential doorway. Most people have no idea how many devices are online, what services those devices are running, or which ports are left wide open.

In this project, you will use Nmap to scan your local network and a practice target, discovering active hosts, open ports, running services, and operating systems.

What You'll Build

A complete network reconnaissance assessment of your local network and Nmap's official practice target (scanme.nmap.org), producing saved scan output files and a structured findings summary.

By the end of this project, you'll have:

Host discovery results showing all active devices on your local subnet, saved to a reusable output file.
Port scan and service detection output revealing the exact software and versions running on open ports across your network.
OS fingerprinting and scripted scan results from Nmap's comprehensive detection mode, identifying operating systems and gathering automated intelligence.
Secret Mission: Run NSE vulnerability scripts against the practice target and write a mini security assessment report with findings, risk ratings, and recommendations.

Are there any prerequisites?

This project assumes you already have Nmap 7.99 installed on Windows. If you do not have it yet, download the installer from nmap.org/download and run the setup wizard (it includes Npcap, which Nmap needs for raw packet capture).

Verify Your Setup and Map Your Network

Before you can scan a network, you need to confirm your tools are working and understand the network you are sitting on. Nmap is your primary reconnaissance tool, and your local network is the first target you will map.

In this step, you will verify that Nmap is ready to use, identify your local IP address and network range, and confirm connectivity to Nmap's official practice target.

In this step, get ready to:

Verify Nmap is installed and review its options.
Identify your local IP address and network range.
Confirm connectivity to the practice scanning target.

Open Command Prompt and verify Nmap

You need a terminal window to run Nmap commands. Let's open one and confirm Nmap responds.

Press the Windows key to open your search bar.
Type Command Prompt and press Enter to open it.

PowerShell works too

If you prefer PowerShell, you can use it instead. Every command in this project works the same in both terminals.

Check your Nmap version by running this command:

nmap -V

You should see a line that starts with Nmap version 7.99 followed by a URL.

✔️ I see version 7.99

Nmap is ready to go. Continue to the next command below.

ⓧ I see an older version

Your Nmap installation is outdated. Download the latest installer from the official download page to upgrade.

Visit https://nmap.org/download in your browser.
Download nmap-7.99-setup.exe and run the installer.
Accept the default options (including Npcap) and let the installer finish.
Close and reopen Command Prompt, then run nmap -V again to confirm version 7.99.

ⓧ Command not found

Windows cannot find Nmap. This usually means the installer did not add Nmap to your system PATH, or Nmap is not installed yet.

Visit https://nmap.org/download in your browser.
Download nmap-7.99-setup.exe and run the installer.
Make sure the option to add Nmap to the system PATH is checked during installation.
Accept the Npcap installation when prompted.
Close and reopen Command Prompt, then run nmap -V again.

Now explore Nmap's full options summary by running:

nmap -h

What does this command show?

The -h flag prints Nmap's help page, listing every scan type, timing option, and output format available. You do not need to memorize any of this. Skim through to get a feel for the categories (scan techniques, host discovery, port specification, service/version detection, OS detection, output).

Throughout this project, you will use a small subset of these options. The help page is always one nmap -h away if you need a refresher.

Identify your local network range

To scan your own network, you first need to know what address range it covers. The ipconfig command on Windows shows this information for every network adapter on your machine.

Display your network configuration by running:

ipconfig

Look for the section labeled with your active connection (usually Wireless LAN adapter Wi-Fi or Ethernet adapter Ethernet).

Find the line that says IPv4 Address and note the value (for example, 192.168.1.105).
Find the line that says Subnet Mask and note the value (for example, 255.255.255.0).

How do I calculate my network range?

Your IPv4 address tells you which device you are on the network. Your subnet mask tells you how large the network is.

A subnet mask of 255.255.255.0 means the first three numbers (octets) identify the network, and the last number identifies individual devices. So if your IP is 192.168.1.105, your network range is 192.168.1.0/24 in CIDR notation.

The /24 means the first 24 bits are the network portion, leaving 8 bits (256 addresses, 0 through 255) for devices. Write down your network range now. You will use it in the next step.

Not seeing an IPv4 address?

If you only see a 169.254.x.x address, your computer is not connected to a network. Check your Wi-Fi or Ethernet connection and run ipconfig again.

If you see multiple adapters listed, look for the one with a Default Gateway value. That is your active connection. Help me find my IPv4 address in the ipconfig output.

Test connectivity to the practice target

Nmap provides an official host, scanme.nmap.org, that anyone has permission to scan for testing purposes. Let's confirm you can reach it before running full scans in later steps.

Why scanme.nmap.org?

Scanning networks you do not own or have permission to test is illegal in most jurisdictions. Nmap's documentation explicitly states: "For testing purposes, you have permission to scan the host scanme.nmap.org."

The only limitation is not to initiate more than a dozen scans against that host per day. Combined with your own local network (which you always have the right to scan), this gives you two safe targets for the entire project.

Send a ping probe to the practice target by running:

nmap -sn scanme.nmap.org

What does -sn do?

The -sn flag tells Nmap to perform a ping scan only, disabling the port scan. It checks whether the host is alive without probing any individual ports. This makes it fast and lightweight.

You should see output that includes Host is up followed by a latency value. This confirms scanme.nmap.org is reachable from your machine.

Seeing 'Host seems down' or a timeout?

This usually means a firewall or network restriction is blocking outbound probes. Try running the command again. Temporary network hiccups can cause timeouts.

If it still fails, check that you have an active internet connection by opening a website in your browser. Some corporate or school networks block ICMP traffic. If you are on a restricted network, try from a home connection instead. Help me troubleshoot why scanme.nmap.org is not responding.

Your tools are verified and you know exactly which network addresses to target. Next up, you will use Nmap to discover every active device on your local network.

Discover Hosts on Your Network

You now know your local IP address, your subnet range, and you have confirmed that scanme.nmap.org is reachable.

Knowing your network range is like knowing the boundaries of a neighbourhood. The next question is: who actually lives there? In this step, you will sweep your entire subnet to find every active device, from your router to your phone to that smart TV you forgot about.

In this step, get ready to:

Run a ping sweep to discover all live hosts on your subnet.
Review the results and identify your own machine, router, and other devices.
Save your discovery results to a file for future reference.

Run a ping sweep across your subnet

A ping sweep sends a probe to every possible address in your network range to see which ones respond. It tells you which devices are online without scanning any of their ports.

In your Command Prompt from earlier, run your first host discovery scan by entering this command:

nmap -sn [[NETWORK_RANGE="your network range, e.g. 192.168.1.0/24"]]

What does this command do?

The -sn flag tells Nmap to perform a Ping Scan and disable port scanning. It only checks whether hosts are alive, not what services they are running.

On your local network, Nmap uses ARP probes to detect devices (which is very reliable). For remote targets, it sends ICMP echo requests and TCP probes.

Wait for the scan to finish. You should see a list of IP addresses with "Host is up" next to each discovered device, followed by a summary line showing the total number of live hosts.

Not seeing any hosts?

Double-check that you entered your correct network range from Step 1. If your IP address is 192.168.1.105 with subnet mask 255.255.255.0, your range is 192.168.1.0/24. A typo in the range (like using 192.168.0.0/24 instead of 192.168.1.0/24) means you are scanning a different subnet entirely.

If you only see one host (your own machine), your router's firewall may be blocking ICMP. You should still see at least your own IP address in the results.

Help me troubleshoot my Nmap ping sweep results.

Review and compare your results

The scan output tells you how many devices are active on your network. Now it is time to make sense of what you found.

Look at the list of discovered IP addresses. Identify which one is your own machine (it matches the IPv4 address you found with ipconfig in Step 1).
Identify your router or gateway. This is typically the first or last address in the range (e.g., 192.168.1.1 or 192.168.1.254).
Note the total count of live hosts and any IP addresses you do not recognize. These could be phones, smart TVs, printers, or other computers on your network.

What is host discovery?

Host discovery is the first phase of any network reconnaissance. Before you can investigate what services a device is running, you need to know which devices exist in the first place.

Professional penetration testers always start with host discovery to build a map of the network before diving deeper into individual targets.

Save your discovery results to a file

You reviewed the results on screen, but scan output disappears when you close the terminal. Saving results to a file gives you a permanent record you can reference later.

Re-run the same ping sweep with the output flag to save results to a file:

nmap -sn [[NETWORK_RANGE="your network range, e.g. 192.168.1.0/24"]] -oN discovery.txt

What does the -oN flag do?

The -oN flag tells Nmap to output the scan results in normal (human-readable) format to the file you specify. The file is created in your current working directory.

This is the same output you see on screen, saved to a text file. You will learn about other output formats (XML and grepable) in a later step.

Confirm the file was created by running:

dir discovery.txt

You should see discovery.txt listed with a file size greater than 0 bytes.
View the contents of your saved file by running:

type discovery.txt

You should see the full scan output including the Nmap version header, each discovered host with its IP address, and the summary line at the bottom.

File not found or empty?

If dir says the file is not found, check that you included a space between your network range and -oN. A missing space means Nmap interprets the flag as part of the target.

If the file exists but appears empty, the scan may have failed silently. Try running the command again and watch for error messages in the terminal output.

Help me figure out why my Nmap output file was not created.

You now have a map of every active device on your local network. Next up, you will scan individual targets to find out which ports are open and what they might be exposing.

Scan Ports on a Target

You now have a map of every live device on your local network. The next question is equally important: what are those devices actually doing?

Port scanning reveals the services each host exposes to the network. Every open port is a potential entry point for an attacker. In this step, you will scan ports on both the practice target and your own machine to understand your network's exposure.

In this step, get ready to:

Run a default port scan against scanme.nmap.org and identify open ports.
Scan your own machine to see what you expose to your local network.
Save a targeted scan in three output formats for documentation.

Run a default port scan against the practice target

A port scan probes a target host to discover which network ports are accepting connections. Each open port means a service is running and reachable over the network.

Run a default scan against the practice target by entering this command:

nmap scanme.nmap.org

This scan takes around 15-30 seconds to complete. You should see a port table in the output listing open ports. Typically, you will see port 22 (ssh) and port 80 (http) listed as open.

What does this scan do?

When you run nmap without any flags, it performs a TCP SYN scan (-sS) of the top 1,000 most common ports. It sends a SYN packet to each port and checks whether the target responds.

Nmap only scans 1,000 ports by default, not all 65,535. This keeps the scan fast while still catching the most commonly used services.

What do the port states mean?

open means an application is actively listening on that port and accepting connections.
closed means no application is listening, but the host is reachable. The port responded to Nmap's probe with a reset.
filtered means a firewall is blocking Nmap's probes. The port did not respond at all, so Nmap cannot determine whether it is open or closed.

Scan seems stuck or timed out?

If the scan hangs for more than a minute, your network may be blocking outgoing probes. Try pressing Enter to see Nmap's progress indicator. If it stays at 0%, check that you still have internet access by pinging a known site.

Help me troubleshoot why my Nmap scan is not completing

Scan your own machine

Scanning an external target shows you what others expose. Scanning yourself reveals what you expose to your local network.

Scan your own machine by running:

nmap localhost

You should see a list of open ports on your own machine. The specific ports depend on what software you have running. You might see ports for database servers, web servers, or remote desktop services.

Why scan yourself?

Any port that is open on your machine is a port that other devices on your local network can potentially connect to. If you see ports you do not recognize or services you did not intentionally start, that is worth investigating.

Compare your results to scanme.nmap.org. A dedicated server typically exposes only the services it needs (SSH, HTTP). Your personal machine may expose more than you expect.

Save a targeted scan in multiple output formats

Professional penetration testers save their scan results in multiple formats. Different tools consume different formats, and having a paper trail of your findings is essential for reporting.

Run a targeted scan of ports 1-1000 and save the output in all three formats by running:

nmap -p 1-1000 scanme.nmap.org -oA portscan

What do the flags do?

-p 1-1000 tells Nmap to scan only ports 1 through 1000, instead of the default top-1000 selection. This gives you explicit control over the range.
-oA portscan saves the output in all three major formats at once, using "portscan" as the base filename.

This creates three files: portscan.nmap (human-readable), portscan.xml (XML for other security tools), and portscan.gnmap (grepable format for quick text searches).

Confirm the three output files were created by running:

dir portscan.*

You should see portscan.nmap, portscan.xml, and portscan.gnmap listed in the output.

Don't see all three files?

Make sure you typed -oA (capital A), not -oa (lowercase). Nmap flags are case-sensitive. If you only see one file, you may have used -oN instead of -oA.

Help me figure out why my Nmap output files are missing

Peek inside your saved files

Try running type portscan.nmap to see the human-readable output, or type portscan.gnmap to see the grepable format. The grepable format puts all information about each host on a single line, making it easy to search through with text tools.

You now know which ports are open on both the practice target and your own machine. Knowing a port is open is useful, but knowing exactly what software is running behind each port is where things get interesting. Next up, you will probe those open ports to identify the exact application names and version numbers.

Detect Services and Versions

In the previous step, you identified which ports are open on scanme.nmap.org and your own machine. You know that port 22 and port 80 are open, but that only tells you something is listening there.

Now you need to find out exactly what software is running on those ports and which version it is. This is what separates a basic network map from actionable security intelligence. An attacker does not just care that port 80 is open. They care whether it is running a specific version of Apache with known vulnerabilities.

In this step, get ready to:

Run version detection against scanme.nmap.org and save the results.
Run version detection against a local network host to see what your devices expose.
Understand why version information is critical for security assessments.

Run version detection against scanme.nmap.org

The -sV flag tells Nmap to probe each open port and determine the exact application name and version number running on it. Instead of just seeing "ssh" or "http," you will see the specific software and its release.

Run a version detection scan against scanme.nmap.org and save the results by running this command:

nmap -sV scanme.nmap.org -oN versions.txt

What does this command do?

This command combines two things you have already used separately.

-sV probes open ports to determine service/version info. Nmap sends specially crafted packets and compares responses against its database of known service signatures.
-oN versions.txt saves the output in normal (human-readable) format to a file called versions.txt.

Wait for the scan to complete. Version detection takes longer than a basic port scan because Nmap sends additional probes to each open port.
Review the output in your terminal. You should now see specific details like "OpenSSH 6.6.1p1" or "Apache httpd 2.4.7" in the VERSION column instead of just "ssh" or "http."

What should I see?

Your output will include a table with columns for PORT, STATE, SERVICE, and VERSION. The VERSION column is the new information. It shows the exact software name, version number, and sometimes additional details like the protocol version or OS build.

Confirm that versions.txt was saved by running:

dir versions.txt

You should see versions.txt listed with a non-zero file size.

Scan taking too long or timing out?

Version detection sends extra probes to each open port, so it takes longer than a simple port scan. If the scan seems stuck, wait a couple of minutes. If it fully times out, check your internet connection and try running the command again.

Help me troubleshoot my Nmap version detection scan against scanme.nmap.org

Run version detection against a local network host

Now that you have seen version detection on an external target, run the same scan against one of the hosts you discovered on your own network. This reveals what software your local devices are actually running, which is valuable for spotting outdated or vulnerable services.

Pick one of the interesting IP addresses from your discovery.txt file. Your router is a good choice because it typically has a few ports open.
Run version detection against that local host by running this command (replace the IP with your chosen target):

nmap -sV [[TARGET_IP="IP address of a host from your discovery.txt"]] -oN local-versions.txt

What does this reveal?

This scan reveals what software your local devices are running and exposing to the network. You might find a web administration interface, a file sharing service, or a print server. Knowing the exact version helps you determine whether the software has known vulnerabilities.

Wait for the scan to finish, then review the output.
Confirm local-versions.txt was created by running:

dir local-versions.txt

You should see local-versions.txt listed with a non-zero file size.

Not seeing version info for local hosts?

Some local devices have firewalls that block Nmap's version probes. If you see ports listed as "filtered" or version shows as blank, try a different host from your discovery list. Your router often has the most accessible ports.

Help me understand why my local version scan shows no results

Understand why version detection matters

Compare the results from your earlier port scan (in portscan.nmap) to what you just got in versions.txt.

Open your earlier port scan results to compare by running:

type portscan.nmap

Now open your version detection results by running:

type versions.txt

Notice how the default scan told you the port number and a generic service name (like "ssh" or "http"), while version detection reveals the exact software and version (like "OpenSSH 6.6.1p1" or "Apache httpd 2.4.7").

Why does the exact version matter?

Knowing "port 80 is open" tells you there is a web server. Knowing "Apache httpd 2.4.7 is running on port 80" tells you whether that server has known vulnerabilities you can look up in public databases.

Security professionals use version information to search for CVEs (Common Vulnerabilities and Exposures) that affect specific software versions. This is what turns a network map into an actionable vulnerability assessment.

You now know exactly what software is running on every open port. Next up, you will combine OS detection, scripting, and traceroute into a single comprehensive scan that reveals even more about your targets.

OS Detection and Scripting

In the previous step, you used version detection to reveal the exact software running behind each open port. You went from knowing "port 80 is open" to knowing the specific application and version listening on that port.

Now you will combine OS detection, version detection, scripting, and traceroute into a single command. The -A flag runs all of these together, giving you the deepest possible picture of a target from one scan.

In this step, get ready to:

Run a comprehensive scan combining OS detection, version detection, default scripts, and traceroute.
Examine NSE script output for actionable intelligence beyond basic scanning.
Run the same comprehensive scan against a local network device to compare results.

Run a comprehensive scan against the practice target

The -A flag is Nmap's most thorough scan mode. It combines -sV (version detection), -sC (default scripts), -O (OS fingerprinting), and --traceroute into a single command.

Run a comprehensive scan against scanme.nmap.org with aggressive timing by running this command:

nmap -A -T4 scanme.nmap.org -oN comprehensive.txt

What does this command do?

-A enables OS detection, version detection, script scanning, and traceroute all at once.
-T4 sets the timing template to aggressive (level 4 of 5), which speeds up the scan on reliable connections like your home network.
-oN comprehensive.txt saves the results in a human-readable file so you can review them later.

Wait for the scan to complete. This takes longer than previous scans because Nmap is running multiple detection techniques.
Review the output and look for the OS detection section, which reports the target's likely operating system and kernel version.

What should I see?

Your output includes several new sections compared to earlier scans. Look for a "Running" or "OS details" line that reports the target's operating system (likely Linux).

You will also see a "TRACEROUTE" section showing the network hops between your machine and the target. If Nmap cannot find a perfect match, it may show "Running (JUST GUESSING)" with a confidence percentage.

Seeing "No exact OS matches" or no OS result?

OS detection works best when the target has at least one open port and one closed port. If all ports are filtered, Nmap cannot fingerprint the OS reliably.
Make sure you are running Command Prompt as Administrator. OS detection requires raw packet access through Npcap, which needs elevated privileges on Windows.
If the scan is taking very long, your network connection to scanme.nmap.org may be slow. Wait for it to finish rather than cancelling.

Why is my OS detection scan not returning results?

Examine the NSE script output

The -sC flag (included in -A) runs the "default" category of Nmap Scripting Engine scripts. These scripts safely gather extra information like SSH host keys, HTTP page titles, and DNS records.

Scroll through your scan output (or open comprehensive.txt) and look for sections labeled "Host script results" and per-port script output.
Look at the SSH port entry for host key information that the scripts extracted automatically.
Look at the HTTP port entry for a page title or server header that goes beyond what version detection alone revealed.

Why do default scripts matter?

Default NSE scripts provide actionable intelligence that basic scanning misses. An SSH host key fingerprint lets you verify you are connecting to the correct server in the future.

An HTTP page title confirms what web application is running. These details help a penetration tester build a complete profile of the target without running any invasive or dangerous tests.

Run a comprehensive scan against a local host

Now apply the same powerful scan to a device on your own network. This shows how OS detection identifies device types like routers, printers, and computers.

Run a comprehensive scan against your router (or another interesting host from your earlier discovery) by running this command:

nmap -A -T4 [[ROUTER_IP="your router or local host IP address"]] -oN local-comprehensive.txt

What does this scan reveal about local devices?

OS detection on local devices often reports the device type (router, printer, general purpose computer) alongside the operating system name and version. A home router might show up as "Linux 2.6.X" with device type "broadband router."

Compare the depth of information from this single -A command to what you gathered in earlier steps using individual flags like -sV or -sn alone. One command now gives you ports, services, versions, OS, scripts, and traceroute together.

Confirm that local-comprehensive.txt was created by running:

dir local-comprehensive.txt

You should see local-comprehensive.txt listed with a file size greater than zero.

Local scan showing fewer results than expected?

Many home devices have firewalls that block Nmap's OS detection probes. If you see "Too many fingerprints match this host" or no OS result, try a different device on your network.
Some routers respond to port scans but block the specific packets Nmap uses for OS fingerprinting. This is normal behavior for consumer networking equipment.
Make sure you replaced the IP address in the command with the actual IP of your router or local device from your earlier discovery scan.

Why is my local device not showing OS detection results?

Secret mission

Vulnerability Assessment Report

You've mapped your network and identified services. Now take it a step further by running vulnerability detection scripts and producing a professional security assessment report, just like a real penetration tester would deliver to a client.

Clean Up Your Resources

This project runs entirely locally, so there are no ongoing costs or cloud resources to worry about. Decide whether to keep your scan output files as reference material, archive them into a tidy folder, or delete them entirely.

Resources you created:

Scan output files: discovery.txt, portscan.nmap, portscan.xml, portscan.gnmap, versions.txt, local-versions.txt, comprehensive.txt, local-comprehensive.txt, vuln-scan.txt.
Assessment report: assessment-report.txt.

Keep everything running

No action needed. Choose this if you want to keep your scan files as documentation and reference material for future security work.

Your scan output files remain wherever your terminal's working directory was when you ran each command.
These files contain a snapshot of your network at the time of scanning. They are useful for comparing against future scans to detect changes.

Pause - I'll come back to this later

Move all output files into a dedicated folder so they stay organized without cluttering your working directory.

Windows

Create a folder and move your files into it by running these commands:

mkdir nmap-recon
move discovery.txt nmap-recon\
move portscan.nmap nmap-recon\
move portscan.xml nmap-recon\
move portscan.gnmap nmap-recon\
move versions.txt nmap-recon\
move local-versions.txt nmap-recon\
move comprehensive.txt nmap-recon\
move local-comprehensive.txt nmap-recon\
move vuln-scan.txt nmap-recon\
move assessment-report.txt nmap-recon\

macOS

Create a folder and move your files into it by running these commands:

mkdir nmap-recon
mv discovery.txt portscan.nmap portscan.xml portscan.gnmap versions.txt local-versions.txt comprehensive.txt local-comprehensive.txt vuln-scan.txt assessment-report.txt nmap-recon/

Delete - I don't want to use this again

Remove all project files from your machine. Since these are just local text and XML files, there is nothing else to clean up.

Windows

Delete all scan output files by running this command:

del discovery.txt portscan.nmap portscan.xml portscan.gnmap versions.txt local-versions.txt comprehensive.txt local-comprehensive.txt vuln-scan.txt assessment-report.txt

Confirm the files are gone by running:

dir *.txt *.xml *.nmap *.gnmap

You should see no matching files in the output.

macOS

Delete all scan output files by running this command:

rm discovery.txt portscan.nmap portscan.xml portscan.gnmap versions.txt local-versions.txt comprehensive.txt local-comprehensive.txt vuln-scan.txt assessment-report.txt

Confirm the files are gone by running:

ls *.txt *.xml *.nmap *.gnmap

You should see a "No such file or directory" message for each pattern.

Nice Work!

You just completed a professional-grade network reconnaissance workflow using Nmap. You discovered hosts, enumerated open ports, identified running services and operating systems, and documented your findings.

You've learned how to:

Discovered active hosts on your local network using ping sweeps and performed TCP SYN port scanning to map open, closed, and filtered ports.
Used service/version detection and OS fingerprinting to identify exact software, versions, and operating systems running on network targets.
Saved scan results in multiple output formats (normal, XML, grepable) and ran NSE scripts for automated information gathering.
Produced a vulnerability assessment report with scope, methodology, findings, risk ratings, and recommendations following a professional security methodology (Secret Mission).

Ready to quiz yourself?