Network Reconnaissance Lab with Linux

Scan your network and capture live packets using nmap and tcpdump.

Introduction

30 Second Summary

Every device on your home network is broadcasting information about itself. Your phone, your laptop, your smart TV, your router. A security professional's first skill is learning how to listen.

In this project, you will set up a Linux virtual machine on your Mac, connect to it over SSH, and use professional security tools to map every device on your network and capture live traffic.

What You'll Build

You will scan your home network from a Linux terminal and watch as every connected device, open port, and running service appears in your reconnaissance report.

By the end of this project, you'll have:

A Linux virtual machine running on your Mac that you can SSH into from your host terminal and run commands remotely.
A network reconnaissance report showing every device on your local network with its open ports and the exact services running on them.
Captured and analyzed real network packets, reading TCP flags to distinguish normal traffic from connection attempts.
Secret Mission: Use nmap's scripting engine to run vulnerability scans against your own machine and produce a security audit document.

Are there any prerequisites?

None. This project includes full setup instructions for every tool you need. You just need a Mac with an Apple Silicon chip (M1, M2, M3, or M4).

Before We Start

Before we dive in, let's lock in what you're about to build and why it matters.

Set Up Your Linux VM

You need a real Linux environment to run security tools the way professionals do. Your Mac terminal is Unix-like, but security tools like nmap and tcpdump behave differently on a native Linux system.

In this step, you'll install UTM (a free virtualization app for Apple Silicon), create a virtual machine, and install Ubuntu Server inside it. By the end, you'll have a fully working Linux system running on your Mac.

In this step, get ready to:

Install UTM and download the Ubuntu Server ISO.
Create and configure a virtual machine in UTM.
Install Ubuntu Server and verify your Linux system is running.

Download and install UTM

UTM is a free, open-source virtualization app built specifically for Apple Silicon. It uses Apple's Hypervisor framework to run ARM64 operating systems at near-native speed on your Mac.

Open your browser and go to https://mac.getutm.app.
Click the Download button to download UTM for free.
Once the download finishes, open the .dmg file from your Downloads folder.
Drag the UTM icon into your Applications folder.
Press Cmd+Space to open Spotlight.
Type UTM and press Enter to launch it.

You should see UTM's main window with an empty virtual machine list. This confirms UTM is installed and ready.

macOS blocking UTM from opening?

macOS may show a security warning because UTM was downloaded from the internet. If this happens:

Open System Settings, then click Privacy & Security in the sidebar.
Scroll down to Security and click the Open Anyway button.
This button is only available for about an hour after you first try to open the app.

Still stuck? Help me open UTM on my Mac despite the security warning.

Why UTM instead of VirtualBox?

UTM is purpose-built for macOS on Apple Silicon. It uses Apple's native Hypervisor framework, which means your Linux VM runs at near-native speed. VirtualBox only added Apple Silicon support recently and is still less stable on M-series chips.

Download Ubuntu Server and create the VM

Now you need an operating system to install inside your VM. Ubuntu Server is a Linux distribution with no graphical interface. It forces you to work entirely in the terminal, which is exactly the skill this project teaches.

Open your browser and go to https://ubuntu.com/download/server/arm.
Download the Ubuntu Server 26.04 LTS ARM64 ISO. This file is approximately 2.9 GB, so it may take a few minutes.

Why ARM64?

Your Mac's Apple Silicon chip uses the ARM64 architecture. Downloading the ARM64 ISO means your VM runs the operating system natively rather than emulating a different architecture. This gives you much better performance.

While the ISO downloads (or once it finishes), create your virtual machine in UTM.

In UTM, click the + button to open the VM creation wizard.
Select Virtualize.
Select Linux.
On the next screen, click Browse and select the Ubuntu Server ARM64 ISO you downloaded.
Press Continue.
Set the RAM to 4096 MB. Leave the CPU cores on the default setting.
Press Continue.
Set the storage size to 32 GB, then press Continue.

On the shared directory screen, skip it by pressing Continue.
On the summary screen, change the VM name to security-lab.
Press Save to create your VM.

You should now see security-lab in UTM's sidebar. Your VM exists but has no operating system installed yet.

Don't see the ISO in the file picker?

Make sure the ISO download has fully completed before browsing. The file is named ubuntu-26.04-live-server-arm64.iso and should be about 2.9 GB. If it's smaller, the download may have been interrupted.

Need help? Help me find my Ubuntu ISO file to load into UTM.

Install Ubuntu Server in the VM

Your VM has hardware (virtual RAM, CPU, disk) but no operating system. Now you will boot from the ISO and install Ubuntu Server, just like installing an OS on a real computer from a USB drive.

Select security-lab in UTM's sidebar and click the Run button (the play icon) to start the VM.
The Ubuntu installer boots. Select your language (English) and press Enter.
Accept the default keyboard layout and press Enter.
Accept the default network configuration and press Enter.
Accept the default storage/disk configuration. Select Done to confirm.
When asked to confirm the destructive action, select Continue.

Next the installer asks you to create a user account. This is the account you will use to log into your Linux system.

Enter hacker as both your name and your server's name.
Enter hacker as your username.
Choose a password you will remember, and confirm it.
On the SSH Setup screen, check the box for Install OpenSSH server. This is critical for connecting to your VM from your Mac later.
On the featured server snaps screen, do not select anything. Press Done.

The installation begins. Wait for it to complete. When you see Reboot Now, select it.

What if the reboot hangs?

After selecting Reboot Now, the VM may hang at a black screen with a blinking cursor. This is expected. If it happens, close the VM window in UTM (click the stop button or close the window), then continue with the next step to remove the ISO.

Whether the reboot succeeded or hung, you now need to remove the installer ISO so the VM boots from its hard drive instead of restarting the installer.

If the VM is still running, stop it by clicking the square stop button in the UTM toolbar.
Right-click security-lab in UTM's sidebar and select Edit.
Find the CD/DVD drive entry that shows the Ubuntu ISO attached.
Click Clear to remove the ISO from the drive.
Click Save.
Start the VM again by clicking the Run button.

The VM boots from its hard drive. After a moment, you should see a login prompt.

Enter hacker as your username and press Enter.
Enter the password you chose during installation and press Enter.

You are now logged into your Linux virtual machine. You should see a command prompt ending in $.

Before running the next command, what do you think uname -a will tell you about this system?

Confirm your Linux system is working by running:

uname -a

You should see output containing aarch64 GNU/Linux. This confirms you have a working ARM64 Linux system running inside your VM.

Not seeing the login prompt?

If the VM boots back into the Ubuntu installer, you did not remove the ISO. Stop the VM, go to Edit, clear the CD/DVD drive, save, and start again.
If you see a blank screen, press Enter a few times. The login prompt may be hidden behind boot messages.
If you forgot your password, you will need to delete this VM and start over from the beginning of this substep.

Still having trouble? Help me get my Ubuntu VM to boot to a login prompt.

Your Linux VM is up and running. Next up, you'll connect to it over SSH from your Mac terminal and start discovering what devices are on your network.

Connect via SSH and Discover Your Network

Your Linux VM is up and running. Now it's time to connect to it properly and start exploring what's on your network.

Typing directly in the VM console is limiting. SSH lets you control your VM from your Mac terminal with full copy/paste, scrollback, and tab completion. Once connected, your first reconnaissance task is to discover what devices share your network.

In this step, get ready to:

SSH into your VM from your Mac terminal.
Install nmap and discover all devices on your local network.
Scan a target host for open ports.

SSH into your VM from your Mac terminal

Your VM has an IP address on your local network. You need to find it so your Mac can connect to the VM over SSH.

Switch back to your VM console window in UTM.
Find your VM's IP address by running this command:

ip addr show

Look for the inet address on the enp0s1 interface (or similar). It will look something like 192.168.64.4. Ignore the 127.0.0.1 address on lo. That is the loopback and only talks to itself.

What am I looking for?

The output lists each network interface. Find the one that is NOT lo (loopback). Under that interface, the inet line shows your VM's IPv4 address. Write this down or memorize it.

Open a new Terminal window on your Mac by pressing Cmd+Space to open Spotlight, typing Terminal, and pressing Enter.
Connect to your VM over SSH by running this command:

ssh hacker@[[VM_IP="your VM's IP address e.g. 192.168.64.4"]]

What will I see?

The first time you connect, SSH displays a fingerprint warning asking if you trust this host. This is normal for a first connection. Type yes and press Enter.

Then enter the password you chose when you created the hacker user in Step 1. The cursor will not move as you type. That is expected security behavior.

Once authenticated, your terminal prompt changes to hacker@security-lab. You are now controlling your Linux VM remotely from your Mac.

Connection refused or timed out?

Make sure your VM is still running in UTM. If it powered off, start it again and wait for the login prompt.
Double-check the IP address. Run ip addr show in the VM console again and confirm you copied the inet address on enp0s1 correctly.
If SSH times out, your Mac and VM might be on different subnets. Check that UTM's network mode is set to Shared Network (the default) in the VM's settings.

Why won't my SSH connection work?

Install nmap and run your first network scan

Now that you have a comfortable SSH session, your first tool is nmap. It is the industry-standard network scanner used by security professionals to discover devices and services on a network.

Install nmap by running this command:

sudo apt update && sudo apt install -y nmap

What does this command do?

sudo apt update refreshes the package list so your system knows about the latest available software. sudo apt install -y nmap installs nmap without asking for confirmation (the -y flag says yes automatically).

Enter your password when prompted by sudo.

You will see package download and install progress. Once it finishes, nmap is ready to use.

Identify your network's subnet by running:

ip route | grep default

This shows your default gateway (your router's IP) and the network interface. Note the gateway IP and the subnet. For example, if you see default via 192.168.1.1, your subnet is 192.168.1.0/24.

How do I figure out my subnet?

Take the gateway IP and replace the last number with 0/24. If your gateway is 192.168.64.1, your subnet is 192.168.64.0/24. The /24 means "scan all 254 usable addresses in this range."

Before you run the next command, how many devices do you think are connected to your network right now?

Discover all live hosts on your network by running this ping scan:

nmap -sn [[SUBNET="your subnet e.g. 192.168.1.0/24"]]

You should see a list of discovered hosts with their IP and MAC addresses. Each entry is a device on your network. This could include phones, laptops, smart TVs, and your router.

What does the -sn flag do?

The -sn flag performs host discovery without a port scan. It sends ping-like probes to every address in the range and reports which ones respond. This is the fastest way to map who is on a network without doing anything invasive.

Only seeing 1-2 hosts?

If your scan only finds the VM itself (and maybe one gateway), your VM is likely behind UTM's NAT. You need to switch to Bridged networking so the VM sits directly on your local network.

Shut down the VM by running sudo poweroff.
In UTM, select the security-lab VM and click the settings icon.
Go to the Network section and change the mode from Shared Network to Bridged.
Start the VM again, SSH back in, and re-run the ping scan.

Why is my nmap scan only finding the VM itself?

Scan for open ports on a discovered host

Now you know what devices are on your network. The next question is: what doors are open on each device? An open port means something is listening for connections on that device.

Pick a target from your ping scan results. Your router (the gateway IP from ip route) is a good first target because routers typically have several services running.
Scan the top 1,000 TCP ports on that host by running:

nmap [[TARGET_IP="target IP from your scan e.g. your gateway address"]]

What does this scan do?

Without any flags, nmap scans the 1,000 most common TCP ports on the target. For each port, it reports whether the port is open, closed, or filtered (blocked by a firewall).

Review the output. You will see a table of open ports. For example:

PORT    STATE SERVICE
53/tcp  open  domain
80/tcp  open  http
443/tcp open  https

You can see that ports are open. But look at the SERVICE column. It only shows generic names like http or domain. You have no idea what software is actually running on those ports. Is port 80 a router admin panel? A printer interface? A NAS web dashboard?

Why are the service names so vague?

The basic scan only guesses service names based on the port number (port 80 is usually HTTP, port 53 is usually DNS). It does not actually probe the service to find out what software is listening. That is a fundamental limitation we will solve in the next step.

All ports showing as filtered?

The target device may have a firewall blocking scan probes. Try a different host from your ping scan results.
If you used your router, some routers block port scans from LAN clients. Try scanning your own VM's IP instead to confirm nmap is working.

Why are all my nmap ports showing as filtered?

You just mapped your network and found open doors. But knowing port 80 is open is only half the story. In the next step, you will probe those ports to discover exactly what software is running behind them. That is what turns raw port numbers into actionable intelligence.

Detect Services on Open Ports

You have a map of your network and a list of open ports on your target host. But a bare port number is not useful intelligence on its own. Port 80 on your router could be an admin panel, a printer interface, or a NAS dashboard.

Service detection closes that gap. In this step, you will use nmap's version-probing capabilities to reveal exactly what software is listening on each port, then save the results as a proper reconnaissance report.

In this step, get ready to:

Run service and version detection to identify the software behind each open port.
Execute an aggressive scan combining OS detection, traceroute, and scripting.
Save a complete reconnaissance report to a file on your VM.

Run service and version detection

In Step 2, your basic scan showed output like 80/tcp open. That tells you a port is open, but not what is behind it. The -sV flag tells nmap to send additional probes that fingerprint the actual software and version running on each port.

Run service version detection against the same target host you scanned earlier:

sudo nmap -sV [[TARGET_IP="your target IP address"]]

This scan takes longer than the basic scan because nmap is sending extra probes to each open port. When it finishes, compare the output to your earlier results.

You should now see entries like 80/tcp open http lighttpd 1.4.x or 80/tcp open http nginx instead of just 80/tcp open.

What does -sV reveal?

The -sV flag identifies services and versions on open ports. For each open port, nmap sends protocol-specific probes and matches the responses against a database of known service signatures.

This is the difference between knowing a door exists and knowing what is behind it. A port labelled http nginx 1.24 tells you the exact software and version to research for known vulnerabilities.

Scan seems stuck or shows no services?

If the scan hangs for a long time, the target host may be rate-limiting probes. Wait up to 2 minutes per open port for results.

If you see tcpwrapped instead of a real service name, the target is actively blocking fingerprinting. Try scanning your VM's own IP as a fallback target, since its SSH service will always respond.

help me troubleshoot why nmap -sV is not detecting services on my target

Run an aggressive scan and save the report

Now that you understand what service detection reveals, you can run a comprehensive scan that combines multiple techniques in a single pass. The -A flag enables OS detection, version detection, script scanning, and traceroute all at once.

Run an aggressive scan against the same target and save the output to a file:

sudo nmap -A [[TARGET_IP="your target IP address"]] -oN recon-report.txt

What do -A and -oN do together?

-A enables OS detection, version detection, script scanning, and traceroute in one command.
-oN recon-report.txt saves the output in normal format to a file, while still displaying results on your screen.

The output includes an operating system guess, service versions, traceroute hops showing the network path to the target, and findings from nmap's default scripts.

This scan takes longer than the previous one. Watch the output as it streams. You will see sections for each open port, an OS detection block, and a traceroute at the end.

Getting permission denied or no route to host?

Make sure you included sudo before the command. OS detection and traceroute require root privileges to send raw packets.

If you see No route to host, the target may have gone offline. Re-run your ping scan from Step 2 to pick a live host.

help me fix nmap permission or connectivity issues

Before you check the saved report, what do you expect to find inside recon-report.txt?

Verify your report was saved by reading it back:

cat recon-report.txt

You should see a saved report containing service names, version numbers, and OS detection results. This is a real reconnaissance report.

You now have a saved reconnaissance report that documents what is running on your network. Next up, you will capture live network packets and read the raw traffic flowing between devices.

Capture and Analyze Live Network Traffic

You have mapped your network and identified what services are running on each device. That tells you what doors exist on the network.

Packet capture shows you what is going through those doors right now. tcpdump is the tool that gives you real-time visibility into actual network conversations, showing you exactly which machines are talking and what they are saying.

In this step, get ready to:

Install tcpdump and capture raw packets flowing across all network interfaces.
Filter captured traffic by protocol and read TCP flags to identify connection types.
Generate HTTP traffic and observe a complete TCP three-way handshake in real time.

Install tcpdump and capture your first packets

Your nmap scans told you which ports are open. Now you need to see what data is actually moving through those ports in real time.

Install tcpdump by running this command:

sudo apt install -y tcpdump

You should see apt download and install the package, ending with a confirmation that tcpdump is set up.

Install failed or package not found?

Make sure you ran sudo apt update earlier in this project. If your VM has no internet access, check that UTM's network mode is set to Shared or Bridged in the VM settings.

help me fix tcpdump installation issues on my Ubuntu VM

Capture your first 20 packets by running this command:

sudo tcpdump -i any -c 20 -nn

Lines scroll past showing real network traffic. Each line has a timestamp, source IP, destination IP, ports, and protocol flags.

What does this command do?

-i any captures on all network interfaces at once.
-c 20 stops automatically after 20 packets so you are not flooded with output.
-nn prevents tcpdump from resolving hostnames or port names. You see raw IP addresses and port numbers instead.

Seeing permission denied?

Packet capture requires root privileges. Make sure you included sudo at the start of the command. Enter your password when prompted.

help me run tcpdump without permission errors

Filter traffic and read TCP flags

The raw capture showed all traffic at once. Filtering lets you isolate specific conversations. Your own SSH session is generating constant traffic, making it a perfect target to observe.

Capture only SSH traffic by running this command:

sudo tcpdump -i any -nn -c 30 -- 'tcp port 22'

Because you are connected via SSH right now, this command captures your own session's packets as they flow. You see output immediately as your keystrokes and responses travel back and forth.

How do I read the TCP flags?

Each packet line includes a Flags field in square brackets. The dot character represents ACK.

[S] = SYN. A new connection request.
[S.] = SYN-ACK. The server acknowledges and accepts the connection.
[.] = ACK. A simple acknowledgement.
[P.] = PUSH-ACK. Data is being transferred.
[F.] = FIN-ACK. One side is closing the connection.

Most of your SSH packets show [P.] because your session is actively transferring data back and forth.

Save 50 packets to a file for later analysis by running this command:

sudo tcpdump -i any -c 50 -nn -w capture.pcap

The terminal goes quiet while tcpdump captures in the background. After 50 packets it exits and reports how many packets were captured.

Read back the saved capture file by running this command:

sudo tcpdump -r capture.pcap -nn

You should see the same packet format as before, but replayed from the saved file.

Why save packets to a file?

Live capture scrolls past quickly. Saving to a .pcap file lets you analyze traffic after the fact. Security analysts capture packets during incidents and review them hours or days later to piece together what happened.

Seeing zero packets captured?

If the capture sits at zero packets, your VM may not have active traffic. Press a few keys in your SSH session or open another SSH connection to generate packets.

If that does not help, try running sudo tcpdump -i any -c 50 -nn -w capture.pcap without any port filter to confirm capture works at all.

help me troubleshoot tcpdump not capturing packets

Generate traffic and observe it

So far you have watched existing traffic. Now you will create specific HTTP traffic on purpose, then watch tcpdump capture the full connection lifecycle from start to finish.

Open a new tab in your Mac Terminal by pressing Cmd+T.
SSH into your VM from this second tab by running this command:

ssh hacker@[[VM_IP="your VM IP address"]]

Accept the fingerprint if prompted and enter your password. You now have two terminal tabs connected to the same VM.

Switch back to your first Terminal tab (the one you have been working in).
Start capturing HTTP traffic by running this command:

sudo tcpdump -i any -nn -c 20 -- 'tcp port 80'

This command blocks and waits. It does not show any output until port 80 traffic appears. Leave it running.

Switch to your second Terminal tab by pressing Cmd+Shift+].
Generate HTTP traffic by running this command:

curl -s http://example.com > /dev/null

Switch back to your first Terminal tab.

You should now see tcpdump output showing the HTTP connection. Look for the three-way handshake pattern: a [S] packet (your VM asking to connect), followed by [S.] (the server accepting), then [.] (your VM confirming).

After the handshake, [P.] packets carry the actual HTTP request and response data. Finally, [F.] packets close the connection gracefully.

What is the three-way handshake?

Every TCP connection starts with three packets. Your machine sends SYN to say it wants to connect. The server replies with SYN-ACK to accept. Your machine sends a final ACK to confirm.

Only after this handshake does real data flow. You just watched this happen in real time. This same pattern occurs billions of times per second across the internet.

Not seeing any HTTP packets?

Make sure you started the tcpdump command in your first tab before running curl in the second tab. If tcpdump was not running when the traffic happened, it missed the packets.

If tcpdump captured zero packets after a long wait, your VM might not have internet access. Confirm by running ping -c 2 example.com in your second tab.

help me capture HTTP packets with tcpdump

Before you run the next command, what do you expect to see inside your saved capture.pcap file? Think about what traffic was happening when you saved those 50 packets earlier.

Verify your saved capture file by running this command in your first tab:

sudo tcpdump -r capture.pcap -nn | head -10

You should see the first 10 captured packets with timestamps, source/destination IP:port pairs, and TCP flags. You are reading real network traffic that you recorded earlier.

You can now see inside live network traffic. You captured packets, filtered by protocol, saved evidence to a file, and read the TCP flags that reveal how connections are built and torn down. Next up, take this further with vulnerability scanning in the Secret Mission.

Secret mission

Vulnerability Scanning with NSE

You have mapped your network and captured traffic. Now take the next step in a real penetration test: use nmap's Scripting Engine to check whether those open services have known vulnerabilities. Run automated security checks, interpret CVE references, and produce a complete audit report.

Clean Up Your Resources

Decide whether to keep your resources running, pause them to come back later, or delete them entirely. This project runs entirely locally on your Mac, so there are no ongoing costs.

Resources you used:

UTM VM security-lab (contains Ubuntu Server, nmap, tcpdump, recon-report.txt, capture.pcap).
UTM application (installed on your Mac).
Ubuntu Server 26.04 LTS ARM64 ISO file (in your Downloads folder).

Keep everything running

No action needed. Choose this if you plan to keep practising with your security lab. Your VM will remain available in UTM to start up anytime.

Your security-lab VM stays in UTM, ready to boot whenever you want to run more scans or packet captures.
UTM stays installed on your Mac for future virtual machine projects.
The Ubuntu Server ISO stays in your Downloads folder in case you want to create another VM later.

Pause - I'll come back to this later

Shut down the VM to free up system memory. Your VM files stay on disk so you can boot it again later.

In your SSH session, run the following command to shut down the VM:

sudo shutdown now

Your SSH connection will close automatically.
The VM powers off in UTM. To resume later, open UTM and click the play button on security-lab.
You can also delete the Ubuntu Server ISO from your Downloads folder to reclaim 2.9 GB of disk space. You will not need it again unless you create a new VM.

Delete - I don't want to use this again

Remove all project resources from your Mac. This frees up approximately 35 GB of disk space (32 GB VM storage plus the 2.9 GB ISO).

If your VM is still running, shut it down first by running this in your SSH session:

sudo shutdown now

Open UTM on your Mac.
Right-click (or Control-click) the security-lab VM in the list.
Select the option to remove the virtual machine. Since it is stored in the default path, all VM data (the 32 GB disk image, recon-report.txt, capture.pcap, and installed tools) will be deleted along with it.
Delete the Ubuntu Server ISO from your Downloads folder:

rm ~/Downloads/ubuntu-26.04-live-server-arm64.iso

To remove UTM itself, drag it from your Applications folder to the Trash, then empty the Trash.

Nice Work!

You just built a complete network reconnaissance lab on your Mac. You can now spin up a Linux VM, SSH into it, discover every device on your network, identify what software they are running, and capture live traffic at the packet level.

You've learned how to:

Set up a Linux virtual machine using UTM and Ubuntu Server, then connect to it over SSH from your Mac terminal to work across both environments.
Discover all devices on your local network and identify their running services using nmap host discovery, port scanning, and service version detection.
Capture live network packets with tcpdump, interpret TCP flags (SYN, ACK, FIN, PUSH) to understand connection patterns, and use BPF filter expressions to isolate specific traffic types.
Secret Mission: Ran vulnerability scans using nmap's NSE scripting engine and produced a security audit report.

Ready to quiz yourself?