Network Reconnaissance with Nmap

Scan real targets and map a network's attack surface using Nmap on Kali Linux.

Introduction

30 Second Summary

Every device on your network is constantly broadcasting information about itself. The question is: who else is listening, and what can they learn?

In this project, you will use Nmap on Kali Linux to perform real network reconnaissance against live targets. You will discover open ports, identify running services, detect operating systems, and save professional scan reports.

What You'll Build

A complete network reconnaissance workflow using Nmap on your Kali Linux VM, scanning both the official Nmap practice server and your own local network.

By the end of this project, you'll have:

Scanned the official Nmap practice target (scanme.nmap.org) using multiple scan techniques including basic, stealth, and aggressive scans.
Discovered devices on your own local network and identified open ports, running services, and operating systems on remote targets.
Generated detailed service detection and OS fingerprinting reports saved in multiple formats for professional documentation.
Secret Mission: Used the Nmap Scripting Engine (NSE) to automatically detect known vulnerabilities on your targets.

Are there any prerequisites?

This project assumes you already have VMware installed with a Kali Linux VM ready to go. You should also be comfortable opening a terminal and typing basic commands.

Set Up Your Scanning Environment

Every penetration test starts with preparation. Before you scan a single target, your tools need to be current and your network connection needs to be working.

Nmap is the industry-standard tool for network reconnaissance. In this step, you'll update it to the latest version on your Kali Linux VM, verify that you can reach the practice target, and learn which targets you're authorized to scan.

In this step, get ready to:

Update Nmap to the latest version.
Verify network connectivity to the practice target.
Understand your authorized scan targets.

Update Nmap to the latest version

Kali Linux comes with Nmap pre-installed, but you want the latest version to get the most accurate scan results and newest features.

Update your system's package list and install the latest version of Nmap by running this command in your terminal:

sudo apt update && sudo apt install nmap -y

What does this command do?

sudo runs the command with administrator privileges. You may be prompted for your Kali Linux user password.
apt update refreshes the list of available packages from Kali's repositories.
apt install nmap -y installs or upgrades Nmap to the latest available version. The -y flag automatically confirms the installation.

Verify that Nmap is installed and up to date by running:

nmap -V

You should see output that includes version 7.99 or a recent version number. This confirms Nmap is ready to use.

Not seeing version 7.99?

Make sure the sudo apt update part of the command completed without errors. If you see "Failed to fetch" messages, your VM may not have internet access.
Check that your VM's network adapter is configured for NAT or Bridged networking in VMware. NAT is the safest default for this project.

Help me troubleshoot my Nmap installation on Kali Linux.

Verify network connectivity

Before scanning anything, you need to confirm your Kali VM can reach targets on the internet and that you know your own network address.

Test your connection to the official Nmap practice target by running:

ping -c 4 scanme.nmap.org

You should see four reply lines, each showing a round-trip time in milliseconds. This confirms your VM can reach scanme.nmap.org.

Not getting ping replies?

Check that your VM's network adapter is set to NAT or Bridged mode in your VMware settings. NAT is the most reliable option for internet access.
Try restarting the networking service inside Kali by running sudo systemctl restart NetworkManager and then try the ping command again.

Help me get network connectivity working in my Kali Linux VM.

Check your own IP address by running:

ip addr show

What am I looking for?

Look for an entry labeled eth0 or ens33 (your primary network interface). Find the inet line underneath it. This shows your IP address, which looks something like 192.168.x.x or 10.0.x.x.

Write down your IP address. You'll use it in the next step to scan your local network.

Understand the legal rules of scanning

Scanning a network without permission is illegal in most jurisdictions. Before you run a single scan, you need to know exactly which targets you are allowed to touch.

Only scan authorized targets

In this project, you are authorized to scan exactly two targets:

scanme.nmap.org is Nmap's official practice server. Their rules state: "You are authorized to scan this machine with Nmap or other port scanners. Try not to hammer on the server too hard. A few scans in a day is fine." This permission only includes scanning with Nmap and not testing exploits or denial of service attacks.
Your own local network is the home network that you own and control.

Never scan networks or systems you do not own or have explicit written permission to scan. Unauthorized scanning can result in legal consequences.

Why is authorization so important?

Even though Nmap is a legitimate security tool, sending packets to someone else's network without permission can be treated the same as unauthorized access. Professional penetration testers always secure written authorization before scanning.

Your scanning environment is ready. Next up, you'll run your first scans against a live target and discover devices on your own network.

Discover Hosts and Scan Ports

Your scanning environment is set up. Nmap is installed, your network connectivity is confirmed, and you know which targets you're authorized to scan.

Now it's time to put Nmap to work against real targets. In this step, you'll run your first scans to discover open ports on scanme.nmap.org and find every device connected to your local network.

In this step, get ready to:

Run a basic port scan against scanme.nmap.org.
Discover live hosts on your local network.
Target specific ports to narrow your scan results.

Run your first basic scan against scanme.nmap.org

A basic Nmap scan checks the 1,000 most common ports on a target. It reports which ones are open, closed, or filtered.

This is the starting point for any network reconnaissance. Every penetration test begins with understanding what's exposed on the target.

Run your first scan against scanme.nmap.org by running this command in your terminal:

nmap scanme.nmap.org

What does the output mean?

The results show a table with three columns: PORT, STATE, and SERVICE. Each line represents one port that Nmap checked.

open means the port is accepting connections.
closed means the port is reachable but no service is listening.
filtered means a firewall is blocking Nmap's probes.

Read through your scan output. You should see a table listing port numbers, states, and service names like ssh or http.
Take note of which ports show as open. You will compare these results to a targeted scan later in this step.

Not seeing any scan results?

Make sure you can still reach scanme.nmap.org. Run ping -c 4 scanme.nmap.org to confirm connectivity.
If the scan hangs or times out, your VM's network adapter might have disconnected. Check your VMware network settings and make sure the adapter is enabled.

Still stuck? Help me troubleshoot why my Nmap scan is not returning results.

Discover live hosts on your local network

Before scanning ports across a whole network, you first need to know which hosts are alive. A ping scan discovers devices without probing any ports.

To scan your local network, you need your subnet address. Take the IP address you noted in Step 1 and replace the last number with 0/24. For example, if your IP is 192.168.1.105, your subnet is 192.168.1.0/24.

Discover all devices on your local network by running this command:

nmap -sn [[LOCAL_SUBNET="your local subnet, e.g. 192.168.1.0/24"]]

What is a ping scan?

The -sn flag tells Nmap to skip port scanning entirely. It only checks whether hosts are alive by sending probe packets and waiting for responses.

This is the first thing a penetration tester does on an engagement to map the network. You figure out what exists before diving into individual hosts.

Look through the results and count how many hosts show as up in the output.

You might see your router, phone, other computers, and smart devices. Each one is a potential target on a real engagement.

Don't see any hosts?

Double-check your subnet address. Run ip addr show again to confirm your IP, then replace the last number with 0/24.
If your VM uses a NAT network adapter, you may only see one or two hosts. This is normal for NAT mode. A bridged adapter would show your full home network.

Need more help? Help me figure out why my Nmap ping scan is not finding hosts on my local network.

Scan specific ports on scanme.nmap.org

Your basic scan checked 1,000 ports, but sometimes you only care about a handful. The -p flag lets you specify exactly which ports to scan.

Run a targeted scan on six specific ports by running this command:

nmap -p 22,80,443,8080,9929,31337 scanme.nmap.org

Why target specific ports?

Professional penetration testers often target specific ports based on what services they expect to find. Port 22 is SSH, port 80 is HTTP, and port 443 is HTTPS.

Narrowing your scan reduces noise and speeds up results. You scan what matters instead of everything.

Compare this output to your basic scan from the first substep. Notice which of these six ports are open, closed, or filtered.

Seeing different results than your basic scan?

Port states can change between scans depending on network conditions and server-side firewalls. Small differences are normal. If every port shows as filtered, check your network connection.

Having trouble? Help me understand the differences between my basic and targeted Nmap scan results.

You've mapped out open ports and discovered devices on your network. Next up, you'll dig deeper into those open ports to find out exactly what software and operating system is running behind them.

Detect Services, Versions, and Operating Systems

In the last step, you discovered live hosts on your local network and identified which ports are open on scanme.nmap.org. Knowing a port is open is a good start, but it only tells you that something is listening.

The real intelligence comes from identifying exactly what software and version is running behind each port. In this step, you will use Nmap's service detection and OS fingerprinting features to build a much deeper picture of your target.

In this step, get ready to:

Run service version detection to identify exact software behind open ports.
Detect the target's operating system remotely.
Combine everything into a single aggressive scan for a complete target profile.

Run service version detection

Your basic scan from Step 2 showed which ports are open and gave a generic service name like "ssh" or "http". Service version detection goes further by probing each open port to determine the exact software name and version number running behind it.

Run service version detection against scanme.nmap.org by entering this command in your terminal:

nmap -sV scanme.nmap.org

What does the -sV flag do?

The -sV flag tells Nmap to probe open ports to determine service/version info. Instead of just reporting "port 22 is open," Nmap now tells you exactly which SSH server and version number is running.

This information is critical because specific software versions have known vulnerabilities. A pentester uses these version numbers to search for matching exploits.

Compare this output to your basic scan from Step 2. You should now see exact software names and version numbers next to each open port.

Not seeing version numbers?

If the VERSION column shows blank entries, the service may not be responding to Nmap's probes. Make sure you have a stable internet connection and try the scan again.

If the scan hangs or times out, scanme.nmap.org may be experiencing heavy traffic. Wait a few minutes and retry.

Still stuck? Help me troubleshoot why my Nmap service version detection isn't showing results.

Detect the operating system

Nmap can identify what operating system a remote host is running based on how it responds to specially crafted network packets. Understanding the target OS helps a pentester choose the right attack vectors and narrow down which exploits are relevant.

Why does OS detection need sudo?

OS detection requires sending raw network packets, which needs root privileges. The sudo prefix gives Nmap the elevated permissions it needs. You may be prompted to enter your password.

Run OS detection against scanme.nmap.org by entering this command:

sudo nmap -O scanme.nmap.org

What does the -O flag do?

The -O flag enables OS detection. Nmap sends specially crafted packets and analyzes how the target responds to fingerprint the operating system.

Look at the "OS details" section in the output. Nmap shows its best guess for the operating system along with a confidence percentage.

Review the OS detection results. You should see one or more OS guesses with confidence percentages listed under "OS details" in the output.

OS detection showing no results?

If you see "No exact OS matches for host," this means Nmap could not confidently fingerprint the OS. This is normal for some targets. The output may still show approximate guesses.

If you get a "Permission denied" error, make sure you included sudo at the start of the command. OS detection requires root privileges.

Need more help? Help me understand my OS detection results.

Run the aggressive scan

So far you have run service version detection and OS detection as separate scans. Nmap has a single flag that combines both of these with script scanning and traceroute into one comprehensive scan.

Run the aggressive scan against scanme.nmap.org by entering this command:

sudo nmap -A scanme.nmap.org

What does the -A flag do?

The -A flag enables OS detection, version detection, script scanning, and traceroute all at once. This is the "give me everything" scan.

The traceroute section shows every network hop between your Kali VM and the target. Script scanning runs default NSE scripts against discovered services to gather even more information.

Why not always use -A?

The aggressive scan is thorough, but it is also slow and noisy. It generates a lot of network traffic that intrusion detection systems can easily spot. In a real engagement, you would start with targeted scans and only use -A when you need a complete picture of a specific host.

Study the full output carefully. You should see exact service versions, an OS fingerprint, traceroute hops, and results from any default scripts that ran.
Compare this output to your earlier scans. Notice how much more detail the aggressive scan provides in a single run.

Aggressive scan taking a very long time?

The -A scan does a lot of work and can take several minutes to complete. This is normal. Let it finish without interrupting it.

If the scan seems stuck, check that your VM still has internet connectivity by opening a second terminal tab and running ping -c 2 scanme.nmap.org.

Still having issues? Help me troubleshoot my aggressive scan.

You now have a detailed profile of your target: open ports, exact software versions, and the operating system it is running. In the next step, you will learn how to scan more stealthily and save your results to files for professional documentation.

Use Stealth Scanning and Save Results

In the previous step, you identified exact service versions and operating systems on scanme.nmap.org. That gives you a detailed picture of the target.

A real penetration tester also needs to control how they scan. Noisy scans can trigger security alarms, so in this step you will use stealth scanning to stay under the radar and save your results to files for professional documentation.

In this step, get ready to:

Perform a SYN stealth scan that avoids completing the TCP handshake.
Control scan speed and verbosity for quieter reconnaissance.
Save scan results to files for professional documentation.

Run a SYN stealth scan

In a real penetration test, you often want to scan without being easily detected. A SYN scan is stealthier than a full connect scan because it never completes the TCP handshake.

Run a SYN stealth scan against scanme.nmap.org by running this command:

sudo nmap -sS scanme.nmap.org

What does the -sS flag do?

`-sS` tells Nmap to perform a SYN scan, also called a "half-open" scan.

It sends a SYN packet to each port and waits for a SYN/ACK response (port open) or RST response (port closed). It never sends the final ACK to complete the connection, which makes it harder for basic logging to detect.

Compare the port results to your basic scan from Step 2.

You should see similar open ports to what you found before. The results look the same because the difference is in the scanning technique, not what gets discovered.

Scan not working?

Make sure you included sudo at the start of the command. SYN scanning requires root privileges to send raw packets.
If you see a timeout, check your network connection by running ping scanme.nmap.org again.
Why is my SYN scan not producing results?

Add verbosity and timing controls

Professional pentesters control how fast and how noisy their scans are. Slower scans are less likely to trigger intrusion detection systems (IDS).

Run a slower, quieter SYN scan with verbose output by running this command:

sudo nmap -sS -T2 -v scanme.nmap.org

What do these flags do?

`-T2` sets the timing to "polite" mode, which sends packets more slowly than the default -T3.
Timing templates range from -T0 (paranoid/slowest) to -T5 (insane/fastest). In a real engagement, you might use -T1 or -T2 to avoid triggering IDS alerts.
`-v` enables verbose output so you can watch what Nmap is doing in real time.

Watch the verbose output in your terminal as Nmap reports its progress in real time.

This scan takes longer than your previous ones because of the -T2 timing.

Scan seems stuck?

The -T2 timing is intentionally slow. The scan may take several minutes to complete.
If you need to cancel and try again, press Ctrl+C.
Why is my verbose Nmap scan taking so long?

Save scan results to files

Documentation is a critical part of any penetration test. Saving scan results to files lets you review them later and share them with your team.

Run an aggressive scan and save the results to two different file formats by running this command:

sudo nmap -A -oN scan_normal.txt -oX scan_results.xml scanme.nmap.org

What do the output flags do?

`-oN scan_normal.txt` saves the output in normal, human-readable format.
`-oX scan_results.xml` saves the output in XML format. This is useful for importing into other security tools like Metasploit or vulnerability management platforms.
`-A` runs the same aggressive scan you used in Step 3, combining OS detection, version detection, script scanning, and traceroute.

Confirm both output files were created by running:

ls scan_normal.txt scan_results.xml

You should see both filenames listed in the output.

View the human-readable report by running:

cat scan_normal.txt

You should see the full scan report with open ports, service versions, OS details, and traceroute information. You now have a professional-quality scan report saved to disk.

Don't see the output files?

Make sure the aggressive scan completed fully before checking. The -A scan can take a minute or two.
Check that you typed the filenames correctly in the original command. A typo in the -oN or -oX argument creates a file with the wrong name.
Why are my Nmap output files not showing up?

Secret mission

Vulnerability Detection with NSE

So far, you have discovered hosts, scanned ports, and identified services. But knowing what is running is only half the picture. In this secret mission, use the Nmap Scripting Engine to automatically detect known vulnerabilities on your targets.

Clean Up Your Resources

This project runs entirely on your local Kali Linux VM, so there are no ongoing costs or cloud resources to worry about. Decide whether to keep your scan output files for future reference or delete them.

Resources you used:

scan_normal.txt and scan_results.xml files saved in your current working directory.
Nmap (updated to latest version on your Kali Linux VM).
Your Kali Linux VM running in VMware.

Keep everything running

No action needed. Choose this if you plan to keep exploring Nmap or start another cybersecurity project on your Kali Linux VM.

Your scan output files (scan_normal.txt and scan_results.xml) remain in your working directory for reference.
Nmap stays installed as part of your Kali Linux toolkit. It is a default Kali tool, so keeping it is expected.
Your Kali Linux VM continues running in VMware. You can shut it down when you are done for the day.

Pause - I'll come back to this later

Shut down your VM to free up system memory and CPU. Your files and Nmap installation will still be there when you return.

In your Kali Linux terminal, shut down the VM by running:

sudo shutdown now

Alternatively, click the power icon in Kali's top-right menu and select Power Off.
Your scan output files, Nmap installation, and all project work are preserved on the VM's virtual disk.

Delete - I don't want to use this again

Remove the scan output files created during this project. Nmap is a default Kali Linux tool, so there is no need to uninstall it.

Delete the scan output files by running this command in your Kali terminal:

rm scan_normal.txt scan_results.xml

Confirm the files are gone by running:

ls scan_normal.txt scan_results.xml

You should see a "No such file or directory" message for each file, confirming they have been deleted.
If you want to delete the entire Kali Linux VM, open VMware, right-click your Kali VM in the library, and select Delete from Disk. This removes the virtual machine and all its files from your computer.

Your VM is a prerequisite for other projects

If you plan to do more cybersecurity projects on NextWork, keep your Kali Linux VM. Setting it up again takes time. Only delete it if you are sure you will not need it.

Nice Work!

Nice work! You just performed real network reconnaissance using Nmap on Kali Linux. These are the same tools and techniques professional penetration testers use on day one of every engagement.

You've learned how to:

Scanned a live, authorized target (scanme.nmap.org) using multiple scan techniques including basic scans, stealth SYN scans, and aggressive scans to map open ports, running services, and operating systems.
Discovered live hosts on your own local network using ping scanning and identified exact service versions and OS fingerprints on remote targets.
Controlled scan timing and verbosity for stealth, and saved results in multiple professional formats for documentation and integration with other security tools.
Secret Mission: Used the Nmap Scripting Engine (NSE) to automatically detect known vulnerabilities and CVEs on your targets.

Ready to quiz yourself?