 |
| Ethical Hacking |
🛡️ Ethical Hacking — Day 7
Nmap Deeper: Scan Types, Port States & Reading Results
⚠️ LEARNING PURPOSE ONLY: This tutorial is strictly for educational and defensive cybersecurity learning. Perform all practical exercises only on systems, networks, virtual machines, applications, or labs that you own or have explicit permission to test. For today's exercises, use 127.0.0.1 unless you have an explicitly authorized lab target. Never scan or probe unauthorized systems.
Welcome to Day 7.
On Day 6, we learned the basics of Nmap. Today we'll understand how Nmap performs different types of scans and why the results can differ.
🎯 Today's Learning Objectives
By the end of Day 7, you'll understand:
TCP Connect scanning
SYN scanning
UDP scanning
Host discovery
Port states
Service/version detection
OS detection concepts
Scan timing
Verbose output
Saving scan results
Comparing different scan types
Practical Nmap usage on Linux, Windows, and macOS
1. Why Are There Different Scan Types?
A common beginner question is:
"Why doesn't Nmap just perform one scan?"
Because different environments require different techniques.
For example:
TCP Scan
↓
Is a TCP service accessible?
UDP Scan
↓
Is a UDP service accessible?
Service Detection
↓
What software is running?
OS Detection
↓
What operating-system characteristics can be inferred?
Each technique produces different information.
2. TCP Connect Scan
A TCP Connect scan uses the operating system's normal TCP connection mechanism.
Nmap option:
-sT
Conceptually:
Client Target
SYN -------------------->
<-------------------- SYN/ACK
ACK -------------------->
Connection established
If the port is open, a TCP connection can be established.
If the port is closed, the target normally responds differently.
🧪 Linux — TCP Connect Scan
Run against your own computer:
nmap -sT 127.0.0.1
🪟 Windows — TCP Connect Scan
PowerShell:
nmap -sT 127.0.0.1
🍎 macOS — TCP Connect Scan
nmap -sT 127.0.0.1
This is a good scan type for beginners because it uses the normal TCP connection mechanism.
3. SYN Scan
Another important scan is:
-sS
This is commonly called a TCP SYN scan.
Conceptually:
Client Target
SYN ------------------------>
<------------------------ SYN/ACK
RST ------------------------>
Instead of completing a normal application connection, Nmap analyzes the response to the SYN.
This can make it useful for efficient port discovery.
⚠️ Privileges
SYN scanning generally requires elevated privileges because Nmap needs lower-level access to construct/send packets.
On Linux/macOS you may therefore see:
sudo nmap -sS 127.0.0.1
On Windows, running Nmap from an appropriately elevated environment may be required depending on the installation and scan behavior.
Do not use elevated privileges unless necessary.
🐧 Linux
sudo nmap -sS 127.0.0.1
🍎 macOS
sudo nmap -sS 127.0.0.1
🪟 Windows
For this course, use the TCP Connect scan if you don't specifically need SYN scanning:
nmap -sT 127.0.0.1
If you later study SYN scanning on Windows, we'll configure a dedicated authorized lab and discuss the required privileges.
4. TCP Connect vs SYN Scan
| Feature | TCP Connect -sT | SYN -sS |
|---|---|---|
| Uses normal TCP connection | ✅ | Not fully |
| Requires elevated privileges | Usually no | Usually yes |
| Common beginner choice | ✅ | Advanced |
| Sends TCP SYN | ✅ | ✅ |
| Completes normal connection | Yes | Generally no |
The key idea:
Different scan techniques interact with the network differently.
5. UDP Scanning
TCP isn't the only transport protocol.
Some services use UDP.
Nmap provides:
-sU
for UDP scanning.
Example:
nmap -sU 127.0.0.1
Linux
sudo nmap -sU 127.0.0.1
macOS
sudo nmap -sU 127.0.0.1
Windows
nmap -sU 127.0.0.1
UDP scans can take considerably longer than simple TCP scans.
⚠️ Important UDP Note
UDP doesn't have the TCP three-way handshake.
Instead:
TCP
SYN
↓
SYN/ACK
↓
ACK
while UDP is conceptually:
UDP
Datagram
↓
Target
Because UDP doesn't establish a TCP-style connection, determining whether a UDP port is open can be more complicated.
Nmap may report:
open
open|filtered
closed
and other states depending on responses.
6. Scan Only Specific UDP Ports
Instead of scanning many UDP ports, start with a small authorized test:
nmap -sU -p 53 127.0.0.1
You can also test several:
nmap -sU -p 53,123,161 127.0.0.1
These are common UDP-related ports, but whether anything is actually listening depends entirely on your system.
7. Why Start Small?
Security testing isn't about generating as much traffic as possible.
A professional approach is:
Small test
↓
Observe result
↓
Understand
↓
Expand scope if authorized
This reduces unnecessary traffic and makes your results easier to understand.
8. Host Discovery
Nmap's:
-sn
option performs host discovery without a normal port scan.
For localhost:
nmap -sn 127.0.0.1
You should normally see that the host is up.
9. Port States
Let's review the important states.
🟢 Open
80/tcp open
An application appears to be listening.
🔴 Closed
80/tcp closed
The port is reachable, but no application appears to be listening.
🟡 Filtered
80/tcp filtered
A firewall or filtering mechanism prevents Nmap from determining the port's state clearly.
🟠 Open|Filtered
This can occur particularly during UDP scanning when Nmap cannot distinguish between an open port and one being filtered.
10. Service Detection
From Day 6:
-sV
tries to identify services and versions.
Try:
nmap -sV 127.0.0.1
You can combine it with a specific port list:
nmap -sV -p 22,80,443 127.0.0.1
11. OS Detection
Nmap also has operating-system detection:
-O
For example:
sudo nmap -O 127.0.0.1
Linux
sudo nmap -O 127.0.0.1
macOS
sudo nmap -O 127.0.0.1
Windows
You can try:
nmap -O 127.0.0.1
but OS detection may require elevated privileges and appropriate packet access.
⚠️ Important OS Detection Limitation
OS detection isn't magic.
Nmap makes an inference based on network behavior.
It may report:
OS details:
...
or:
Aggressive OS guesses:
...
The result is not necessarily 100% accurate.
A security professional should treat OS detection as evidence, not unquestionable truth.
12. Service Detection + OS Detection
You can combine options:
sudo nmap -sV -O 127.0.0.1
This asks Nmap to gather:
Ports
+
Services
+
Versions
+
OS characteristics
Again, only use this on an authorized target.
13. Verbose Mode
Nmap provides verbose output using:
-v
Example:
nmap -v 127.0.0.1
For even more detail:
nmap -vv 127.0.0.1
Verbose output can help you understand what Nmap is doing.
14. Why Verbose Output Is Useful
Instead of only seeing:
80/tcp open http
you may see additional information about the scan process.
For beginners, this is useful because you're learning:
How the tool reaches its conclusions.
15. Scan Timing
Nmap provides timing templates:
-T0
-T1
-T2
-T3
-T4
-T5
They range conceptually from very slow/cautious to very fast/aggressive.
For your own localhost lab, you can experiment with:
nmap -T3 127.0.0.1
and:
nmap -T4 127.0.0.1
Don't use aggressive timing against networks without authorization.
16. Recommended Beginner Approach
Don't start by memorizing dozens of Nmap switches.
Start with:
1. Target
2. Port discovery
3. Service detection
4. Interpretation
5. Documentation
For example:
nmap 127.0.0.1
Then:
nmap -sV 127.0.0.1
Then:
nmap -p 22,80,443 127.0.0.1
This builds understanding gradually.
🧪 Day 7 Practical Lab
We will perform the same basic exercises on all three operating systems.
🐧 Linux
1. Basic scan
nmap 127.0.0.1
2. TCP Connect
nmap -sT 127.0.0.1
3. SYN scan
sudo nmap -sS 127.0.0.1
4. Service detection
nmap -sV 127.0.0.1
5. Specific ports
nmap -p 22,80,443 127.0.0.1
6. Port range
nmap -p 1-100 127.0.0.1
7. Verbose mode
nmap -v 127.0.0.1
8. Save results
nmap -sV 127.0.0.1 -oN day7-linux.txt
🪟 Windows
Open PowerShell.
1. Basic scan
nmap 127.0.0.1
2. TCP Connect
nmap -sT 127.0.0.1
3. Service detection
nmap -sV 127.0.0.1
4. Specific ports
nmap -p 22,80,443 127.0.0.1
5. Port range
nmap -p 1-100 127.0.0.1
6. Verbose mode
nmap -v 127.0.0.1
7. Save results
nmap -sV 127.0.0.1 -oN day7-windows.txt
For SYN/OS-detection exercises on Windows, use an elevated Nmap environment only in your authorized lab. We'll cover that more carefully when we build the lab.
🍎 macOS
1. Basic scan
nmap 127.0.0.1
2. TCP Connect
nmap -sT 127.0.0.1
3. SYN scan
sudo nmap -sS 127.0.0.1
4. Service detection
nmap -sV 127.0.0.1
5. Specific ports
nmap -p 22,80,443 127.0.0.1
6. Port range
nmap -p 1-100 127.0.0.1
7. Verbose mode
nmap -v 127.0.0.1
8. Save results
nmap -sV 127.0.0.1 -oN day7-macos.txt
🧪 Practical Comparison
Now compare these three scans:
nmap 127.0.0.1
nmap -sT 127.0.0.1
nmap -sV 127.0.0.1
Create this table:
| Scan | What does it tell you? |
|---|---|
| Basic | __________ |
-sT | __________ |
-sV | __________ |
The objective isn't simply to see which scan finds "more."
The objective is to understand why the results differ.
🔬 Practical Exercise: TCP vs UDP
On your own computer:
TCP
nmap -sT -p 22,80,443 127.0.0.1
UDP
nmap -sU -p 53,123,161 127.0.0.1
Compare:
TCP
↓
Connection-oriented
UDP
↓
Connectionless
UDP results can take longer and may show open|filtered.
That's expected.
📊 Day 7 Nmap Report
Create a report like this:
| Scan | Target | Result |
|---|---|---|
| Basic | 127.0.0.1 | ______ |
| TCP Connect | 127.0.0.1 | ______ |
| Service Detection | 127.0.0.1 | ______ |
| UDP | 127.0.0.1 | ______ |
| OS Detection | 127.0.0.1 | ______ |
Then record:
Open TCP ports:
________________
Open UDP ports:
________________
Detected services:
________________
Detected versions:
________________
OS detection result:
________________
🧠 Reading an Nmap Result
Suppose you see:
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH ...
80/tcp open http Apache ...
443/tcp closed https
Your interpretation should be:
Port 22
TCP
SSH
Open
An SSH service appears to be accessible.
Port 80
TCP
HTTP
Open
An HTTP service appears to be accessible.
Port 443
TCP
HTTPS
Closed
The port is reachable, but Nmap did not find an accessible service there.
Don't immediately assume any of these represent vulnerabilities.
🔐 Security Analysis Mindset
A professional doesn't stop at:
"Port 22 is open."
Instead, they ask:
Is SSH expected?
↓
What version?
↓
Is it supported?
↓
Is configuration secure?
↓
Who is allowed to connect?
↓
Is authentication properly configured?
↓
What is the business risk?
That's the difference between running a tool and performing a security assessment.
📝 Day 7 Assignment
Answer these questions:
1.
What is a TCP Connect scan?
2.
What does -sS represent?
3.
Why does SYN scanning generally require elevated privileges?
4.
What does -sU do?
5.
Why can UDP scanning be slower or less straightforward?
6.
What does -sV do?
7.
What does -O attempt to determine?
8.
What does -v do?
9.
What is the difference between an open and filtered port?
10.
Why shouldn't an ethical hacker treat Nmap's OS detection as absolute proof?
11.
Why should you start with a small authorized scan?
12.
Why is an open port not automatically a vulnerability?
🏆 Day 7 Challenge
On your own computer, perform:
1️⃣ Basic scan
↓
2️⃣ TCP Connect scan
↓
3️⃣ Service detection
↓
4️⃣ Specific-port scan
↓
5️⃣ Small UDP scan
↓
6️⃣ Compare results
↓
7️⃣ Save the results
↓
8️⃣ Write your observations
Then answer:
Which scan gave you the most useful information, and why?
Don't answer simply with "because it found more ports."
Explain what additional information it provided.
⚠️ Ethical Hacking Reminder
LEARNING PURPOSE ONLY: All Nmap techniques in this lesson are provided for educational and authorized security testing. Use them only against systems you own or have explicit permission to test. Do not substitute a public IP address, company server, school network, Wi-Fi network, cloud server, or another person's computer for
127.0.0.1without authorization.
Permission → Scope → Test → Document → Remediate → Retest
✅ Day 7 Summary
Today you learned:
TCP Connect scanning
SYN scanning
UDP scanning
Host discovery
TCP vs UDP scanning
Open/closed/filtered states
Service detection
OS detection
Verbose mode
Scan timing
Saving scan results
Comparing scan types
Nmap usage on Linux
Nmap usage on Windows
Nmap usage on macOS
Most important lesson:
A security tool is only as valuable as your understanding of its results.
Don't become someone who simply memorizes Nmap commands.
Become someone who can explain what the result means, why it matters, and how the system can be secured.
🔜 Day 8 — Wireshark Fundamentals
Tomorrow we'll move from scanning to packet analysis.
We'll learn:
What Wireshark is
Packets vs frames
Capture interfaces
Ethernet
IP packets
TCP packets
UDP packets
DNS traffic
HTTP/HTTPS concepts
Capture filters vs display filters
Following traffic
Practical packet capture on Linux, Windows & macOS
Safe analysis of your own traffic
🔐 LEARN → PRACTICE → UNDERSTAND → SECURE.
No comments:
Post a Comment