Key takeaways
- Open = a service is listening; closed = reachable but nothing listening; filtered = blocked.
- -sV adds service and version detection to each open port.
- Only scan systems you own or have written permission to test.
- Use results defensively: close what you don’t need.
What Nmap is
Nmap (“Network Mapper”) is a free, widely used tool for discovering hosts and the services they expose. It’s usually the first real tool people reach for in networking and security labs. Network administrators use it to audit their own systems, and security learners use it to understand how services appear from the outside.
Golden rule
Only scan systems you own or have explicit written permission to test. Unauthorised scanning can break the law and the rules of your network provider. For practice, use your own lab machines or the test host the Nmap project provides, scanme.nmap.org, within its stated fair-use limits.
Your first scan
A simple, low-impact command is enough to start:
nmap -sV scanme.nmap.org
It checks the most common ports and tries to identify the service on each one that’s open. Useful variations for your own lab:
nmap -sn 192.168.1.0/24lists which hosts are up on your home network without scanning ports.nmap -p 22,80,443 hostchecks only specific ports.nmap -Pn hostskips the ping step, useful when a host doesn’t answer ping.
Reading port states
- open: something is actively listening and accepting connections.
- closed: the host responded, but nothing is listening on that port.
- filtered: a firewall or filter is blocking Nmap from telling whether the port is open.
- open|filtered: Nmap can’t tell which of the two applies, which is common with UDP.
The -sV flag adds service and version detection, turning a bare port number like 22 into something readable such as “OpenSSH 8.9.” That is far more useful, because you can then check whether the software is current. The Port Reference table on the Tools page is a quick lookup for what common ports usually mean while you read results.
Using results defensively
- List what’s open on your own systems and ask whether each service is needed.
- Close or firewall anything unnecessary, especially remote-admin ports exposed to the internet.
- Patch outdated versions that
-sVreveals. - Re-scan after changes to confirm they worked.
Scanning is only the first step. Understanding the results and fixing the weak points is where the value is, and it connects to habits like hardening web servers and fixing application-level flaws.
Frequently asked questions
Is Nmap legal?
The tool itself is legal and widely used. Scanning systems without permission may not be, so only test what you own or are authorised to test.
Does Nmap hack systems?
No. It discovers hosts, ports and services. What you do with that information, and whether you have permission, is what matters.
What does a filtered port mean?
A firewall or similar device is dropping or blocking the probes, so Nmap can’t determine whether the port is open.
What should I learn after Nmap?
Basic networking (TCP/IP, DNS, HTTP), Linux, and then web application security basics in intentionally vulnerable labs.
Keep reading
SQL Injection and XSS, Explained Simply
Two of the most common web vulnerabilities, their shared root cause, short safe-versus-unsafe code examples and the standard fixes.
Read article →Password Security in 2026: Why Length Beats Complexity
Why long passphrases and unique passwords protect you better than short, symbol-heavy ones, how entropy works, and the habits that stop most account takeovers.
Read article →A Practical WordPress Hardening Checklist
Most WordPress compromises come from basics being skipped. This checklist covers updates, logins, backups and security headers.
Read article →