nmap, one scan per page
Twenty-eight lessons on what nmap is: a network scanner born in Phrack in 1997 and why a network gets mapped; host discovery with -sn and the ping idea; the TCP handshake and the connect scan; the half-open SYN scan with -sS and why raw packets want root; the port states open, closed and filtered; service versions with -sV, OS guesses with -O and the timing dial -T0 through -T5; the script engine with -sC and one named script, saving maps with -oN -oX -oG, and the UDP door with -sU; firewalls read honestly, reports not over-trusted, and teaching a friend their first honest scan of their own machine in one sitting.
One host you own, one honest hour. That's the rhythm.
nmap, one scan per page
Twenty-eight lessons on what nmap is: a network scanner born in Phrack in 1997 and why a network gets mapped; host discovery with -sn and the ping idea; the TCP handshake and the connect scan; the half-open SYN scan with -sS and why raw packets want root; the port states open, closed and filtered; service versions with -sV, OS guesses with -O and the timing dial -T0 through -T5; the script engine with -sC and one named script, saving maps with -oN -oX -oG, and the UDP door with -sU; firewalls read honestly, reports not over-trusted, and teaching a friend their first honest scan of their own machine in one sitting.
Set in Space Grotesk, Inter and JetBrains Mono (SIL Open Font License).
Every fact is as the official source states it, fetched and read during this build: the local nmap(1) guide and nmap -h of Nmap 7.94SVN on this machine, the truth for flags, port states and timing templates, and the Wikipedia articles Nmap, Port scanner, Ping, Internet Control Message Protocol, TCP, UDP, TCP Half-Open, SYN Flood, Service Discovery, Port (computer networking), Firewall (computing) and Netcat. No facts come from Reddit, Stack Overflow, vendor blogs or commercial sites. Every scan quoted ran on this machine's loopback only (127.0.0.1, localhost, 127.0.0.53) and is cached verbatim beside this book; the -oN, -oX and -oG files went to build scratch only.
Honest notes: 'TCP scan' and 'List of Nmap scripts' returned 404, not used; 'Nmap Scripting Engine' is a redirect stub back to Nmap; 'ICMP' redirects to Internet Control Message Protocol, which was read; NSE facts come from the Nmap article itself. SAFETY LAW: no third-party host was ever scanned; raw-packet scans (-sS, -O, -sU) ran as root on loopback, sudo never typed; no filtered-port or firewall-evasion demo ran, and both gaps are stated. Independent, not affiliated with the Nmap Project or the Wikimedia Foundation.
Your purchase is for personal use only. You do not have redistribution rights: please do not share, resell, or republish this book or its pages.
© 2026 Steve Hodgkiss. All rights reserved. Personal use only; no redistribution rights.
Edition 1.0 · stevehodgkiss.net
Contents
Per the Wikipedia Port scanner article, citing RFC 4949, a port scan is a process that sends client requests to a range of server port addresses with the goal of finding an active port; this is not a nefarious process in and of itself. Per the Wikipedia Nmap article, in 2003 the Supreme Court of Finland ruled that systematic port scanning for unauthorised break-in amounted to an attempted computer break-in, and security and systems administrators use Nmap to assess their own networks for vulnerabilities. Per this book's plan, the law of this book is: scan only networks you own or are authorized to scan.
The law first
The honest middle, per the Port scanner article: a scan is a probe with the goal of finding an active port, and this is not a nefarious process in and of itself.
The red edge is real: in 2003 Finland's Supreme Court held that scanning systematically carried out toward a break-in amounted to an attempted computer break-in.
So this book's law, per this book's plan: scan only what you own or are authorized to scan. Every capture here scanned this machine only.
Before your next scan, say aloud whose network it is; if the answer is not you or a yes from the owner, stop.
Per the local nmap -h help text, -sn is the ping scan that disables the port scan. Per the local nmap(1) reference guide, -sn tells Nmap not to do a port scan after host discovery, and only print out the available hosts that responded to the host discovery probes; this is often known as a ping scan. This machine's capture: nmap -sn 127.0.0.1 answered Host is up, 1 host up, in 0.01 seconds.
The -sn sweep
One flag, one question. Per the local help text: -sn: Ping Scan - disable port scan. The guide spells it out: not to do a port scan after host discovery, only print the hosts that responded.
Our capture, this machine only: nmap -sn 127.0.0.1 answered Host is up, one IP, one host up, in 0.01 seconds. No port was touched.
The sweep is the polite first move: presence, nothing else.
Run one -sn sweep against your own loopback and write down the one fact it proves.
Per the local nmap(1) reference guide, the six port states recognized by Nmap are open, closed, filtered, unfiltered, open|filtered and closed|filtered; open means an application is actively accepting TCP connections, and a closed port is accessible but no application is listening on it. Per the Wikipedia Port scanner article, a scan result is usually generalized as open, closed or filtered. This machine's capture: nmap -p 23,111 127.0.0.1 answered 23/tcp closed telnet and 111/tcp closed rpcbind.
Open or closed
Open, per the guide: An application is actively accepting TCP connections on that port. Closed: the port answers, but there is no application listening on it.
Our capture: nmap -p 23,111 127.0.0.1 answered 23/tcp closed telnet and 111/tcp closed rpcbind. The host spoke; nobody was home.
Closed is an answer, not a failure. It proves the host is alive and the door is shut.
Scan three ports on your own machine and sort the answers into open, closed and unanswered.
Per the local nmap(1) reference guide, most scan types are only available to privileged users because they send and receive raw packets, which requires root access on Unix; on Unix boxes only the privileged user root is generally able to send and receive raw TCP packets. Per the Wikipedia SYN Flood article, a flood of SYNs makes a server retain state for large numbers of incomplete half-open connections, leaving insufficient resources for new legitimate connections. This book's runs: the shell runs as root, so raw-packet scans ran directly, on loopback only, and sudo was never typed.
Root and raw
Why some scans ask for root. Per the local guide, most scan types send and receive raw packets, which requires root access; only the privileged user root is generally able to send and receive raw TCP packets.
The red kinship: per the SYN Flood article, floods make a server retain state for large numbers of incomplete half-open connections.
This book's runs: as root, on loopback only, sudo never typed. Power and restraint travel together.
Check which of your last scans needed root, and say why the raw packets wanted it.
Per the local nmap(1) reference guide, Nmap offers a simpler approach with six timing templates; the template names are paranoid (0), sneaky (1), polite (2), normal (3), aggressive (4), and insane (5); normal mode is the default and -T3 does nothing, aggressive mode speeds scans up by assuming a reasonably fast and reliable network, and insane mode assumes an extraordinarily fast network or trades accuracy for speed. Per the local nmap -h help text, -T sets the timing template, higher is faster. Per the Wikipedia Nmap article, Nmap can adapt to network conditions including latency and congestion during a scan. This machine's capture: nmap -T4 -p 22,80 127.0.0.1 answered both ports open.
The -T dial
Speed is a dial, not a switch. Per the local help text, -T sets the timing template (higher is faster); the guide names all six: paranoid (0), sneaky (1), polite (2), normal (3), aggressive (4), and insane (5).
Normal mode is the default and so -T3 does nothing; aggressive mode speeds scans up by assuming a fast, reliable network.
Our capture: nmap -T4 -p 22,80 127.0.0.1, both open. The article adds that Nmap adapts to latency and congestion anyway.
Run one small scan at -T2 and once at -T4 on your machine and feel the dial move.
Per the local nmap -h help text, --script takes a comma-separated list of script names. This machine's capture: nmap --script=http-title -p 80 127.0.0.1 answered the port open and added the script line http-title: Apache2 Ubuntu Default Page: It works. A second captured run, nmap -sC -p 22,6379 127.0.0.1, returned ssh-hostkey lines with ECDSA and ED25519 fingerprints.
One named script
One scan, one named question: our capture ran nmap --script=http-title -p 80 127.0.0.1, and the script answered Apache2 Ubuntu Default Page: It works.
The default set in action: our -sC capture on ports 22 and 6379 returned ssh-hostkey lines, ECDSA and ED25519 fingerprints.
Name the script the way you name the port: a scan you can explain is a scan you can repeat.
Run one named script against one open port on your own machine and log its single answer.
Per this book's plan, the last lesson hands nmap to a friend in one honest hour: five captured lines from this book, typed by the learner on the learner's own machine, read aloud by the teacher. The captures behind the five lines: the -sn sweep, the three-port first scan, the version-light read, the wrong OS guess, and the saved grepable line.
Teaching a scan
The last piece is passing the tool on: one friend, one honest hour, per this book's plan. They type; you read aloud.
Five lines, this book's captures: nmap -sn 127.0.0.1, the first scan reading open ssh, open http, open redis, the -sV line naming OpenSSH 9.6p1, the -O guess of Linux 2.6.32 against the real 6.8 kernel, and the saved Ports: 22/open/tcp//ssh///.
When they can say why the guess was wrong, the hour is done and the scanner is theirs.
Sit with one friend and teach this book in one sitting; they type the five lines, you read each answer aloud.