Nmap on Linux

Nmap is a very powerful tool with lots of options and features to visualize your network. Check which services are running on various hosts and find suspicious malicious programs running in your network. Even though Nmap is the swiss-army knife for network scanning, most of its benefits can be gained by the average Network Administrator without diving deep in to its complications. Chances are, most of the time you will find yourself using common switches even if you know all of them.

The basic syntax for Nmap is:

nmap 192.168.0.1

the above command scans the given host with defaults - standard TCP connect method (-sT option) and known ports (those specified in the /etc/services file. You may need to scan a whole subnet, in which case you can use:

nmap 192.168.0.1/24
nmap 192.168.0.*

both the command would do the same here.

One of the simplest scan methods that I come up with almost every day is the Ping Scan:

nmap -sP 192.168.0.1
Starting nmap 3.70 ( http://www.insecure.org/nmap/ ) at 2008-01-11 11:35 WIT
Host web.smiert.org (192.168.0.1) appears to be up.
MAC Address: 00:14:5E:1B:15:F0 (Unknown)
Nmap run completed -- 1 IP address (1 host up) scanned in 0.283 seconds

the -sP option simply pings the host and reports back whether the host is up or down. Run in the local network, it gives you some additional detail such as MAC Address and the Company for which the NIC card is registered. It is also possible to ping sweep your entire network by specifying a network address and the bitmask.

Stealth Scanning might come in handy too (-sS):

nmap -sS 192.168.0.1

Starting nmap 3.70 ( http://www.insecure.org/nmap/ ) at 2008-01-11 11:36 WIT
Interesting ports on web.smiert.org (192.168.0.1):
(The 1653 ports scanned but not shown below are in state: closed)
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
111/tcp open rpcbind
443/tcp open https
967/tcp open unknown
4444/tcp open krb524
8080/tcp open http-proxy
MAC Address: 00:14:5E:1B:15:F0 (Unknown)

Nmap run completed -- 1 IP address (1 host up) scanned in 0.353 seconds

The -sT method (default) makes a full connection to that port to see whether the port is open. But in a stealth scan a SYN packet is sent to the host and waits until a SYN from the target host is received to see whether the port is open or closed. In other words does not make a full connection, which reduces the chance of being seen on a target log file.

Scan specific ports and port ranges (-p) :

nmap -sS 192.168.0.1 -p 22,80,50-500

Starting nmap 3.70 ( http://www.insecure.org/nmap/ ) at 2008-01-11 13:15 WIT
Interesting ports on web.smiert.org (192.168.0.1):
(The 448 ports scanned but not shown below are in state: closed)
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
111/tcp open rpcbind
443/tcp open https
MAC Address: 00:14:5E:1B:15:F0 (Unknown)

Nmap run completed -- 1 IP address (1 host up) scanned in 0.301 seconds

the above command scans the target host for ports 25, 80 and the range between 50 and 500.

OS detection (-O):

nmap -sS 192.168.0.1 -O

Starting nmap 3.70 ( http://www.insecure.org/nmap/ ) at 2008-01-11 13:16 WIT
Interesting ports on web.smiert.org (192.168.0.1):
(The 1653 ports scanned but not shown below are in state: closed)
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
111/tcp open rpcbind
443/tcp open https
967/tcp open unknown
4444/tcp open krb524
8080/tcp open http-proxy
MAC Address: 00:14:5E:1B:15:F0 (Unknown)
Device type: general purpose
Running: Linux 2.4.X|2.5.X|2.6.X
OS details: Linux 2.4.18 - 2.6.4 (x86)
Uptime 36.737 days (since Wed Dec 5 19:35:30 2007)

Nmap run completed -- 1 IP address (1 host up) scanned in 2.366 seconds

the -O option displays the Operating System and its version running on target system. This may not be accurate and may sometimes fail to identify the target OS. But most of the time you’ll end up being lucky…trust me…!

Detect the version of running services (-sV):

nmap -sV 192.168.0.1

Starting nmap 3.70 ( http://www.insecure.org/nmap/ ) at 2008-01-11 13:17 WIT
Interesting ports on web.smiert.org (192.168.0.1):
(The 1653 ports scanned but not shown below are in state: closed)
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 3.9p1 (protocol 1.99)
80/tcp open http Apache httpd 2.0.52 ((Red Hat))
111/tcp open rpcbind 2 (rpc #100000)
443/tcp open ssl/http Apache httpd 2.0.52 ((Red Hat))
967/tcp open rpc
4444/tcp open krb524?
8080/tcp open http Apache Tomcat/Coyote JSP engine 1.1
MAC Address: 00:14:5E:1B:15:F0 (Unknown)

Nmap run completed -- 1 IP address (1 host up) scanned in 10.524 seconds

You may also use the -A switch to request Nmap to check for OS version as well as Services version which is easier. There are many other options such as -D (decoy), -sU (UDP scan), etc; not specified in this tutorial that might be useful to you. Please check the nmap documentation and evolve you knowledge on Nmap.