Reconnaissance is the first and most critical stage of security auditing. Before you can assess or defend a network, you must catalog its active hosts, open ports, and running software versions. Nmap (Network Mapper) is the industry standard tool for this task.
Understanding TCP Port States
When Nmap probes a system, the port status will return as one of three primary states:
- Open: An application is actively listening for incoming TCP packets on this port.
- Closed: No application is listening, though the host is reachable.
- Filtered: A firewall or packet filter is blocking the probe, and Nmap cannot determine if the port is open or closed.
Common Scan Flag Modifiers
To perform audits efficiently without triggering intrusion alarms, use these scanning methods:
# TCP SYN Stealth Scan (Probes service versions and operating systems)
nmap -sS -sV -O -T4 target-ip.comThe -sS SYN scan sends a SYN packet but terminates the handshake with a Reset (RST) packet immediately after receiving a SYN-ACK, which avoids creating full connection log traces on older logging systems.