Network Reconnaissance Fundamentals: A Practical Guide to Nmap

Active reconnaissance is the first phase of any security audit. Nmap (Network Mapper) is the industry-standard tool for discovering open ports and mapping host parameters.

1. Standard SYN Scan (-sS)

Often called a “stealth scan,” the TCP SYN scan sends a SYN packet to target ports. If it receives a SYN-ACK, it indicates the port is open. Nmap sends a RST (Reset) packet instead of completing the 3-way handshake, minimizing logs on target systems.

nmap -sS -pn 192.168.1.1

2. Service Version Detection (-sV)

Obtaining open port numbers is not enough; we must find the exact software and version version running on those ports to identify vulnerable setups.

nmap -sV 192.168.1.1

3. Operating System Fingerprinting (-O)

Nmap analyzes TCP/IP packet structure details (like TTL and TCP window size) to estimate the exact OS type and kernel version of the remote host.

nmap -O 192.168.1.1

4. Nmap Scripting Engine (NSE)

NSE scripts automate vulnerability verification. The “vuln” script suite queries public CVE databases to verify if target services are exploitable.

nmap --script vuln 192.168.1.1

Defensive Action: Set up host firewall rules to detect rapid port scan attempts and configure blocklists to automatically ban offending IP addresses.