You cannot defend an asset you do not know exists. Threat actors routinely scan external IP ranges and internal subnets searching for exposed management ports, deprecated protocols, and misconfigured services. To secure an environment, defensive teams must maintain an equally rigorous view of their attack surface.

Network Mapper, commonly known as Nmap, is one of the most reliable tools for this task. While offensive testers frequently use it for reconnaissance, Nmap was built to be dual-purpose. This guide covers core scanning mechanics, essential command flags for network auditing, service fingerprinting techniques, and methods to detect unauthorized infrastructure changes.

Why Network Defenders Need Nmap

Modern asset management systems often rely on agent-based telemetry. While endpoint detection agents provide deep insight into managed systems, they fail to report unmanaged network switches, rogue Internet of Things (IoT) hardware, shadow cloud instances, or legacy systems where agents cannot run.

Network-level scanning provides ground truth from the vantage point of an outside observer. Running regular Nmap scans helps defenders validate firewall rule enforcement, verify that exposed ports match configuration baselines, and discover services mistakenly exposed to untrusted subnets.

How Nmap Interacts with the TCP/IP Stack

To interpret Nmap scan results correctly, defenders must understand the network handshake mechanics behind each probe. Nmap determines port status by evaluating how a target responds to specific packets.

TCP SYN Scanning (-sS)

The SYN scan, often called a half-open scan, is Nmap's default mode when executed with administrative privileges. The scanner sends a packet with the SYN (synchronize) flag set. If the port is open, the target replies with a SYN-ACK (synchronize-acknowledge) packet. Instead of completing the three-way handshake with an ACK, Nmap immediately transmits an RST (reset) packet to tear down the connection.

Because the connection never finishes opening, application logs often fail to record the attempt, making it faster and less resource-intensive on the target system.

TCP Connect Scanning (-sT)

When run without root or administrator permissions, Nmap falls back to a full TCP Connect scan. This technique invokes the underlying operating system network system calls to establish a complete three-way handshake before terminating the session.

Connect scans take longer to complete and produce higher overhead on target applications. However, they are useful when auditing systems across certain proxy configurations or when strict local privilege controls prevent raw packet generation.

UDP Scanning (-sU)

UDP is connectionless, meaning services rarely respond to empty probe packets unless configured to do so. If Nmap sends a UDP packet to a closed port, the host operating system typically generates an ICMP Port Unreachable packet. If the port is open, the service may return an application-specific response, or it may drop the probe entirely.

Because packet drops look identical to firewall drops, Nmap marks these states as open|filtered. UDP audits take significantly longer due to ICMP rate-limiting enforced by modern operating systems, but scanning critical UDP protocols like DNS (port 53), NTP (port 123), and SNMP (port 161) remains a defensive necessity.

Core Defensive Scanning Techniques

Defenders should tailor scans to their specific investigative objective rather than using a one-size-fits-all command. Here are the core scanning workflows used in network defense.

1. Host Discovery Across a Subnet

Before scanning thousands of ports, identify which hosts are actively responding. The ping sweep command disables port scanning and relies solely on ICMP echo requests, TCP SYN to port 443, TCP ACK to port 80, and ICMP timestamp queries:

sudo nmap -sn 192.168.10.0/24

On a local Ethernet segment, Nmap will automatically use ARP requests instead, providing an accurate list of live MAC addresses regardless of local firewall rules.

2. Port Scoping and Port States

By default, Nmap scans the 1,000 most common ports. For critical infrastructure, defenders should scan all 65,535 TCP ports to catch administrative services running on high non-standard ports:

sudo nmap -sS -p- 192.168.10.50

Pay attention to the three primary states reported:

  • Open: An application is actively accepting connections. Investigate whether the service aligns with business requirements.
  • Closed: The host received the probe and sent an RST, meaning no application is listening. The host is live and reachable.
  • Filtered: Nmap received no response or received an ICMP administrative filter message. A firewall, packet filter, or router ACL is blocking the traffic.

3. Service Version Detection

An open port only reveals half the picture. Defenders need to know the specific software and version running on that port. Use the -sV flag to instruct Nmap to interrogate listening services using application-specific banners and handshakes:

sudo nmap -sS -sV --version-intensity 5 192.168.10.50

The intensity flag ranges from 0 to 9. Higher numbers query an extensive probe database to identify uncommon software or customized service banners.

Leveraging the Nmap Scripting Engine (NSE) for Audits

The Nmap Scripting Engine (NSE) allows security teams to automate vulnerability checks and configuration audits using Lua scripts. Scripts are grouped into categories such as default, safe, discovery, and vuln.

Defenders should avoid running the entire vuln category unmonitored in production environments, as some scripts can destabilize fragile legacy software. Instead, run targeted, non-intrusive scripts.

Auditing TLS/SSL Configurations

Identify weak ciphers, deprecated protocol versions (such as SSLv3 or TLS 1.0), and certificate expiration dates across web servers:

nmap -p 443 --script ssl-enum-ciphers,ssl-cert 192.168.10.50

The script grades each cipher suite and flags obsolete algorithms like RC4 or 3DES, helping administrators meet compliance requirements.

Checking for Insecure SMB Settings

Verify that file shares are not exposing sensitive data without authentication:

sudo nmap -p 445 --script smb-security-mode,smb2-security-mode 192.168.10.0/24

This check reveals whether message signing is required, helping administrators identify systems susceptible to SMB relay attacks.

Baseline Tracking and Drift Detection

A single scan represents a point in time. Real defensive value comes from comparing scans over days, weeks, and months to catch unauthorized changes. Always export results in multiple formats using the -oA flag, which writes output in normal, XML, and grepable formats simultaneously:

sudo nmap -sS -sV -oA /var/log/nmap/baseline_$(date +%F) 192.168.10.0/24

You can then use the ndiff utility to compare the baseline XML file against a subsequent scan to highlight discrepancies:

ndiff baseline_2026-03-01.xml baseline_2026-03-08.xml

Any line prefixed with a plus sign indicates a newly opened port or newly discovered host, providing an immediate trigger for internal investigation.

Common Scanning Mistakes to Avoid

Network auditing can introduce operational friction if executed carelessly. Keep these common pitfalls in mind:

  • Overwhelming fragile endpoints: Aggressive timing templates like -T4 or -T5 can saturate low-bandwidth WAN links or crash legacy embedded devices (such as industrial PLCs or printers). Use default -T3 or conservative -T2 templates for sensitive environments.
  • Treating filtered ports as secure: A filtered port indicates a packet boundary exists, not that the service behind it is patched. An internal attacker who compromises that intermediate boundary will see the port as open.
  • Failing to scan UDP: Because UDP scanning is slow, teams frequently skip it entirely, leaving exposed DNS resolvers, SNMP agents with default community strings, and TFTP servers completely unmonitored.
  • Running scans without operational awareness: An unannounced internal scan may trigger high-severity alerts inside your Security Operations Center (SOC). Coordinate scanning schedules with monitoring teams to prevent unnecessary alert fatigue.

Defensive Scanning Checklist

Use this step-by-step checklist to integrate Nmap into your recurring security operations:

  1. Define the authorized scope: Document IP ranges, excluded systems (such as medical devices or critical production controllers), and approved scanning windows.
  2. Establish a discovery baseline: Run a host discovery ping sweep (-sn) to verify asset counts against your CMDB.
  3. Audit exposed perimeter services: Perform a full TCP port scan (-p-) and targeted UDP scan on all publicly accessible IP addresses.
  4. Fingerprint active versions: Run service version detection (-sV) to flag end-of-life operating systems and outdated web server binaries.
  5. Execute targeted NSE checks: Run focused scripts to audit TLS cipher suites, SSH key algorithms, and administrative interfaces.
  6. Compare results: Parse the generated XML files through ndiff or a SIEM pipeline to detect unexpected configuration drift.
  7. Remediate and repeat: Close unused ports, restrict administrative access to internal VPNs, and schedule automated scans on a weekly cadence.