Nmap Security Scanner

A widely used software tool used for IP scanning.

Nmap requires at least the IP address or the subnet to scan. When used without any switches or flags (e.g. nmap 10.0.0.116), Nmap sends a TCP ACK packet to ports 80 and 443 of the target IP to determine if a host is up. Nmap also performs ARP and ND sweeps. If a host is detected, it also does a port sweep to find what ports the host has open.

Port Scanning

Switch	Type	Description
`-sS`	TCP SYN	Fast technique. Requests a connection without acknowledging it.
`-sT`	TCP connect	Tries to form a full connection by crafting packets using the network driver or the host OS.
`-sU`	UDP scan	Takes a long time, since UDP doesn't use ACKs. Requires a response from the host to determine the port state, otherwise times out
`-p`	Port Range	Specify a port range for Nmap to scan. By default, Nmap uses a preconfigured list of 1,000 commonly used ports.
`-sn`	Hop Count	Get the hop count to a host.
`-sV` `-A`	Aggressive Scanning	Tries to get the version of the detected service running on the host.