Nmap (Network Mapper) is a security scanner originally written by Gordon Lyon (also known by his pseudonym Fyodor Vaskovich) used to discover hosts and services on a computer network, thus creating a "map" of the network.

learn more… | top users | synonyms

45
votes
9answers
127k views

nmap find all alive hostnames and IPs in LAN

How can I issue a nmap command that shows me all the alive machines' IP addresses and corresponding hostname s in the LAN that I am connected? (if this can be done in another way/tool you surely are ...
19
votes
1answer
79k views

NMAP: Check if port 80 and 8080 is open

In our company, I want to check if users are running web servers on port 80 and 8080. I downloaded nmap and ran this command: nmap -p 80,8080 192.168.1.0-255 I got a list of IPs and tried to ...
10
votes
2answers
11k views

Nmap not scanning all ports

I've noticed that nmap only scans a bunch of known ports, and the only way i've managed to check 'em all is to put a "-p 0-65535" in. Why is that? am I wrong? is there a more popular way to scan all ...
7
votes
4answers
29k views

Can I use nmap to discover IPs and mac addresses?

When I need to locate the IPs of devices by their mac address on a Windows system, I normally use Advanced IP Scanner (from radmin.com) to scan the network, then I use arp -a to list the mac addresses....
7
votes
2answers
2k views

Nmap: find free IPs from the range

Is there a way to scan for free IPs on the network? I use nmap -sP 192.168.1.0/24 but this actually shows hosts that are up.
6
votes
3answers
7k views

nmap does not find alive hosts with ping scan

I try to ping scan my local network using nmap, but it doesn't seem to find machines that are for sure alive. It responses to ping but on to ping scan. Results for ping: $ ping 192.168.0.2 PING 192....
5
votes
4answers
7k views

Is there a way to see what is actually filtering TCP port communication?

nmap -p 7000-7020 10.1.1.1 Will output all the filtered ports Starting Nmap 6.40 ( http://nmap.org ) at 2015-03-04 12:18 EET Nmap scan report for 10.1.1.1 Host is up (0.00091s latency). PORT ...
5
votes
1answer
914 views

How to check if an IP address is free on a network

I'm gonna setup a Wireless router for a customer. They have subnet 10.253.48.0/24 What can I do to check if the IP 10.253.48.243 is available to set up the router? I'm on out on a local network at my ...
5
votes
5answers
4k views

Is there a Nagios plugin that uses Nmap and does port checking?

I need to monitor open and closed ports on dozens of hosts. I've found a Nagios plugin that does what I need, but I would have to use this script through NRPE. Some of the hosts are powered by Linux ...
4
votes
1answer
1k views

Completely getting rid of SSLv3 on Apache

Our security team is asking that we completely disable SSLv3 on some of our servers running Apache. I've used the SSLProtocol entry in the ssl.conf file (like SSLProtocol ALL -SSLv2 -SSLv3) and ...
4
votes
1answer
939 views

command for MAC broadcast

I am looking for a command to discover all hosts on the same LAN segment from a host with unassigned IP, default gateway, and subnet. I know there's ping 255.255.255.255 but that operates at layer 3 ...
4
votes
7answers
4k views

Scan for connected, powered on computers on a network?

I want to scan for powered on computers on my LAN and gather logs about that. I tried nmap but it didn't work very well (a lot of switched on computers are not getting detected). nmap -sP 192.168.2....
4
votes
1answer
3k views

Nmap ping scan over a VPN tunnel return all hosts alive?

I'm curious as to why running an nmap -sP (ping scan) on a remote subnet linked via a Cisco site-to-site IPSec tunnel returns "host up" status for every IP in the range. [root@xt ~]# nmap -sP 192.168....
4
votes
2answers
307 views

Removing new fingerprint detection message from nmap

I run a nmap scan of my hosts daily to check for open ports. sudo nmap -f -sS -sV --log-errors -append-output -p1-9999 host.com But along with the output I get a long list of fingerprint ...
3
votes
2answers
3k views

Test if an IP is being used in an internal network without using nmap

I can perform port scan using nmap to test if a given IP is being used, e.g. nmap -PR 192.168.1.9 However, nmap is not installed in most server, is it possible to have the same result (e.g. check ...
3
votes
3answers
3k views

Why do nmap -p <port> and nmap -A scans show different results?

I have a C# application that I've written that listens on port 789. It is running on a Windows XP Professional computer. Running netstat -an | find "789" TCP 0.0.0.0:789 0.0.0.0:0 ...
3
votes
3answers
2k views

VirtualBox guest responds to ping but all ports closed in nmap

I want to setup a test database on a vm for development purposes but I cannot connect to the server via the network. I've got Ubuntu 12.04vm installed on 12.04 host in Virtualbox 4.2.4 set to - ...
3
votes
1answer
807 views

Powershell and NMAP Information Sharing

I am working on a project where I would like to perform host documentation for a variety of items. Part of these items would be sourced from Powershell and the rest would be sourced from NMAP. For ...
3
votes
1answer
268 views

use of nmap clogged my network

I was using nmap to scan the mac addresses of my network.What I found was internet connections and rest of network services badly clogged the users were not able to connect to internet.After messing ...
3
votes
1answer
417 views

Automatic/scheduled check for open ports on list of servers

I need a way to configure a scheduled check for open ports on a list of servers and to get notified if something has changed from last check. what's the best way to do it? If there is some solution ...
3
votes
1answer
147 views

Identify where a port is blocked

I'm trying to find out where a port is being blocked by a firewall; either en-route to a host or by the host itself. If I run nmap I can see that the port is filtered. However, this could mean by the ...
3
votes
1answer
1k views

nmap and arp-scan inconsistent IP-MAC results

I seem to get variable and inconsistent results for the IP/MAC addresses from a particular machine, using nmap or arp-scan. The machine has 3 interfaces, and this is what it shows: $ uname -a Linux ...
3
votes
3answers
1k views

How to Hide OS Fingerprint of Virtual Machine?

Is it possible to make a linux virtual machine appear as the host machine to a network tool like nmap or Blue's Port Scanner without recompiling the kernel?
3
votes
1answer
952 views

Nmap external scan shows port open, ASA says port is not open, but do get an socket

Folks, have a weird one, need your expert help. For one of our heavily used external facing server which came up in an audit, nmap -Pn scan shows the following: Starting Nmap 5.51 ... Host ...
3
votes
1answer
2k views

Using nmap to scan open ports. iptables default policy affects other rules?

I'm trying to find out why changing my default iptables policy is affecting what nmap sees when it scans my host. Consider the following iptables setup: iptables -F iptables -A INPUT -p tcp -s 10.1....
3
votes
1answer
1k views

NMap route determination on Windows 7 x64 [closed]

C:\Windows\system32>nmap --iflist Starting Nmap 6.01 ( http://nmap.org ) at 2012-08-31 06:51 Central Daylight Time ************************INTERFACES************************ DEV (SHORT) IP/MASK ...
2
votes
3answers
459 views

Command line tools for ping HTTP? [closed]

Background : It's a common question as we can search at google "ping works but http does not" ping is not a reliable test of network connectivity. ping working just means enough of the IP stack is ...
2
votes
2answers
209 views

646/tcp open unknown

when I make nmap localhost I get PORT STATE SERVICE 22/tcp open ssh 25/tcp open smtp 111/tcp open rpcbind 631/tcp open ipp 646/tcp open unknown what is the port 646 ?
2
votes
2answers
1k views

IPtables: is there a minimum UDP packet size for a DNS lookup?

IPtables for a virtual dedicated server. I would like to block UDP scans and I was wondering whether there's a minimum packet size for a DNS lookup? Nmap sends 0-byte UDP packets (source : http:...
2
votes
2answers
2k views

Weird Port scanning results using nmap

I was scanning one of my friends servers using nmap and got these port details. PORT STATE SERVICE 22/tcp open ssh 42/tcp filtered nameserver 80/tcp open http 111/tcp open ...
2
votes
3answers
5k views

tcp port 554 open

I was running a routine security check of the machines I manage today and found in my nmap scans that TCP/554 is open, although when I run 'netstat -an' on the machine itself it doesn't show up, same ...
2
votes
2answers
431 views

nmap results to find open ports for SIP

I suspect that a firewall, or other security, on either the router, or on tleilax or doge is causing a problem with SIP calls. How do I establish that the connection is allowed and not being blocked? ...
2
votes
1answer
75 views

How to test iptables settings by port scanning? [closed]

I want to test my iptables and prove that it only allows traffic for given Protocol / Port - combinations. How I can use as a target for a port scan?
2
votes
3answers
3k views

How to list down hosts with nmap 5.51

I was using nmap 5.21 with the -PN, -F and --reason flags in version 5.21. I was outputting the results to an XML file. It would list ALL hosts (say I gave it a /24 subnet to scan. I then updated ...
2
votes
1answer
315 views

Why can NMAP not show some ports?

when I do "nmap localhost", some open ports are listed and others aren't. For Example SSH on 22 is listed, but SSH on 10022 is not. Host's port 10022 in my case is NAT port forwarding to a ...
2
votes
3answers
200 views

Why does nmap send two packets in order to test a single port

I run nmap with root privileges using sudo so I assume it has full access to creat raw sockets. Wireshark shows two packets used to test a single port when I used the command sudo nmap 192.168.110....
2
votes
1answer
394 views

nmap lists host as up despite being black listed

I have an iptables rule setup that marks addresses as suspicious if they connect on certain ports or any unopen ports. If more than three consecutive connections are made without authentication, then ...
2
votes
1answer
655 views

Trace /8 address space with nmap

I'm trying to sketch out a network topology map using the following command nmap -sP -PE -PS22,25,80 -PA21,23,80,3389 -PU -PO -oX topology.xml --traceroute 10.0.0.0/8 (10.0.0.0/8 because no one ...
2
votes
1answer
226 views

using nmap to guess remote OS and probe service details on a single port only

I am looking at scanning with nmap a large network in order to identify the OS of devices (-O--osscan-limit) probe for details of a service on a single port (I would have used -sV for all open ports)...
2
votes
1answer
3k views

Why does nmap report different results from localhost?

When I execute "nmap -sT -O localhost" per the Centos 5 deployment guide, I get: Not shown: 1677 closed ports PORT STATE SERVICE 22/tcp open ssh 80/tcp open http 8080/tcp open http-proxy ...
2
votes
1answer
550 views

Detecting network state with arping

I am developing system for detecting network actual state. One part is to get all IPs and their respective MAC addresses. Right now I am using arping in DAD (Duplicate Address Discovery) mode. I send ...
2
votes
1answer
241 views

NMap - running as root yields different response than running as another user

nmap -eeth1 [hostname] -p80 Running that command as root uses interface one and fails as expected (interface one is on a subnet blocked by the host.) Using interface 0 succeeds as it should. ...
2
votes
1answer
44 views

How to setup nmap ping count?

I need an arp-ping tool for windows Tried arp-ping http://www.elifulkerson.com/projects/arp-ping.php. Source address specification did not work in this tool. Then I came across nmap. -PR option suits ...
2
votes
0answers
55 views

Logstash nmap codec @timestamp match

I am using Logstash to input NMAP scan data into Elasticsearch. input{ http{ host => "127.0.0.1" port => 8000 codec => nmap } }...
2
votes
1answer
454 views

HTTP Ports are Filtered on New Virtual IPs in LVS (Linux Virtual Server) Load Balancer

I inherited a Linux Virutal Server (LVS) load balancer on CentOS 5.10. Its been running with no issues for quite some time with no worries. Now when I add a new virutal IP (VIP), all HTTP traffic ...
2
votes
0answers
2k views

Issue with Netgear GS108T Managed Switch and Jumbo Frames

I recently purchased a Netgear GS108T managed switch and I am trying to configure jumbo packets between my NAS (Thecus N4100Pro), PC and managed switch. I should mention the fact that I was able to ...
2
votes
2answers
2k views

Port is open on machine A but it is not visible from machine B in Nmap

I have a virtualized CentOS machine with a software that is listening on port 8080. I have turned off SELinux and flushed all iptables (so now there are no rules set). I have checked with netstat -nap ...
1
vote
4answers
6k views

Ping only OS Detection with nmap?

I am interested in using nmap for discovery, and to figure out the OS of each host. I understand that nmap does this, and can be enabled and controlled as described in the man page: OS detection ...
1
vote
5answers
6k views

Can't get nmap to work under Windows 7 64 bit

I'm trying to install and run the nmap tool to test my server, but it keeps saying Note: Host seems down. If it is really up, but blocking our ping probes, try -P0 and showing all the server ports ...
1
vote
5answers
18k views

How to find out that SMTP server is in open relay?

I used nmap for network security testing. It found that SMTP server was in open relay. Here is the output: nmap --script smtp-open-relay testwww.confidesk.com PORT STATE SERVICE 25/tcp open ...