Nmap (Network Mapper) is a security scanner originally written by Gordon Lyon (also known by his pseudonym Fyodor Vaskovich) used to discover hosts and services on a computer network, thus creating a "map" of the network.

learn more… | top users | synonyms

29
votes
9answers
63k views

nmap find all alive hostnames and IPs in LAN

How can I issue a nmap command that shows me all the alive machines' IP addresses and corresponding hostname s in the LAN that I am connected? (if this can be done in another way/tool you surely are ...
7
votes
1answer
38k views

NMAP: Check if port 80 and 8080 is open

In our company, I want to check if users are running web servers on port 80 and 8080. I downloaded nmap and ran this command: nmap -p 80,8080 192.168.1.0-255 I got a list of IPs and tried to ...
5
votes
1answer
555 views

How to check if an IP address is free on a network

I'm gonna setup a Wireless router for a customer. They have subnet 10.253.48.0/24 What can I do to check if the IP 10.253.48.243 is available to set up the router? I'm on out on a local network at my ...
4
votes
1answer
419 views

command for MAC broadcast

I am looking for a command to discover all hosts on the same LAN segment from a host with unassigned IP, default gateway, and subnet. I know there's ping 255.255.255.255 but that operates at layer 3 ...
4
votes
7answers
2k views

Scan for connected, powered on computers on a network?

I want to scan for powered on computers on my LAN and gather logs about that. I tried nmap but it didn't work very well (a lot of switched on computers are not getting detected). nmap -sP ...
4
votes
5answers
3k views

Is there a Nagios plugin that uses Nmap and does port checking?

I need to monitor open and closed ports on dozens of hosts. I've found a Nagios plugin that does what I need, but I would have to use this script through NRPE. Some of the hosts are powered by Linux ...
4
votes
1answer
1k views

Nmap ping scan over a VPN tunnel return all hosts alive?

I'm curious as to why running an nmap -sP (ping scan) on a remote subnet linked via a Cisco site-to-site IPSec tunnel returns "host up" status for every IP in the range. [root@xt ~]# nmap -sP ...
4
votes
2answers
4k views

nmap does not find alive hosts with ping scan

I try to ping scan my local network using nmap, but it doesn't seem to find machines that are for sure alive. It responses to ping but on to ping scan. Results for ping: $ ping 192.168.0.2 PING ...
4
votes
2answers
213 views

Removing new fingerprint detection message from nmap

I run a nmap scan of my hosts daily to check for open ports. sudo nmap -f -sS -sV --log-errors -append-output -p1-9999 host.com But along with the output I get a long list of fingerprint ...
3
votes
2answers
1k views

Test if an IP is being used in an internal network without using nmap

I can perform port scan using nmap to test if a given IP is being used, e.g. nmap -PR 192.168.1.9 However, nmap is not installed in most server, is it possible to have the same result (e.g. check ...
3
votes
2answers
2k views

Nmap not scanning all ports

I've noticed that nmap only scans a bunch of known ports, and the only way i've managed to check 'em all is to put a "-p 0-65535" in. Why is that? am I wrong? is there a more popular way to scan all ...
3
votes
2answers
231 views

Nmap: find free IPs from the range

Is there a way to scan for free IPs on the network? I use nmap -sP 192.168.1.0/24 but this actually shows hosts that are up.
3
votes
1answer
438 views

Powershell and NMAP Information Sharing

I am working on a project where I would like to perform host documentation for a variety of items. Part of these items would be sourced from Powershell and the rest would be sourced from NMAP. For ...
3
votes
1answer
256 views

use of nmap clogged my network

I was using nmap to scan the mac addresses of my network.What I found was internet connections and rest of network services badly clogged the users were not able to connect to internet.After messing ...
3
votes
3answers
2k views

Why do nmap -p <port> and nmap -A scans show different results?

I have a C# application that I've written that listens on port 789. It is running on a Windows XP Professional computer. Running netstat -an | find "789" TCP 0.0.0.0:789 0.0.0.0:0 ...
3
votes
1answer
256 views

Automatic/scheduled check for open ports on list of servers

I need a way to configure a scheduled check for open ports on a list of servers and to get notified if something has changed from last check. what's the best way to do it? If there is some solution ...
3
votes
1answer
134 views

Identify where a port is blocked

I'm trying to find out where a port is being blocked by a firewall; either en-route to a host or by the host itself. If I run nmap I can see that the port is filtered. However, this could mean by the ...
3
votes
3answers
1k views

How to Hide OS Fingerprint of Virtual Machine?

Is it possible to make a linux virtual machine appear as the host machine to a network tool like nmap or Blue's Port Scanner without recompiling the kernel?
3
votes
1answer
522 views

nmap and arp-scan inconsistent IP-MAC results

I seem to get variable and inconsistent results for the IP/MAC addresses from a particular machine, using nmap or arp-scan. The machine has 3 interfaces, and this is what it shows: $ uname -a Linux ...
3
votes
1answer
1k views

Using nmap to scan open ports. iptables default policy affects other rules?

I'm trying to find out why changing my default iptables policy is affecting what nmap sees when it scans my host. Consider the following iptables setup: iptables -F iptables -A INPUT -p tcp -s ...
3
votes
1answer
849 views

NMap route determination on Windows 7 x64 [closed]

C:\Windows\system32>nmap --iflist Starting Nmap 6.01 ( http://nmap.org ) at 2012-08-31 06:51 Central Daylight Time ************************INTERFACES************************ DEV (SHORT) IP/MASK ...
2
votes
3answers
316 views

Command line tools for ping HTTP? [closed]

Background : It's a common question as we can search at google "ping works but http does not" ping is not a reliable test of network connectivity. ping working just means enough of the IP stack is ...
2
votes
2answers
147 views

646/tcp open unknown

when I make nmap localhost I get PORT STATE SERVICE 22/tcp open ssh 25/tcp open smtp 111/tcp open rpcbind 631/tcp open ipp 646/tcp open unknown what is the port 646 ?
2
votes
2answers
1k views

IPtables: is there a minimum UDP packet size for a DNS lookup?

IPtables for a virtual dedicated server. I would like to block UDP scans and I was wondering whether there's a minimum packet size for a DNS lookup? Nmap sends 0-byte UDP packets (source : ...
2
votes
2answers
940 views

Weird Port scanning results using nmap

I was scanning one of my friends servers using nmap and got these port details. PORT STATE SERVICE 22/tcp open ssh 42/tcp filtered nameserver 80/tcp open http 111/tcp open ...
2
votes
3answers
3k views

tcp port 554 open

I was running a routine security check of the machines I manage today and found in my nmap scans that TCP/554 is open, although when I run 'netstat -an' on the machine itself it doesn't show up, same ...
2
votes
3answers
920 views

VirtualBox guest responds to ping but all ports closed in nmap

I want to setup a test database on a vm for development purposes but I cannot connect to the server via the network. I've got Ubuntu 12.04vm installed on 12.04 host in Virtualbox 4.2.4 set to - ...
2
votes
1answer
256 views

Why can NMAP not show some ports?

when I do "nmap localhost", some open ports are listed and others aren't. For Example SSH on 22 is listed, but SSH on 10022 is not. Host's port 10022 in my case is NAT port forwarding to a ...
2
votes
1answer
197 views

nmap lists host as up despite being black listed

I have an iptables rule setup that marks addresses as suspicious if they connect on certain ports or any unopen ports. If more than three consecutive connections are made without authentication, then ...
2
votes
1answer
146 views

Trace /8 address space with nmap

I'm trying to sketch out a network topology map using the following command nmap -sP -PE -PS22,25,80 -PA21,23,80,3389 -PU -PO -oX topology.xml --traceroute 10.0.0.0/8 (10.0.0.0/8 because no one ...
2
votes
1answer
149 views

using nmap to guess remote OS and probe service details on a single port only

I am looking at scanning with nmap a large network in order to identify the OS of devices (-O--osscan-limit) probe for details of a service on a single port (I would have used -sV for all open ...
2
votes
1answer
2k views

Why does nmap report different results from localhost?

When I execute "nmap -sT -O localhost" per the Centos 5 deployment guide, I get: Not shown: 1677 closed ports PORT STATE SERVICE 22/tcp open ssh 80/tcp open http 8080/tcp open http-proxy ...
2
votes
1answer
345 views

Detecting network state with arping

I am developing system for detecting network actual state. One part is to get all IPs and their respective MAC addresses. Right now I am using arping in DAD (Duplicate Address Discovery) mode. I send ...
2
votes
1answer
213 views

NMap - running as root yields different response than running as another user

nmap -eeth1 [hostname] -p80 Running that command as root uses interface one and fails as expected (interface one is on a subnet blocked by the host.) Using interface 0 succeeds as it should. ...
2
votes
0answers
1k views

Issue with Netgear GS108T Managed Switch and Jumbo Frames

I recently purchased a Netgear GS108T managed switch and I am trying to configure jumbo packets between my NAS (Thecus N4100Pro), PC and managed switch. I should mention the fact that I was able to ...
1
vote
5answers
4k views

Can't get nmap to work under Windows 7 64 bit

I'm trying to install and run the nmap tool to test my server, but it keeps saying Note: Host seems down. If it is really up, but blocking our ping probes, try -P0 and showing all the server ports ...
1
vote
5answers
12k views

How to find out that SMTP server is in open relay?

I used nmap for network security testing. It found that SMTP server was in open relay. Here is the output: nmap --script smtp-open-relay testwww.confidesk.com PORT STATE SERVICE 25/tcp open ...
1
vote
2answers
359 views

Does nmap work with ipv6?

Does nmap work with ipv6? I don't even really know if ports are handled in the same way on ipv6 so I just wondered.
1
vote
2answers
12k views

Can I use nmap to discover IPs and mac addresses?

When I need to locate the IPs of devices by their mac address on a Windows system, I normally use Advanced IP Scanner (from radmin.com) to scan the network, then I use arp -a to list the mac ...
1
vote
1answer
4k views

iptables has port 80 open but nmap shows it closed

I'm having some troubles getting a Debian webserver to open up port 80 for HTTP traffic. In my iptables, I opened up port 80 using the following commands: iptables -A INPUT -p tcp --dport 80 -j ...
1
vote
2answers
587 views

Cannot connect from Linux to SQL Server through a firewall

I need to connect from a Debian GNU/Linux webserver to an SQL Server database which is hosted on a Windows machine within an organization's local network. The person in charge of the database server ...
1
vote
2answers
249 views

ping and identify Cisco model without physical access or login?

There are several Cisco devices on my network which I can find with ping or nmap but I have no idea what the type (e.g. switches, routers) or specific model is. Is there some way to find this out ...
1
vote
2answers
475 views

Nmap / Batch: alert if only ports usually closed are opened?

Context I check open ports on my server with a scheduled batch file: nmap.exe server1 server2 server3 etc >> log.txt Usually 21, 22, 80, 443 and 3389 are opened. Now I want to send an email ...
1
vote
2answers
452 views

different nmap results

Hello I have a scan on my server form outside and from inside, why results are different? [root@xxx ~]# nmap -sV -p 0-65535 localhost Starting Nmap 5.51 ( http://nmap.org ) at 2011-02-16 07:59 MSK ...
1
vote
4answers
1k views

iptables rule to drop SYN and FIN attacks

From a Trustwave report, we are trying to set our server to block this type of request but after trying several combinations of rules, we can still see the ports. Could anyone give me a hint or the ...
1
vote
1answer
1k views

Port 443 is open but IP tables denies it

When I run the following command on my Ubuntu instance: $ nmap host I see that port 443 is open: Starting Nmap 5.21 ( http://nmap.org ) at 2013-03-19 05:36 PDT Nmap scan report for [host redacted] ...
1
vote
1answer
236 views

Allow nmap advanced scans for a normal user

I want to allow a normal user to run NMAP's advanced scans like XMAS, TCP FIN, TCP NULL scans. Can somebody please tell me how to do that ?? Since it uses raw packets so whether setting the setuid bit ...
1
vote
1answer
183 views

Nmap reporting incorrect results from an idle scan

I have a VPS that I was scanning to make sure everything is in check. A regular SYN scan reports that ports 25 and 80 are open (which they should be). When I run an idle scan however, I get back that ...
1
vote
2answers
68 views

Network Scan, Filtering for Top Level Domain

Greetings, I have a list of 2 /24s worth of IP addresses in seperate text files. What I am interested in doing is finding a way to resolve the hosts of these IP addresses and filter out to display ...
1
vote
1answer
147 views

Windows AdvFirewall and nmap scans

I come from a Unix background but got the task of configuring a Windows firewall on a public facing server. I find awkward that any nmap scan I perform against the public IP reports all TCP ports ...