Nmap for Beginners: Your First Scans, Explained Step by Step

If Kali Linux is a toolbox, Nmap is the first tool most people pick up. It is free, it has been around for decades, and it answers a simple but powerful question: what is running on this machine, and which doors are open?

Network administrators use Nmap to check their own servers. Security testers use it as the first step of an assessment. Students use it to understand how networks really work. In this guide you will learn what Nmap does, the handful of commands that cover most beginner needs, and how to read the results, all without touching a system you don't have permission to scan.

Golden rule: only scan systems you own or have clear permission to test. Your own lab, your own computer and the Nmap project's test server (mentioned below) are all fine. Your neighbour's Wi-Fi, your school or your employer's network are not, unless you have written permission.

What does Nmap actually do?

Nmap ("Network Mapper") sends carefully built network packets to a target and studies how it answers. From those answers it can tell you:

• Which hosts are online on a network.
• Which ports are open on each host. A port is like a numbered door, and each service uses its own door (for example 22 for SSH and 80 for web traffic).
• Which service and version is listening behind each open port.
• Which operating system the machine is probably running.

Before you start

Nmap comes pre-installed on Kali Linux. If you haven't built your lab yet, read my guide on setting up Kali in a virtual machine first. To check that Nmap is ready, open a terminal and run:

nmap --version

Your first scan

The simplest scan needs only a target. Start with your own Kali VM, using the address that always means "this computer":

nmap 127.0.0.1

By default Nmap checks the 1,000 most commonly used TCP ports and prints the ones it finds. If nothing is listening, the result will be short or empty, and that is normal for a fresh machine.

A safe public target

The Nmap project runs a machine called scanme.nmap.org for exactly this purpose, and its page says you are authorized to scan it. It asks for light use, so a few scans a day is fine. Please don't hammer it, and don't use it to test password-cracking tools.

nmap scanme.nmap.org

How to read the results

Nmap prints a table with three main columns: the port, its state, and the service name. The state is the important part. These are the three you will see most often:

• open: an application is actively accepting connections on this port.
• closed: the port is reachable, but nothing is listening on it.
• filtered: something, usually a firewall, is blocking Nmap's probes, so Nmap can't tell whether the port is open.

Nmap can also report unfiltered, open|filtered and closed|filtered. You will meet these with more advanced scan types, so don't worry about them yet.

The commands every beginner should know

1. Detect service versions

nmap -sV scanme.nmap.org

The -sV option probes open ports to find out which software and version is running. Knowing that a server runs an old, outdated version is often the first sign of a weakness, and that is exactly why defenders scan their own systems.

2. Scan specific ports

nmap -p 22,80,443 scanme.nmap.org

Use -p to check only the ports you care about. You can also give a range, such as -p 1-1000.

3. Scan faster with fewer ports

nmap -F scanme.nmap.org

Fast mode scans fewer ports than the default. It is handy when you just want a quick look.

4. Find which devices are online

nmap -sn 192.168.56.0/24

The -sn option performs host discovery only and skips the port scan. The address above is an example for a host-only lab network. Replace it with your own lab's range, and never use it on a network you don't own.

5. Skip host discovery

nmap -Pn 192.168.56.101

By default Nmap first checks whether a host is online. Some hosts ignore those checks, so -Pn tells Nmap to treat the target as online and scan it anyway.

6. The "all in one" option

sudo nmap -A 192.168.56.101

The -A option turns on OS detection, version detection, script scanning and traceroute. It gives a lot of detail but is slower and much noisier, so use it only on your own lab machines. OS detection often needs administrator rights, which is why the command starts with sudo.

7. Save your results

nmap -sV -oN results.txt scanme.nmap.org

The -oN option saves the normal output to a file, so you can compare scans later or add them to your notes.

A simple practice routine

1. Set up a second VM that is deliberately vulnerable, such as Metasploitable 2 or DVWA, on a host-only network with your Kali VM.
2. Find the target's address with a host discovery scan (-sn).
3. Run a default scan, then a version scan (-sV).
4. Write down what you find: open ports, services and versions.
5. Research each service and ask yourself why it is exposed and whether it needs to be.

Common beginner mistakes

• Scanning without permission. This is the big one. If you are unsure, don't scan.
• Running every option at once. Start simple and add options only when you understand what they do.
• Trusting results blindly. A "filtered" port or a guessed OS is not a certainty. Treat Nmap's output as strong clues, not proof.
• Not taking notes. Save your output. You will learn far more from comparing scans than from running them once.

Final thoughts

Nmap is simple to start with and deep enough to keep learning for years. Begin with the basic scan, learn to read port states, add -sV, and practice only on targets you are allowed to test. Once you can explain what each open port is doing, you are already thinking like a security professional.

Which should we cover next: Wireshark, or a beginner's guide to Linux commands for hacking labs? Tell me in the comments, and follow the blog for more guides on Kali Linux, programming, AI and crypto.