How Nmap Works
Nmap does not simply "scan ports." It follows a carefully designed pipeline of distinct phases, each of which can be independently configured, skipped, or extended. Understanding this pipeline is essential for interpreting scan results and troubleshooting when things go wrong.
The Seven Phases of an Nmap Scan
Every Nmap scan follows the same fundamental pipeline. While some phases can be disabled with flags, the default behavior processes targets through all seven stages sequentially.
Target Specification
How Nmap interprets your input
Nmap begins by parsing the targets you provide on the command line. It accepts single IP addresses (192.168.1.1), hostnames (scanme.nmap.org), CIDR ranges (10.0.0.0/24), hyphen ranges (192.168.1.1-100), and files containing lists of targets (-iL). Nmap resolves DNS names, expands ranges into individual addresses, and deduplicates the final target list. For IPv6, use the -6 flag. Nmap also supports excluding targets with --exclude and --excludefile.
nmap 192.168.1.1nmap 10.0.0.0/24nmap -iL targets.txtnmap --exclude 192.168.1.1 10.0.0.0/24Host Discovery
Determining which targets are online
By default, Nmap does not blindly scan every IP you specify. First, it attempts host discovery to avoid wasting time on offline addresses. It sends ICMP echo requests, TCP SYN to port 443, TCP ACK to port 80, and ICMP timestamp requests. If any probe receives a response, the host is marked "up" and proceeds to port scanning. Use -Pn to skip this phase entirely — useful when ICMP is blocked by firewalls. Use -sn to perform only host discovery without port scanning.
nmap -sn 10.0.0.0/24nmap -Pn 192.168.1.1nmap -PE -PP -PM 10.0.0.1Port Scanning
Probing ports and interpreting responses
Nmap sends crafted packets to each target port based on the selected scan type. For TCP SYN scans (-sS), it sends a SYN packet. If SYN-ACK returns, the port is open. If RST returns, it is closed. If nothing returns, it may be filtered. UDP scans (-sU) send UDP datagrams and expect ICMP "port unreachable" for closed ports. Nmap can scan all 65,535 ports (-p-) or a subset. Parallelism is controlled by timing templates (-T0 to -T5).
nmap -sS -p- 10.0.0.1nmap -sU -p 53,161 10.0.0.1nmap --top-ports 100 10.0.0.1Service & Version Detection
Identifying what is actually running
When -sV is enabled, Nmap sends application-layer probes to every open port. These probes are designed to elicit version-specific responses from services like SSH, HTTP, FTP, SMTP, and databases. Responses are matched against the nmap-service-probes database, which contains over 7,000 signatures. Version detection also attempts to extract extra info such as protocol numbers, hostname, operating system, device type, and service CPE identifiers.
nmap -sV 10.0.0.1nmap -sV --version-intensity 5 10.0.0.1nmap -A 10.0.0.1OS Detection
Fingerprinting the operating system
With -O, Nmap sends a series of specially crafted TCP and UDP probes designed to expose subtle differences in OS TCP/IP stack implementations. Factors analyzed include IPID sequencing, initial TTL values, TCP window sizes, TCP option support and ordering, and responses to malformed packets. Nmap compares these fingerprints against its nmap-os-db database of thousands of known OS signatures. Results include OS family, version, and confidence percentage.
nmap -O 10.0.0.1nmap -O --osscan-limit 10.0.0.1nmap -A 10.0.0.1NSE Script Execution
Automated vulnerability and service checks
The Nmap Scripting Engine (NSE) runs Lua scripts against discovered targets. Scripts are organized into categories: auth, broadcast, brute, default, discovery, dos, exploit, external, fuzzer, intrusive, malware, safe, version, and vuln. Default scripts (-sC) run safe, non-intrusive checks. The vuln category detects known CVEs. Brute scripts attempt credential guessing. Discovery scripts enumerate additional hosts, users, or shares. Scripts can run pre-scan, host-scan, service-scan, or post-scan phases.
nmap -sC 10.0.0.1nmap --script vuln 10.0.0.1nmap --script "http-*" 10.0.0.1Output Generation
Formatting results for humans and machines
Nmap supports four output formats simultaneously: normal (-oN) for human reading, XML (-oX) for tool parsing and import into vulnerability management platforms, grepable (-oG) for command-line processing with grep/awk, and JSON (-oJ) for modern API integration. Nmap also provides real-time runtime interaction: press v/V for verbosity, d/D for debugging, p/P for packet tracing, and ? for a help menu during an active scan.
nmap -oN results.txt -oX results.xml 10.0.0.1nmap -oG results.gnmap 10.0.0.1nmap -v 10.0.0.1Packet Types Nmap Sends
Nmap is fundamentally a packet crafter. It builds and sends specific packet types to elicit responses that reveal information about the target. Understanding these packets helps you read Nmap output and troubleshoot scan issues.
| Packet Type | Purpose | Expected Response |
|---|---|---|
| TCP SYN | Check if port is open (stealth scan) | SYN-ACK = open, RST = closed, nothing = filtered |
| TCP Connect | Full handshake when raw sockets unavailable | Full three-way handshake completed by OS |
| UDP Datagram | Probe UDP services | ICMP unreachable = closed, nothing = open/filtered |
| ICMP Echo | Host discovery (ping) | Echo reply = host up |
| ARP Request | Local network host discovery | ARP reply = host up (most reliable locally) |
| NSE Probes | Application-layer service interrogation | Varies by script — banners, versions, CVEs |
Privilege Requirements
Many of Nmap's most powerful features require elevated privileges because they craft raw packets that bypass the operating system's TCP/IP stack. This is a security feature of modern operating systems.
Root / Administrator
-sS(TCP SYN scan) — raw packet crafting-sU(UDP scan) — raw UDP packets-sN/sF/sX— NULL, FIN, Xmas scans-O(OS detection) — raw probe crafting-f(packet fragmentation) — raw packet manipulation
Unprivileged User
-sT(TCP Connect scan) — uses OS connect()-sV(Version detection) — application layer only--script(NSE scripts) — most scripts work fine-Pn,-n— no special requirements-p,-T— timing and port selection
Warning
-sS silently falls back to -sT. The scan still works but is slower, more visible in logs, and less stealthy.Scan Performance Fundamentals
Nmap scan speed depends on multiple factors: network latency, target responsiveness, firewall behavior, the number of ports scanned, and the timing template selected. Understanding these interactions helps you choose the right settings for your environment.
Parallelism
Nmap sends multiple probes in parallel to different targets and ports. The -T templates control the maximum number of parallel probes, timeouts, and retry limits. Higher templates increase parallelism but also increase network load and IDS visibility.
Retransmissions
If a probe receives no response, Nmap assumes packet loss and retransmits. The number of retries depends on the timing template. On unreliable networks, Nmap may retransmit several times before marking a port as filtered. Use --max-retries 0 to disable retransmissions for faster (but less accurate) scans.
RTT Estimation
Nmap continuously estimates round-trip time (RTT) to each target and adjusts probe timing accordingly. This dynamic adaptation prevents scans from being too aggressive on slow networks or too slow on fast ones. You can override this with --min-rtt-timeout and --max-rtt-timeout.
Host Groups
Nmap processes targets in groups rather than one at a time. This allows efficient parallel scanning across many hosts. The default group size is optimized for most networks, but you can adjust it with --min-hostgroup and --max-hostgroup for very large or small scans.
Common Scan Issues
All ports show filtered
-Pn to skip host discovery, or use -sS with a different source port (--source-port 53) to bypass simple stateless filters.Scan is extremely slow
--max-retries 1 to limit retransmissions.open|filtered everywhere
-sS or -sT for clearer results.OS detection fails
-O may not produce results. Try a broader port scan first to ensure both open and closed ports exist.