Scanning asks a target which services are listening. It is active, noisy and only lawful against systems you own or are explicitly authorised to test.
TCP connect versus SYN
- TCP connect scan (
-sT) completes the full three-way handshake using the operating system. It works without special privileges and is easy for the target to log. - SYN scan (
-sS) sends a SYN and interprets the response without completing the handshake. It is faster and stealthier, and usually needs elevated privileges.
Reading nmap output
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 9.6
80/tcp open http nginx 1.26
3306/tcp closed mysql
- open: something accepted the connection.
- closed: the host responded but no service is listening.
- filtered: no response, often a firewall.
Version detection (-sV) sends extra probes. It is more intrusive than a simple port scan and can trigger alerts.
Lab scan pattern
nmap -sn 10.10.10.0/24 # discover hosts in your own lab
nmap -sT -p 22,80,443 10.10.10.5
nmap -sV 10.10.10.5
Continue this lesson in the player
A free account unlocks the full lesson, the five-question knowledge check, progress tracking, notes and the completion certificate.