NMap, also known as Network Mapper, is the Web scanning and sniffing Toolkit under Linux, which has three basic functions, one is to detect whether a group of hosts are online, the second is to scan host ports, to sniff out network services, and to infer the operating system used by the host. Nmap can be used to scan a LAN with only two nodes up to 500 nodes above the network. Nmap also allows users to customize scanning techniques. Typically, a simple ping using the ICMP protocol can meet general requirements, or you can drill down into UDP or TCP ports until the operating system is used by the host, and you can log all the probe results to a variety of formats for further analysis.
Perform a ping scan to print a host that responds to the scan without further testing (such as port scanning or operating system probing):
NMAP-SP 192.168.1.0/24
Lists only each host on the specified network and does not send any messages to the target host:
NMAP-SL 192.168.1.0/24
To probe open ports on the target host, you can specify a comma-delimited list of ports (such as-ps22,23,25,80):
Nmap-ps 192.168.1.234
To probe a host using UDP ping:
Nmap-pu 192.168.1.0/24
The most Frequently used scan option: A SYN Scan, also known as a semi-open scan, does not open a full TCP connection and executes quickly:
Nmap-ss 192.168.1.0/24
When the SYN scan is unavailable, the TCP Connect () scan is the default TCP scan:
Nmap-st 192.168.1.0/24
UDP scanning with the-SU option, the UDP scan sends an empty (no data) UDP header to each destination port:
Nmap-su 192.168.1.0/24
Determine which IP protocols are supported by the target machine (TCP,ICMP,IGMP, etc.):
Nmap-so 192.168.1.19
To probe the target host's operating system:
Nmap-o 192.168.1.19
Nmap-a 192.168.1.19
Use of the "shell" nmap tool