Cyber Security Academy · Lesson

Nmap Port Scanning Techniques

Run SYN, TCP connect, UDP, and version scans; read Nmap output; tune timing and avoid detection.

Nmap Port Scanning Techniques is a free Cyber Security Academy lesson on CoddyKit — lesson 1 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

Why Port Scanning Matters

Port scanning reveals which services are running on a target. Every open port is a potential entry point — knowing what is exposed is the first step in both offense and defense.

TCP SYN Scan (Stealth Scan)

The SYN scan (-sS) sends a SYN packet and waits for SYN-ACK without completing the handshake. It is fast, less likely to be logged, and requires root privileges.

# SYN scan (requires root)
sudo nmap -sS 192.168.1.0/24

# Results: open / closed / filtered

TCP Connect Scan

The connect scan (-sT) completes the full three-way handshake. It does not require root but is noisier and more likely to appear in application logs.

nmap -sT 192.168.1.100

# Useful when you lack raw socket privileges

UDP Scan

UDP services (DNS, SNMP, DHCP) are often forgotten. -sU probes UDP ports; responses (or lack thereof) indicate open|filtered vs closed. Slow — target specific ports.

sudo nmap -sU -p 53,161,67,123 192.168.1.100

# SNMP (161) and DNS (53) are common UDP targets

Version Detection

-sV sends probes to identify the service and version running on open ports. Version info is critical for matching against CVE databases.

sudo nmap -sV 192.168.1.100

# Output:
# 22/tcp  open  ssh     OpenSSH 8.9p1
# 80/tcp  open  http    Apache httpd 2.4.52

Timing Templates

Nmap timing (-T0 to -T5) controls speed vs stealth. -T3 is default; -T4 is faster; -T1 is very slow and evasion-friendly.

sudo nmap -sS -T4 192.168.1.0/24   # faster
sudo nmap -sS -T1 10.0.0.1          # slow/stealthy

# Aggressive timing increases detection risk

Specifying Port Ranges

By default Nmap scans the top 1000 ports. Use -p for specific ranges, -p- for all 65535 ports, or --top-ports for the N most common.

nmap -p 22,80,443 192.168.1.100
nmap -p 1-1024 192.168.1.100
nmap -p- 192.168.1.100              # all ports
nmap --top-ports 100 192.168.1.100

Output Formats

Save results with -oN (normal), -oX (XML for tool import), -oG (grepable), or -oA for all three simultaneously.

sudo nmap -sV -oA scan_results 192.168.1.0/24

# Creates:
# scan_results.nmap
# scan_results.xml
# scan_results.gnmap

Scan Multiple Targets

Nmap accepts IP ranges, CIDR blocks, hostnames, and input files. Combine with exclusion lists to skip sensitive hosts.

nmap 192.168.1.1 192.168.1.50
nmap 192.168.1.1-100
nmap -iL targets.txt
nmap 192.168.1.0/24 --exclude 192.168.1.1

Firewall Evasion Basics

Fragmented packets (-f), decoys (-D), and source port spoofing (--source-port) can help bypass basic firewall rules during authorized tests.

sudo nmap -f 192.168.1.100          # fragment packets
sudo nmap -D RND:10 192.168.1.100   # decoys
sudo nmap --source-port 53 192.168.1.100

Reading Nmap Output

Nmap reports each port as open, closed, or filtered. Open means a service accepted the probe; filtered means a firewall is blocking; closed means nothing is listening.

Quick Check

Which Nmap flag performs a SYN (stealth) scan?

Summary: Nmap Port Scanning

Mastering Nmap means knowing which scan type fits your authorization level and detection tolerance: SYN for speed and stealth, connect when you lack root, UDP for overlooked services, and version detection to build a CVE-ready target list. Always save output.

Frequently asked questions

Is the “Nmap Port Scanning Techniques” lesson free?

Yes — the full text of “Nmap Port Scanning Techniques” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.

What will I learn in “Nmap Port Scanning Techniques”?

Run SYN, TCP connect, UDP, and version scans; read Nmap output; tune timing and avoid detection. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Cyber Security Academy?

No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 1 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Nmap Port Scanning Techniques” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Cyber Security Academy lesson?

Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

← Back to Cyber Security Academy