nmap: port scanning and service detection in a pentest

Nmap · NPSL

nmap needs no introduction and gets one anyway, because most people use perhaps five percent of it. It discovers hosts, enumerates ports, identifies services and versions, and runs a scripting engine that does everything from banner parsing to vulnerability checks.

Install

# Debian / Ubuntu / Kali
sudo apt install nmap

# macOS
brew install nmap

# RHEL / Fedora
sudo dnf install nmap

Core commands

# fast, top ports, service versions
nmap -sV --top-ports 1000 -T4 -oA scan example.com

# full TCP range
nmap -p- -sV -T4 -oA fullscan 10.0.0.0/24

# SYN scan — needs root, quieter and faster
sudo nmap -sS -p- -T4 -oA syn 10.0.0.0/24

# UDP, the slow one that finds what everyone misses
sudo nmap -sU --top-ports 100 -oA udp 10.0.0.0/24

# default scripts plus version detection
nmap -sC -sV -oA default example.com

# TLS specifics
nmap --script ssl-enum-ciphers -p 443 example.com

-oA writes all three formats at once — normal, greppable and XML. Always use it: the XML is what importers read, and you cannot regenerate it after the fact without rescanning.

Output

The XML (scan.xml) is the machine-readable one:

<port protocol="tcp" portid="22">
  <state state="open" reason="syn-ack"/>
  <service name="ssh" product="OpenSSH" version="6.6.1p1" method="probe"/>
</port>

Where it sits in Tandera

nmap runs in the active_scan phase of recon_web_full only — never in recon_web_lite, which is capped NonIntrusive. It runs after cdncheck has classified the address space, so the target list excludes CDN and shared-provider ranges.

The tandera CLI also imports nmap XML directly:

nmap -sV -oX - example.com | tandera import --auto-dedupe

Using it in a pentest

-T4 is not always safe. Against fragile industrial or embedded targets it causes outages. -T2 on anything you were warned about, and agree timing with the client in writing.

Version detection is where the findings are. An open port is not a finding. OpenSSH 6.6.1p1 is — it is a version with known issues that you can cite. Without -sV you have an inventory, not results.

UDP is where the forgotten services live. It is slow enough that most testers skip it, which is exactly why SNMP with a default community string is still findable in 2026.

Keep the XML. It is your evidence that the scan happened, when, and what it saw. Clients dispute findings; timestamped XML settles it.