# nmap: port scanning and service detection in a pentest

> How to install and run nmap, which scan profiles matter, how to read its XML output, and where it sits in Tandera active scanning.

`nmap` needs no introduction and gets one anyway, because most people use perhaps five percent of it. It discovers hosts, enumerates ports, identifies services and versions, and runs a scripting engine that does everything from banner parsing to vulnerability checks.

## Install

```bash
# Debian / Ubuntu / Kali
sudo apt install nmap

# macOS
brew install nmap

# RHEL / Fedora
sudo dnf install nmap
```

## Core commands

```bash
# fast, top ports, service versions
nmap -sV --top-ports 1000 -T4 -oA scan example.com

# full TCP range
nmap -p- -sV -T4 -oA fullscan 10.0.0.0/24

# SYN scan — needs root, quieter and faster
sudo nmap -sS -p- -T4 -oA syn 10.0.0.0/24

# UDP, the slow one that finds what everyone misses
sudo nmap -sU --top-ports 100 -oA udp 10.0.0.0/24

# default scripts plus version detection
nmap -sC -sV -oA default example.com

# TLS specifics
nmap --script ssl-enum-ciphers -p 443 example.com
```

`-oA` writes all three formats at once — normal, greppable and XML. Always use it: the XML is what importers read, and you cannot regenerate it after the fact without rescanning.

## Output

The XML (`scan.xml`) is the machine-readable one:

```xml
<port protocol="tcp" portid="22">
  <state state="open" reason="syn-ack"/>
  <service name="ssh" product="OpenSSH" version="6.6.1p1" method="probe"/>
</port>
```

## Where it sits in Tandera

nmap runs in the **active_scan** phase of `recon_web_full` only — never in `recon_web_lite`, which is capped `NonIntrusive`. It runs after `cdncheck` has classified the address space, so the target list excludes CDN and shared-provider ranges.

The `tandera` CLI also imports nmap XML directly:

```bash
nmap -sV -oX - example.com | tandera import --auto-dedupe
```

## Using it in a pentest

**`-T4` is not always safe.** Against fragile industrial or embedded targets it causes outages. `-T2` on anything you were warned about, and agree timing with the client in writing.

**Version detection is where the findings are.** An open port is not a finding. `OpenSSH 6.6.1p1` is — it is a version with known issues that you can cite. Without `-sV` you have an inventory, not results.

**UDP is where the forgotten services live.** It is slow enough that most testers skip it, which is exactly why SNMP with a default community string is still findable in 2026.

**Keep the XML.** It is your evidence that the scan happened, when, and what it saw. Clients dispute findings; timestamped XML settles it.

---

Canonical: https://tandera.io/tools/nmap
This page as markdown: https://tandera.io/tools/nmap.md
Index for agents: https://tandera.io/llms.txt

Every page here is also available as markdown: append `.md` to the path (e.g. `/recon.md`, `/index.md` for this homepage, `/blog/<slug>.md`), or request the canonical path with `Accept: text/markdown`.