Nmap

What It Is and How It Maps Networks

• Nmap (Network Mapper) is an open-source tool for network discovery and security auditing.
• It sends crafted packets to targets and analyzes the responses to determine which hosts are alive, which ports are open, what services are running, and what operating system the host uses.
• MITRE ATT&CK maps network service scanning to T1046 (Network Service Discovery) — attackers run Nmap to build a map of the internal network before moving laterally.
• The tool has been in active development since 1997 and remains the standard for TCP/IP stack fingerprinting.

Scan Types — The Flags Analysts Actually Use

Analysts’ Most-Used Nmap Commands

# Quick network sweep — find all live hosts on a subnet
nmap -sn 192.168.1.0/24

# Fast scan of top 1000 ports
nmap -sS -T4 192.168.1.100

# Full port range scan (1-65535)
nmap -sS -p- -T4 192.168.1.100

# Service and version detection
nmap -sV -sC 192.168.1.100

# OS detection + version + scripts + all ports
nmap -sS -sV -O -sC -p- -T4 192.168.1.100

# Output to all formats
nmap -sS -sV -oA network_scan 192.168.1.0/24

Detection — How to Spot Nmap Scans on Your Network

Detection via Network Flow / Zeek / NetFlow

Nmap scans produce a distinctive pattern in network telemetry. Whether you detect them depends on which level you can observe:

SPL query — detect SYN scan (many SYN packets without ACK responses):

index=network sourcetype=conn
| search proto=tcp
| eval conn_state = if(conn_state == "S0", "SYN_sent_no_reply", "other")
| where conn_state == "SYN_sent_no_reply"
| stats count as SynOnly by src_ip, dst_ip
| where count > 20
| eval alert = "HIGH — possible SYN scan from " . src_ip . " to " . dst_ip . " (" . count . " connections)"

SPL query — detect ping sweep (connections to multiple IPs in short window):

index=network sourcetype=conn
| timechart span=1m dc(dst_ip) as UniqueHosts by src_ip
| where UniqueHosts > 10
| eval alert = "MEDIUM — possible ping sweep from " . src_ip . " — contacted " . UniqueHosts . " hosts in 1 minute"

Detection via IDS/IPS Rules

Snort and Suricata have built-in rules for Nmap scans:

Detection via Zeek conn.log

Zeek’s conn.log captures TCP connection state. Nmap scans produce specific states:

Understanding Detection Limitations

Analyst Reference — What Each Port Result Means

Prevention

Related

• Metasploit — detection and response for T1203 techniques
• RITA — detection and response for T1071 techniques
• Common Ports and Protocols — covers the common ports and protocols concepts
• Log Sources Overview — covers the log sources overview concepts
• Network Security Basics — detection and response for T1040, T1046 techniques

Sources

• Nmap Official Documentation
• MITRE ATT&CK T1046
• Zeek conn.log Documentation
• SANS — Detecting Nmap Scans