Nmap (Network Mapper) is a network scanner created by

Gordon Lyon Gordon Lyon (also known by his pseudonym Fyodor Vaskovich) is an American network security expert, creator of Nmap and author of books, websites, and technical papers about network security. He is a founding member of the Honeynet Project and ...

(also known by his

pseudonym A pseudonym (; ) or alias () is a fictitious name that a person assumes for a particular purpose, which differs from their original or true meaning ( orthonym). This also differs from a new name that entirely or legally replaces an individual's o ...

''Fyodor Vaskovich''). Nmap is used to discover

hosts A host is a person responsible for guests at an event or for providing hospitality during it. Host may also refer to: Places * Host, Pennsylvania, a village in Berks County * Host Island, in the Wilhelm Archipelago, Antarctica People * ...

and

services Service may refer to: Activities * Administrative service, a required part of the workload of university faculty * Civil service, the body of employees of a government * Community service, volunteer service for the benefit of a community or a ...

on a

computer network A computer network is a collection of communicating computers and other devices, such as printers and smart phones. In order to communicate, the computers and devices must be connected by wired media like copper cables, optical fibers, or b ...

by sending packets and analyzing the responses. Nmap provides a number of features for probing computer networks, including host discovery and service and

operating system An operating system (OS) is system software that manages computer hardware and software resources, and provides common daemon (computing), services for computer programs. Time-sharing operating systems scheduler (computing), schedule tasks for ...

detection. These features are extensible by scripts that provide more advanced service detection, vulnerability detection, and other features. Nmap can adapt to network conditions including latency and congestion during a scan. Nmap started as a

Linux Linux ( ) is a family of open source Unix-like operating systems based on the Linux kernel, an kernel (operating system), operating system kernel first released on September 17, 1991, by Linus Torvalds. Linux is typically package manager, pac ...

utility and was ported to other systems including

Windows Windows is a Product lining, product line of Proprietary software, proprietary graphical user interface, graphical operating systems developed and marketed by Microsoft. It is grouped into families and subfamilies that cater to particular sec ...

macOS macOS, previously OS X and originally Mac OS X, is a Unix, Unix-based operating system developed and marketed by Apple Inc., Apple since 2001. It is the current operating system for Apple's Mac (computer), Mac computers. With ...

, and

BSD The Berkeley Software Distribution (BSD), also known as Berkeley Unix or BSD Unix, is a discontinued Unix operating system developed and distributed by the Computer Systems Research Group (CSRG) at the University of California, Berkeley, beginni ...

. It is most popular on Linux, followed by Windows.

Features

Nmap features include: * Fast scan (''nmap -F arget') – Performing a basic port scan for fast result. * Host discovery – Identifying hosts on a network. For example, listing the hosts that respond to TCP and/or

ICMP The Internet Control Message Protocol (ICMP) is a supporting protocol in the Internet protocol suite. It is used by network devices, including routers, to send error messages and operational information indicating success or failure when com ...

requests or have a particular port open. *

Port scanning A port scanner is an application designed to probe a server or host for open ports. Such an application may be used by administrators to verify security policies of their networks and by attackers to identify network services running on a host and ...

– Enumerating the open

ports Ports collections (or ports trees, or just ports) are the sets of makefiles and Patch (Unix), patches provided by the BSD-based operating systems, FreeBSD, NetBSD, and OpenBSD, as a simple method of installing software or creating binary packages. T ...

on target hosts. * Version detection – Interrogating network services on remote devices to determine application name and version number. * Ping Scan – Check host by sending ping requests. *

TCP/IP stack fingerprinting TCP/IP stack fingerprinting is the remote detection of the characteristics of a TCP/IP stack implementation. The combination of parameters may then be used to infer the remote machine's operating system (aka, OS fingerprinting), or incorporated ...

– Determining the

and hardware characteristics of network devices based on observations of network activity of said devices. * Scriptable interaction with the target – using Nmap Scripting Engine (NSE) and Lua programming language. Nmap can provide further information on targets, including reverse

DNS The Domain Name System (DNS) is a hierarchical and distributed name service that provides a naming system for computers, services, and other resources on the Internet or other Internet Protocol (IP) networks. It associates various informatio ...

names, device types, and

MAC address A MAC address (short for medium access control address or media access control address) is a unique identifier assigned to a network interface controller (NIC) for use as a network address in communications within a network segment. This use i ...

es. Typical uses of Nmap: * Auditing the security of a device or

firewall Firewall may refer to: * Firewall (computing), a technological barrier designed to prevent unauthorized or unwanted communications between computer networks or hosts * Firewall (construction), a barrier inside a building, designed to limit the spre ...

by identifying the network connections which can be made to, or through it. * Identifying open ports on a target host in preparation for auditing. * Network inventory,

network mapping Network mapping is the study of the physical connectivity of networks e.g. the Internet. Network mapping discovers the devices on the network and their connectivity. It is not to be confused with network discovery or network enumeration which di ...

, maintenance and asset management. * Auditing the security of a network by identifying new servers. * Generating traffic to hosts on a network, response analysis and response time measurement. * Finding and exploiting vulnerabilities in a network. *

queries and

subdomain In the Domain Name System (DNS) hierarchy, a subdomain is a domain that is a part of another (main) domain. For example, if a domain offered an online store as part of their website it might use the subdomain. Overview The Domain Name System ...

User interfaces

NmapFE, originally written by Kanchan, was Nmap's official

GUI Gui or GUI may refer to: People Surname * Gui (surname), an ancient Chinese surname, ''xing'' * Bernard Gui (1261 or 1262–1331), inquisitor of the Dominican Order * Luigi Gui (1914–2010), Italian politician * Gui Minhai (born 1964), Ch ...

for Nmap versions 2.2 to 4.22. For Nmap 4.50 (originally in the 4.22SOC development series) NmapFE was replaced with Zenmap, a new official graphical user interface based on UMIT, developed by Adriano Monteiro Marques. Web-based interfaces exist that allow either controlling Nmap or analysing Nmap results from a web browser, such as IVRE. Image:Zenmap.png, ''Zenmap'', showing results for a port scan against Wikipedia Image:Nmapfe screenshot.png, ''NmapFE'', showing results for a port scan against Wikipedia Image:Xnmap.png, ''XNmap'', a Mac OS X GUI

Output

Four different output formats are offered by Nmap. Everything is saved to a file except the interactive output. Text processing software can be used to modify Nmap output, allowing the user to customize reports. ; Interactive: presented and updated real time when a user runs Nmap from the command line. Various options can be entered during the scan to facilitate monitoring. ;

XML Extensible Markup Language (XML) is a markup language and file format for storing, transmitting, and reconstructing data. It defines a set of rules for encoding electronic document, documents in a format that is both human-readable and Machine-r ...

: a format that can be further processed by XML tools. It can be converted into a

HTML Hypertext Markup Language (HTML) is the standard markup language for documents designed to be displayed in a web browser. It defines the content and structure of web content. It is often assisted by technologies such as Cascading Style Sheets ( ...

report using

XSLT XSLT (Extensible Stylesheet Language Transformations) is a language originally designed for transforming XML documents into other XML documents, or other formats such as HTML for web pages, plain text, or XSL Formatting Objects. These formats c ...

. ; Grepable: output that is tailored to line-oriented processing tools such as

grep grep is a command-line utility for searching plaintext datasets for lines that match a regular expression. Its name comes from the ed command g/re/p (global regular expression search and print), which has the same effect. grep was originally de ...

, sed, or awk. ; Normal: the output as seen while running Nmap from the command line, but saved to a file. ;

Script kiddie A script kiddie, skript kiddie, skiddie, kiddie, or skid is a pejorative term used to describe an unskilled individual who uses malicious scripts or programs developed by others or LLMs. Characteristics The term script kiddie was first used in ...

:meant to be an amusing way to format the interactive output replacing letters with their visually alike number representations. For example, Interesting ports becomes Int3rest1ng p0rtz. This is known as

Leet Leet (or "1337"), also known as eleet or leetspeak, or simply hacker speech, is a system of modified spellings used primarily on the Internet. It often uses character replacements in ways that play on the similarity of their glyphs via refle ...

History

Nmap was first published in September 1997, as an article in Phrack Magazine with source-code included. With help and contributions of the computer security community, development continued. Enhancements included operating system fingerprinting, service fingerprinting, code rewrites ( C to C++), additional scan types, protocol support (e.g.

IPv6 Internet Protocol version 6 (IPv6) is the most recent version of the Internet Protocol (IP), the communication protocol, communications protocol that provides an identification and location system for computers on networks and routes traffic ...

SCTP The Stream Control Transmission Protocol (SCTP) is a computer networking communications protocol in the transport layer of the Internet protocol suite. Originally intended for Signaling System 7 (SS7) message transport in telecommunication, the ...

) and new programs that complement Nmap's core features. Major releases include:

Legal issues

Nmap is a tool that can be used to discover services running on Internet connected systems. Like any tool, it could potentially be used for

black hat hacking Black is a color that results from the absence or complete absorption of visible light. It is an achromatic color, without chroma, like white and grey. It is often used symbolically or figuratively to represent darkness.Eva Heller, ''Psy ...

, as a precursor to attempts to gain unauthorized access to computer systems. However, Nmap is also used by security and systems administrators to assess their own networks for vulnerabilities (i.e. white hat hacking). System administrators can use Nmap to search for unauthorized servers, or for computers that do not conform to security standards. In 2003

Supreme Court of Finland The Supreme Court of Finland ( , abbreviated as ''KKO''; , abbreviated as ''HD''), located in Helsinki, is the court of last resort for cases within the private law of Finland (that is, civil and criminal cases). The Court's counterpart is the ...

has ruled that port scanning has amounted to an attempted computer break in, which was illegal under Finnish Penal code at the time:

''In its ruling the Supreme Court stated that the defendant had systematically carried out port scanning operations to gather information for the purpose of unauthorised break-in to the bank's computer network. This amounted to an attempted computer break in.''

License

Nmap was originally distributed under the

GNU General Public License The GNU General Public Licenses (GNU GPL or simply GPL) are a series of widely used free software licenses, or ''copyleft'' licenses, that guarantee end users the freedom to run, study, share, or modify the software. The GPL was the first ...

(GPL). In later releases, Nmap's authors added clarifications and specific interpretations to the license where they felt the GPL was unclear or lacking. For instance, Nmap 3.50 specifically revoked the license of

SCO Group The SCO Group (often referred to SCO and later called The TSG Group) was an American software company in existence from 2002 to 2012 that became known for owning Unix operating system assets that had belonged to the Santa Cruz Operation (the or ...

to distribute Nmap software because of their views on the SCO-Linux controversies. Starting with version 7.90, Nmap transitions to a new custom license NPSL, dual-licensing versions 7.90, 7.91, and 7.92 under both old and new licenses. Several Linux distributions consider the new license non-free.

In popular culture

In ''

The Matrix Reloaded ''The Matrix Reloaded'' is a 2003 American science fiction action film written and directed by the Wachowskis. It is the sequel to ''The Matrix'' (1999) and the second installment in the ''Matrix'' film series. The film stars Keanu Reeves, L ...

'',

Trinity The Trinity (, from 'threefold') is the Christian doctrine concerning the nature of God, which defines one God existing in three, , consubstantial divine persons: God the Father, God the Son (Jesus Christ) and God the Holy Spirit, thr ...

is seen using Nmap to access a power plant's computer system, allowing Neo to "physically" break into a building. The appearance of Nmap in the film was widely discussed on Internet forums and hailed as an unusually realistic example of hacking. Nmap and NmapFE were used in '' The Listening'', a 2006 movie about a former NSA officer who defects and mounts a clandestine counter-listening station high in the Italian alps. Nmap source code can be seen in the movie '' Battle Royale'', as well as brief views of the command line version of Nmap executing in ''

Live Free or Die Hard ''Live Free or Die Hard'' (released as ''Die Hard 4.0'' outside North America) is a 2007 American action thriller film directed by Len Wiseman, the fourth installment in the Die Hard (franchise), ''Die Hard'' film series. It is based on the 199 ...

'' and '' Bourne Ultimatum''. In 2013, Nmap continued to make appearances in movies including popular sci-fi movie ''

Elysium Elysium (), otherwise known as the Elysian Fields (, ''Ēlýsion pedíon''), Elysian Plains or Elysian Realm, is a conception of the afterlife that developed over time and was maintained by some Greek religious and philosophical sects and cult ...

''. The film ''

Dredd ''Dredd'' is a 2012 science fiction film, science fiction action film directed by Pete Travis and written and produced by Alex Garland. It is based on the ''2000 AD (comics), 2000 AD'' comic strip ''Judge Dredd'' and its eponymous character ...

'', a film adaptation of the famous

Judge Dredd Judge Joseph Dredd is a fictional character created by writer John Wagner and artist Carlos Ezquerra. He first appeared in the second issue of the British weekly anthology Comic book, comic ''2000 AD (comics), 2000 AD'' (1977). He is the magazi ...

comics, was released in 2012 and also contains multiple Nmap scenes. Nmap is used for network reconnaissance and exploitation of the slum tower network. It is even seen briefly in the movie's trailer. The command Nmap is widely used in the video game '' Hacknet'', allowing to probe the network ports of a target system to hack it. In '' Snowden'', Nmap is used in the aptitude test scene about 14 minutes into the movie.

In academia

Nmap is an integral part of academic activities. It has been used for research involving the

TCP/IP The Internet protocol suite, commonly known as TCP/IP, is a framework for organizing the communication protocols used in the Internet and similar computer networks according to functional criteria. The foundational protocols in the suite are ...

protocol suite and networking in general. Besides being a research tool, Nmap has also become a research topic.

Examples

$ nmap -f -v -A scanme.nmap.org Starting Nmap 6.47 ( https://nmap.org ) at 2014-12-29 20:02 CET Nmap scan report for scanme.nmap.org (74.207.244.221) Host is up (0.16s latency). Not shown: 997 filtered ports PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 5.3p1 Debian 3ubuntu7.1 (Ubuntu Linux; protocol 2.0) , ssh-hostkey: , 1024 8d:60:f1:7c:ca:b7:3d:0a:d6:67:54:9d:69:d9:b9:dd (DSA) , _ 2048 79:f8:09:ac:d4:e2:32:42:10:49:d3:bd:20:82:85:ec (RSA) 80/tcp open http Apache httpd 2.2.14 ((Ubuntu)) , _http-title: Go ahead and ScanMe! 9929/tcp open nping-echo Nping echo Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose, phone, storage-misc, WAP Running (JUST GUESSING): Linux 2.6.X, 3.X, 2.4.X (94%), Netgear RAIDiator 4.X (86%) OS CPE: cpe:/o:linux:linux_kernel:2.6.38 cpe:/o:linux:linux_kernel:3 cpe:/o:netgear:raidiator:4 cpe:/o:linux:linux_kernel:2.4 Aggressive OS guesses: Linux 2.6.38 (94%), Linux 3.0 (92%), Linux 2.6.32 - 3.0 (91%), Linux 2.6.18 (91%), Linux 2.6.39 (90%), Linux 2.6.32 - 2.6.39 (90%), Linux 2.6.38 - 3.0 (90%), Linux 2.6.38 - 2.6.39 (89%), Linux 2.6.35 (88%), Linux 2.6.37 (88%) No exact OS matches for host (test conditions non-ideal). Network Distance: 13 hops Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel TRACEROUTE (using port 80/tcp) HOP RTT ADDRESS 1 14.21 ms 151.217.192.1 2 5.27 ms ae10-0.mx240-iphh.shitty.network (94.45.224.129) 3 13.16 ms hmb-s2-rou-1102.DE.eurorings.net (134.222.120.121) 4 6.83 ms blnb-s1-rou-1041.DE.eurorings.net (134.222.229.78) 5 8.30 ms blnb-s3-rou-1041.DE.eurorings.net (134.222.229.82) 6 9.42 ms as6939.bcix.de (193.178.185.34) 7 24.56 ms 10ge10-6.core1.ams1.he.net (184.105.213.229) 8 30.60 ms 100ge9-1.core1.lon2.he.net (72.52.92.213) 9 93.54 ms 100ge1-1.core1.nyc4.he.net (72.52.92.166) 10 181.14 ms 10ge9-6.core1.sjc2.he.net (184.105.213.173) 11 169.54 ms 10ge3-2.core3.fmt2.he.net (184.105.222.13) 12 164.58 ms router4-fmt.linode.com (64.71.132.138) 13 164.32 ms scanme.nmap.org (74.207.244.221) OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 28.98 seconds

Bibliography

References

External links

* {{Official website C++ software Cross-platform free software Free network management software Linux security software Lua (programming language)-scriptable software Network analyzers Port scanners Python (programming language) software Security testing tools Unix network-related software Pentesting software toolkits