nstallation
To install nmap on RHEL based Linux distributions, type the following yum command:# yum install nmap
Sample outputs:
Loaded plugins: protectbase, rhnplugin, security 0 packages excluded due to repository protections Setting up Install Process Resolving Dependencies --> Running transaction check ---> Package nmap.x86_64 2:5.51-2.el6 will be installed --> Finished Dependency Resolution Dependencies Resolved ================================================================================ Package Arch Version Repository Size ================================================================================ Installing: nmap x86_64 2:5.51-2.el6 rhel-x86_64-server-6 2.8 M Transaction Summary ================================================================================ Install 1 Package(s) Total download size: 2.8 M Installed size: 0 Is this ok [y/N]: y Downloading Packages: nmap-5.51-2.el6.x86_64.rpm | 2.8 MB 00:00 Running rpm_check_debug Running Transaction Test Transaction Test Succeeded Running Transaction Installing : 2:nmap-5.51-2.el6.x86_64 1/1 Verifying : 2:nmap-5.51-2.el6.x86_64 1/1 Installed: nmap.x86_64 2:5.51-2.el6 Complete! |
How do I use nmap command?
To find out nmap version, run:# nmap --version
Sample outputs:
Nmap version 5.51 ( http://nmap.org )To scan an IP address or a host name (FQDN), run:
# nmap 1.2.3.4
# nmap localhost
# nmap 192.168.1.1
Sample outputs:
Getting more information out of the remote system
The -v option forces verbose output and the -A optipn enables OS detection and Version detection, Script scanning and traceroute in a single command:# nmap -v -A scanme.nmap.org
# nmap -v -A 192.168.1.1
Sample outputs:
Starting Nmap 5.00 ( http://nmap.org ) at 2012-11-19 16:38 IST NSE: Loaded 30 scripts for scanning. Initiating ARP Ping Scan at 16:38 Scanning 192.168.1.1 [1 port] Completed ARP Ping Scan at 16:38, 0.04s elapsed (1 total hosts) Initiating Parallel DNS resolution of 1 host. at 16:38 Completed Parallel DNS resolution of 1 host. at 16:38, 0.00s elapsed Initiating SYN Stealth Scan at 16:38 Scanning 192.168.1.1 [1000 ports] Discovered open port 80/tcp on 192.168.1.1 Discovered open port 22/tcp on 192.168.1.1 Completed SYN Stealth Scan at 16:38, 0.27s elapsed (1000 total ports) Initiating Service scan at 16:38 Scanning 2 services on 192.168.1.1 Completed Service scan at 16:39, 66.11s elapsed (2 services on 1 host) Initiating OS detection (try #1) against 192.168.1.1 Retrying OS detection (try #2) against 192.168.1.1 Retrying OS detection (try #3) against 192.168.1.1 Retrying OS detection (try #4) against 192.168.1.1 Retrying OS detection (try #5) against 192.168.1.1 NSE: Script scanning 192.168.1.1. NSE: Starting runlevel 1 scan Initiating NSE at 16:40 Completed NSE at 16:40, 0.88s elapsed NSE: Script Scanning completed. Host 192.168.1.1 is up (0.00050s latency). Interesting ports on 192.168.1.1: Not shown: 998 closed ports PORT STATE SERVICE VERSION 22/tcp open ssh Dropbear sshd 0.52 (protocol 2.0) | ssh-hostkey: 1024 15:b6:b5:68:dc:36:97:76:19:72:4d:74:63:d6:18:35 (DSA) |_ 1040 d2:75:67:8e:51:4d:4b:f6:25:f0:46:e3:a8:9e:8f:42 (RSA) 80/tcp open http? |_ html-title: Error | http-auth: HTTP Service requires authentication |_ Auth type: Basic, realm = tswitch 1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at http://www.insecure.org/cgi-bin/servicefp-submit.cgi : SF-Port80-TCP:V=5.00%I=7%D=11/19%Time=50AA133E%P=x86_64-unknown-linux-gnu% SF:r(GetRequest,17E,"HTTP/1\.0\x20401\x20Unauthorized\r\nDate:\x20Mon,\x20 SF:19\x20Nov\x202012\x2011:08:46\x20GMT\r\nContent-Type:\x20text/html;\x20 SF:charset=utf-8\r\nCache-Control:\x20no-cache,\x20no-store,\x20must-reval SF:idate,\x20private\r\nExpires:\x20Thu,\x2031\x20Dec\x201970\x2000:00:00\ SF:x20GMT\r\nPragma:\x20no-cache\r\nWWW-Authenticate:\x20Basic\x20realm=\" SF:tswitch\"\r\nConnection:\x20close\r\n\r\n |
To scan a range of IP addresses
# nmap 192.168.1.1-50
To scan an entire subnet
# nmap 192.168.1.0/24
Ping only scan
# nmap -sP 192.168.1.1
TCP SYN scan
# nmap -sS 192.168.1.1
UDP scan
# nmap -sU 192.168.1.1IP protocol scan
# nmap -sO 192.168.1.1
Scan port 80, 25, 443, and 110
# nmap -p 80,25,443,110 192.168.1.1
Scan port ranges 1024-2048
# nmap -p 1024-2048 192.168.1.1
Operating system detection
# nmap -O --osscan-guess 192.168.1.1
Source : Cyberciti.biz