Category hub: Security tools and testing methods

In one sentence: Nmap is a free tool that maps a network by checking which devices and which ports are open, used by IT teams to audit their own systems and by attackers to find a way in.

What it is

Nmap stands for Network Mapper. Its documentation calls it an open source tool for network exploration and security auditing, designed to scan large networks rapidly although it works fine against single hosts.

The Nmap Reference Guide says it uses raw IP packets to find which hosts are on a network, what services (application name and version) they offer, which operating systems they run and what kinds of packet filter or firewall are in use. Many administrators use it for network inventory, planning service upgrades and monitoring uptime. Its main output is a table of ports with the number, protocol, service name and state.

How it works

1. Find live devices. Nmap sends probes to see which addresses respond.
2. Check ports. For each device it tests ports and records whether each is open, closed or filtered by a firewall.
3. Identify services. It can ask each open port what software and version is behind it.
4. Guess the system. It can estimate the operating system from how the device answers.
5. Run scripts. The Nmap Scripting Engine adds checks for discovery and some vulnerability detection. The documentation says Nmap includes about 50 such scripts.
6. Report. A person decides what should and should not be exposed.

Nmap shows what is reachable. It does not say whether a service can be broken into without further testing.

Who it affects and how badly

• Sole trader to 10 staff. Anyone can run Nmap against your public address. If your router or NAS exposes services, they will be seen.
• 10 to 250 staff. Offices, MSPs and SaaS firms can use it on their own networks to find forgotten servers, printers and cameras.
• 250 plus and regulated firms. Large estates use it for inventory and to show auditors which ports are open.
• Legal point. Scan only systems you own or have written permission to test. The UK Computer Misuse Act 1990 makes it an offence to secure unauthorised access to computer material, and the CPS says the offender must know the access is unauthorised.

Real examples

• Malware behaving like a scanner. CISA’s WannaCry indicators describe the dropper building a list of IP ranges on the local network and trying UDP ports 137 and 138 and TCP ports 139 and 445. If port 445 answered, it tried to spread. This is port scanning used by malware.
• Defenders’ use. The Nmap project describes network inventory and finding rogue devices.

How to detect it

• Firewall logs showing one address trying many ports on one machine, or one port on many machines, in a short time.
• Intrusion detection alerts for port scans.
• Your own scheduled scans, labelled so you can tell them from attacks.
• Windows Firewall logging, if turned on, to see dropped connections.

How to fix or prevent it

You cannot stop people scanning, but you can make the results dull.
1. Close ports and services you do not need.
2. Keep management ports such as RDP, SSH and SMB off the internet, and reach them through a VPN or gateway.
3. Patch the services that must stay open.
4. Scan yourself regularly and compare with your asset list to find surprises.
5. Alert on scan patterns and block repeat offenders where sensible.
6. Segment the network so one infected PC cannot see every machine.
7. Do not rely on moving services to odd ports. Scanners check those too.

Related terms

• Vulnerability scanning
• Penetration testing methodology
• Port 445 (SMB)
• Port 3389 (RDP)
• Port 22 (SSH)
• CVE
• Nessus
• How to check which ports are open on your network

FAQ

What is Nmap used for?
Network discovery and security auditing. It finds hosts, open ports, services and operating systems, and administrators also use it for inventory and uptime checks.

Is it legal to run Nmap?
Nmap is free and widely used. Scan only your own systems or those you have written permission to test, because the Computer Misuse Act 1990 covers unauthorised access.

Does Nmap find vulnerabilities?
It reports ports and services and has some scripts for vulnerability detection. It does not replace a full scan or a penetration test.

Sources

• https://nmap.org/book/man.html
• https://nmap.org/docs.html
• https://www.cisa.gov/news-events/alerts/2017/05/12/indicators-associated-wannacry-ransomware
• https://www.cps.gov.uk/prosecution-guidance/computer-misuse-act
• https://www.legislation.gov.uk/ukpga/1990/18/contents

How Wolfcore helps

A Wolfcore penetration test finds this the way an attacker would, by hand, not with a scanner. Start with the free web vulnerability scan.