19.6 Nmap Basics: Host Discovery, Port States and Scan Types

By Ravindra Bagale Last updated: 27 September 2026

Nmap (Network Mapper) ha scanning cha raja aahe. Part 1 madhe aapan ports aani TCP 3-way handshake shiklo – aata tech gyaan ithe kaamala yeta. Nmap don prashnanchi uttara deto: (1) konte hosts jivant aahet? aani (2) tyanchyavar konte ports ughde aahet?

Host discovery – find live hosts without port scanning:

sudo nmap -sn 192.168.56.0/24          # "ping scan": discovery only, no ports
sudo nmap -sn -PR 192.168.56.0/24      # force ARP discovery (default on a local LAN as root)
sudo nmap -Pn 192.168.56.20            # skip discovery, treat the host as up (when ping is blocked)
nmap -sL 192.168.56.0/28               # just list targets, send nothing (check your range first)

On a local network run as root, Nmap uses ARP for discovery automatically. On remote networks it uses ICMP echo, TCP SYN to 443, TCP ACK to 80 and ICMP timestamp. If a host blocks all of these, Nmap says it is down – that is when -Pn helps.

Port states – Nmap reports every port in one of six states:

State	Meaning	Usually caused by
`open`	An application is accepting connections on this port	A running service (SSH, Apache, MySQL...)
`closed`	Port reachable, but nothing is listening	Host is up, service not installed or stopped
`filtered`	Nmap cannot tell – probes get no reply or an ICMP error	A firewall or security group dropping packets
`unfiltered`	Reachable, but open/closed unknown	Only seen with an ACK scan (`-sA`)
`open\|filtered`	Cannot tell open from filtered	UDP or FIN/NULL/Xmas scans with no reply
`closed\|filtered`	Cannot tell closed from filtered	Rare; IP ID idle scan

Main scan types – remember the 3-way handshake from Chapter 3 (SYN, SYN-ACK, ACK):

Scan	Command	How it works	Notes
TCP SYN ("half-open")	`sudo nmap -sS 192.168.56.20`	Sends SYN; SYN-ACK means open, then sends RST instead of ACK	Default as root; fast
TCP connect	`nmap -sT 192.168.56.20`	Completes the full handshake using the OS	Default without root; logged by the service
UDP	`sudo nmap -sU --top-ports 50 192.168.56.20`	Sends UDP probes; ICMP "port unreachable" means closed	Slow – limit the ports
ACK	`sudo nmap -sA 192.168.56.20`	Maps firewall rules (filtered vs unfiltered)	Does not find open ports

Choosing ports:

nmap 192.168.56.20                    # default: top 1000 TCP ports
nmap -p 22,80,443 192.168.56.20       # specific ports
nmap -p 1-1024 192.168.56.20          # a range
sudo nmap -p- 192.168.56.20           # all 65535 TCP ports
nmap -F 192.168.56.20                 # fast: top 100 ports
nmap --open 192.168.56.20             # show only open ports

Ravindra Bagale's Tip

When they see filtered, students say "the port is closed". No! closed means the host replied "nobody's here", while filtered means a firewall in between swallowed the packet – we don't know what's inside. On AWS, if a port isn't allowed in the security group, it will always show as filtered. This difference is asked in interviews for sure.

Ravindra Bagale's Tip – मराठी

filtered बघितलं की students म्हणतात "port बंद आहे". नाही! closed म्हणजे host ने उत्तर दिलं "इथे कोणी नाही", आणि filtered म्हणजे मधे firewall ने packet गिळला – आत काय आहे ते माहीत नाही. AWS वर security group मध्ये port allow नसेल तर नेहमी filtered दिसेल. हा फरक interview मध्ये हमखास विचारला जातो.

Ravindra Bagale's Tip – हिंदी

filtered देखते ही students कहते हैं "port बंद है". नहीं! closed यानी host ने जवाब दिया "यहाँ कोई नहीं है", और filtered यानी बीच में firewall ने packet निगल लिया – अंदर क्या है पता नहीं. AWS पर security group में port allow न हो तो हमेशा filtered दिखेगा. यह फ़र्क interview में ज़रूर पूछा जाता है.

Lab

Against Metasploitable 2 (192.168.56.20) run sudo nmap -sS, then nmap -sT, then sudo nmap -sU --top-ports 20. Compare the time taken and the open ports. Then on your own EC2 instance from Chapter 4, close port 80 in the security group and scan it from your laptop: note that port 80 changes from open to filtered.