Articles
Downloads
The Tech Teapot
Security Scanning with Nmap
How to use Nmap to scan your network for security weaknesses
Your network is under threat. If there are weaknesses or vulnerabilities in your Firewalls, or if your Servers have ports open unnecessarily, you run the risk of your security being breached. You can only protect against this by proactively testing your own systems using the methods employed by the hackers.
Nmap, Network Mapper, is a powerful tool for performing security audits and network exploration on all sizes of network, everything from a single host to very large networks containing thousands of devices.
Nmap can detect which devices are on the network, the services (ports) they are offering, and details of the operating systems in use. Nmap can probe your Firewalls to determine how they are configured, the types of packet filtering in use, where the weaknesses are, and help you plug the holes.
Windows Support
Nmap runs on Microsoft Windows 2000 and XP. It does not run on Windows 98, ME, or CE.
Setting up a Scan
Nmap allows a wide range of scanning options. Hosts detected will be probed depending on the options selected and details displayed and logged as required.
You may set scanning to run at preset intervals.
It is also possible to build an input file of hosts and ranges to scan and use that instead of typing a list of IP addresses or names.
Scanning a range of IP addresses
You can scan a single host or a range of hosts, by name or by IP address. Options may be combined.
To scan a range from IP address 10.0.0.0 to 10.0.0.255 type:
10.0.0.0-255
and click Scan.
Alternatively you can replace any element of the IP address with an asterisk (*) type:
10.0.0.* (equivalent to 10.0.0.0-255 above)
and click Scan.
To scan part of a range type:
10.0.0.1-20
and click Scan. This will scan the addresses from 1 to 20 inclusive.
The range of addresses need not be continuous. So:
10.0.0.1-21,30-60
would scan addresses 1 to 21 and 30 to 60, missing out those in between.
To scan a wider range specify other networks:
10.0.1,2,3.*
would scan 256 addresses in each of the 1, 2, 3 networks.
For an even bigger range of addresses type:
10.0.*.*
This would scan the whole class B network.
The /mask option may also be used to specify the range.
10.0.0.0/16
would scan all the class B range.
10.0.0.0/24
would scan all a class C range.
10.0.0.0/32 (equivalent to typing a single IP address)
would scan a single device.