Tips Using Nmap IP and Port Scanner on Ubuntu

Nmap (Network Mapper) is a security scanner originally written by Gordon Lyon (also known by his pseudonym Fyodor Vaskovich) used to discover hosts and services on a computer network, thus creating a “map” of the network. Nmap runs on Linux, Microsoft Windows, Solaris, HP-UX and BSD variants (including Mac OS X), and also on AmigaOS and SGI IRIX.[2] Linux is the most popular nmap platform with Windows following it closely.

It’s very easy to install nmap in Ubuntu, just download from the internet :

zullfree@zullfree:~$ sudo apt-get install nmap
[sudo] password for zullfree:
Reading package lists… Done
Building dependency tree
Reading state information… Done
The following packages were automatically installed and are no longer required:
linux-headers-2.6.32-21 linux-headers-2.6.32-21-generic
Use ‘apt-get autoremove’ to remove them.
The following extra packages will be installed:
liblua5.1-0
The following NEW packages will be installed:
liblua5.1-0 nmap
0 upgraded, 2 newly installed, 0 to remove and 29 not upgraded.
Need to get 1,671kB of archives.
After this operation, 6,541kB of additional disk space will be used.
Do you want to continue [Y/n]? y
Get:1 http://id.archive.ubuntu.com/ubuntu/ lucid/main liblua5.1-0 5.1.4-5 [82.2kB]
Get:2 http://id.archive.ubuntu.com/ubuntu/ lucid/main nmap 5.00-3 [1,589kB]
Fetched 1,671kB in 5s (303kB/s)
Selecting previously deselected package liblua5.1-0.
(Reading database … 149317 files and directories currently installed.)
Unpacking liblua5.1-0 (from …/liblua5.1-0_5.1.4-5_i386.deb) …
Selecting previously deselected package nmap.
Unpacking nmap (from …/archives/nmap_5.00-3_i386.deb) …
Processing triggers for man-db …
Setting up liblua5.1-0 (5.1.4-5) …

Setting up nmap (5.00-3) …

Processing triggers for libc-bin …
ldconfig deferred processing now taking place

to run nmap to scan ip address with range 10.10.28.0 – 10.10.28.254, you just run command :

zullfree@zullfree:~$ nmap -sP 10.10.28.0/24

and the result :

Starting Nmap 5.00 ( http://nmap.org ) at 2010-08-30 17:23 WIT
Host 10.10.28.1 is up (0.00025s latency).
Host 10.10.28.3 is up (0.00032s latency).
Host 10.10.28.7 is up (0.000098s latency).
Host 10.10.28.9 is up (0.00022s latency).
Host 10.10.28.21 is up (0.00032s latency).
Host 10.10.28.22 is up (0.00030s latency).
Host 10.10.28.41 is up (0.0012s latency).
Host 10.10.28.42 is up (0.0011s latency).
Host 10.10.28.43 is up (0.0010s latency).
Host 10.10.28.44 is up (0.0010s latency).
Host 10.10.28.45 is up (0.0013s latency).
Host 10.10.28.46 is up (0.0012s latency).
Host 10.10.28.47 is up (0.0016s latency).
Host 10.10.28.48 is up (0.0015s latency).
Host 10.10.28.49 is up (0.0015s latency).
Host 10.10.28.50 is up (0.0015s latency).
Host 10.10.28.51 is up (0.0012s latency).
Host 10.10.28.100 is up (0.012s latency).
Host 10.10.28.105 is up (0.0041s latency).
Host 10.10.28.131 is up (0.0041s latency).
Nmap done: 256 IP addresses (20 hosts up) scanned in 2.36 seconds

Port Scanning with range 100-150

zullfree@zullfree:~$ nmap 10.10.28.22 -p100-150

Starting Nmap 5.00 ( http://nmap.org ) at 2010-08-30 17:33 WIT
Interesting ports on 10.10.28.22:
Not shown: 49 closed ports
PORT STATE SERVICE
135/tcp open msrpc
139/tcp open netbios-ssn

Nmap done: 1 IP address (1 host up) scanned in 1.16 seconds

for Scan Operating System :

zullfree@zullfree:~$ sudo nmap 10.10.28.22 -O

Starting Nmap 5.00 ( http://nmap.org ) at 2010-08-30 17:35 WIT
Interesting ports on 10.10.28.22:
Not shown: 988 closed ports
PORT STATE SERVICE
135/tcp open msrpc
139/tcp open netbios-ssn
445/tcp open microsoft-ds
3389/tcp open ms-term-serv
5101/tcp open admdog
49152/tcp open unknown
49153/tcp open unknown
49154/tcp open unknown
49155/tcp open unknown
49156/tcp open unknown
49157/tcp open unknown
49160/tcp open unknown
MAC Address: 00:04:4B:16:59:89 (Nvidia)
Device type: general purpose
Running: Microsoft Windows Vista|2008|7
OS details: Microsoft Windows Vista SP0 or SP1, Server 2008, or Windows 7 Ultimate (build 7000)
Network Distance: 1 hop

OS detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 8.39 seconds

nmap Faster Execution

If you want to make faster scan, use -T4 option on nmap command.

zullfree@zullfree:~$ sudo nmap -A -T4 10.10.28.3

Starting Nmap 5.00 ( http://nmap.org ) at 2010-08-30 17:38 WIT
Interesting ports on 10.10.28.3:
Not shown: 998 closed ports
PORT STATE SERVICE VERSION
5009/tcp open airport-admin Apple AirPort admin
10000/tcp open snet-sensor-mgmt?
MAC Address: 00:1F:F3:42:BD:75 (Apple)
Device type: general purpose
Running: NetBSD 4.X
OS details: NetBSD 4.99.4
Network Distance: 1 hop

OS and Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 83.68 seconds