nmap

Identify open ports and enumerate network services with Nmap.

811|123|Updated Nov 17, 2025

Search Tags:#security #reconnaissance #network #nmap #service-detection #port-scan

Ready to run

npx skills add https://github.com/BrownFineSecurity/iothackbot --skill nmap

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: nmap
Source: https://github.com/BrownFineSecurity/iothackbot/tree/main/skills/nmap
Command: npx skills add https://github.com/BrownFineSecurity/iothackbot --skill nmap

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Network reconnaissance and port discovery can be slow and error-prone. This skill guides you through a structured two-phase approach to quickly identify open ports and then enumerate services, versions, and potential vulnerabilities.

Core Features & Use Cases

Two-Phase Scanning: Fast port discovery followed by targeted service detection.
Service Version & NSE Scripts: Identify running versions and run default NSE checks for deeper insights.
Organized Output: Clear results directories with standardized filenames for easy report generation.

Quick Start

Phase 1: sudo nmap -p- <target> -oA nmap-portscan
Phase 2: nmap -p <OPEN_PORTS> -sV -sC <target> -oA nmap-services

Frequently Asked Questions about nmap

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I find open ports on a network host?▼

Port scanning identifies open ports by sending network packets to target addresses. Nmap performs comprehensive port discovery across all 65535 TCP and UDP ports or selective ranges, using fast SYN scans (requiring root privileges) to rapidly detect which ports accept connections and which services are listening.

What's the best way to enumerate service versions during network reconnaissance?▼

Service enumeration uses version detection flags (-sV) combined with default NSE scripts (-sC) to identify running software, versions, and potential vulnerabilities. A two-phase approach—fast port discovery followed by targeted service detection on open ports—balances speed with detailed intelligence gathering.

How do I perform OS fingerprinting on a target network?▼

OS fingerprinting analyzes network responses to determine operating systems running on discovered hosts. Nmap combines port scan results, service version data, and NSE script output to build fingerprints that reveal host platform details alongside service inventory.

Do I need root privileges to run comprehensive network scans?▼

SYN scans—the fastest port discovery method—require root privileges to send raw network packets. Standard user scans use TCP connect mode, which is slower but needs no elevated access; choose based on speed requirements and available permissions.

What's the difference between quick port scans and comprehensive reconnaissance?▼

Quick scans discover open ports rapidly using SYN methods on common ports or all 65535 ports without version detection. Comprehensive reconnaissance adds service version detection, NSE script enumeration, and OS fingerprinting to deliver deeper vulnerability intelligence and service inventory.