Nmap
Network SecurityDiscover hosts and open services on a network.
Who uses it?
Network administrators, penetration testers and security teams. Only scan systems you are authorised to test.
Best for
Mapping hosts and exposed services
Similar tools
Wireshark, Zeek
What is it?
Nmap is a free network scanner used to discover devices and identify which services they expose.
What problem does it solve?
You cannot protect what you do not know about. Nmap helps map what is reachable.
How does it work?
Nmap sends probes to target addresses and ports. It interprets the responses to determine which hosts are up and which ports are open. Optional scripts and version detection provide more detail.
Simple example
nmap -sV 192.168.1.0/24Detects service versions across a private range. Scan only networks you are authorised to test.
When would a SOC analyst use it?
When verifying an alert about exposed services, or when checking what an internal host is running during an investigation.
How does it work?
- 1Nmap sends probes to target addresses and ports.
- 2It interprets the responses to determine which hosts are up and which ports are open.
- 3Optional scripts and version detection provide more detail.
Simple example
Scan an authorised test range to list the hosts that respond and the services they expose.
nmap -sV 192.168.1.0/24Detects service versions across a private range. Scan only networks you are authorised to test.
When would a SOC analyst use it?
When verifying an alert about exposed services, or when checking what an internal host is running during an investigation.
Who uses it?
Network administrators, penetration testers and security teams. Only scan systems you are authorised to test.
Pros
- Free and widely documented
- Flexible and scriptable
- Fast host discovery
Cons
- Scanning without permission can be illegal
- Results need interpretation
- Can be noisy on monitored networks
