Nmap (Network Mapper) is a

network scanner Network enumeration is a computing activity in which usernames and info on groups, shares, and services of networked computers are retrieved. It should not be confused with network mapping, which only retrieves information about which servers ar ...

created by

Gordon Lyon Gordon Lyon (also known by his pseudonym Fyodor Vaskovich) is an American network security expert, creator of Nmap and writer of books, websites, and technical papers about network security. He is a founding member of the Honeynet Project and wa ...

(also known by his

pseudonym A pseudonym (; ) or alias () is a fictitious name that a person or group assumes for a particular purpose, which differs from their original or true name (orthonym). This also differs from a new name that entirely or legally replaces an individua ...

''Fyodor Vaskovich''). Nmap is used to discover

hosts A host is a person responsible for guests at an event or for providing hospitality during it. Host may also refer to: Places *Host, Pennsylvania, a village in Berks County People *Jim Host (born 1937), American businessman *Michel Host ( ...

and

services Service may refer to: Activities * Administrative service, a required part of the workload of university faculty * Civil service, the body of employees of a government * Community service, volunteer service for the benefit of a community or a p ...

on a

computer network A computer network is a set of computers sharing resources located on or provided by network nodes. The computers use common communication protocols over digital interconnections to communicate with each other. These interconnections are ...

by sending packets and analyzing the responses. Nmap provides a number of features for probing computer networks, including host discovery and service and

operating system An operating system (OS) is system software that manages computer hardware, software resources, and provides common services for computer programs. Time-sharing operating systems schedule tasks for efficient use of the system and may also in ...

detection. These features are extensible by

scripts Script may refer to: Writing systems * Script, a distinctive writing system, based on a repertoire of specific elements or symbols, or that repertoire * Script (styles of handwriting) ** Script typeface, a typeface with characteristics of handw ...

that provide more advanced service detection, vulnerability detection, and other features. Nmap can adapt to network conditions including latency and congestion during a scan. Nmap started as a

Linux Linux ( or ) is a family of open-source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991, by Linus Torvalds. Linux is typically packaged as a Linux distribution, which ...

utility and was ported to other systems including

Windows Windows is a group of several proprietary graphical operating system families developed and marketed by Microsoft. Each family caters to a certain sector of the computing industry. For example, Windows NT for consumers, Windows Server for serv ...

macOS macOS (; previously OS X and originally Mac OS X) is a Unix operating system developed and marketed by Apple Inc. since 2001. It is the primary operating system for Apple's Mac computers. Within the market of desktop and lapt ...

, and

BSD The Berkeley Software Distribution or Berkeley Standard Distribution (BSD) is a discontinued operating system based on Research Unix, developed and distributed by the Computer Systems Research Group (CSRG) at the University of California, Berk ...

. It is most popular on Linux, followed by Windows.

Features

Nmap features include: * Host discovery – Identifying hosts on a network. For example, listing the hosts that respond to TCP and/or ICMP requests or have a particular port open. *

Port scanning A port scanner is an application designed to probe a server or host for open ports. Such an application may be used by administrators to verify security policies of their networks and by attackers to identify network services running on a host a ...

– Enumerating the open

ports A port is a maritime facility comprising one or more wharves or loading areas, where ships load and discharge cargo and passengers. Although usually situated on a sea coast or estuary, ports can also be found far inland, such as H ...

on target hosts. * Version detection – Interrogating network services on remote devices to determine application name and version number. *

TCP/IP stack fingerprinting TCP/IP stack fingerprinting is the remote detection of the characteristics of a TCP/IP stack implementation. The combination of parameters may then be used to infer the remote machine's operating system (aka, OS fingerprinting), or incorporated ...

– Determining the

and hardware characteristics of network devices based on observations of network activity of said devices. * Scriptable interaction with the target – using Nmap Scripting Engine (NSE) and

Lua Lua or LUA may refer to: Science and technology * Lua (programming language) * Latvia University of Agriculture * Last universal ancestor, in evolution Ethnicity and language * Lua people, of Laos * Lawa people, of Thailand sometimes referred t ...

programming language. Nmap can provide further information on targets, including reverse

DNS The Domain Name System (DNS) is a hierarchical and distributed naming system for computers, services, and other resources in the Internet or other Internet Protocol (IP) networks. It associates various information with domain names assigned to ...

names, device types, and

MAC address A media access control address (MAC address) is a unique identifier assigned to a network interface controller (NIC) for use as a network address in communications within a network segment. This use is common in most IEEE 802 networking techno ...

es. Typical uses of Nmap: * Auditing the security of a device or

firewall Firewall may refer to: * Firewall (computing), a technological barrier designed to prevent unauthorized or unwanted communications between computer networks or hosts * Firewall (construction), a barrier inside a building, designed to limit the spr ...

by identifying the network connections which can be made to, or through it. * Identifying open ports on a target host in preparation for auditing. * Network inventory,

network mapping Network mapping is the study of the physical connectivity of networks e.g. the Internet. Network mapping discovers the devices on the network and their connectivity. It is not to be confused with network discovery or Network enumeration, network ...

, maintenance and asset management. * Auditing the security of a network by identifying new servers. * Generating traffic to hosts on a network, response analysis and response time measurement. * Finding and exploiting vulnerabilities in a network. *

queries and subdomain search

User interfaces

NmapFE, originally written by Kanchan, was Nmap's official

GUI The GUI ( "UI" by itself is still usually pronounced . or ), graphical user interface, is a form of user interface that allows users to interact with electronic devices through graphical icons and audio indicator such as primary notation, inste ...

for Nmap versions 2.2 to 4.22. For Nmap 4.50 (originally in the 4.22SOC development series) NmapFE was replaced with Zenmap, a new official graphical user interface based on UMIT, developed by Adriano Monteiro Marques. Web-based interfaces exists that allow either controlling Nmap or analysing Nmap results from a web browser, such as IVRE. Image:Zenmap.png, ''Zenmap'', showing results for a port scan against Wikipedia Image:Nmapfe screenshot.png, ''NmapFE'', showing results for a port scan against Wikipedia Image:Xnmap.png, ''XNmap'', a Mac OS X GUI

Output

Nmap provides four possible output formats. All but the interactive output is saved to a file. Nmap output can be manipulated by text processing software, enabling the user to create customized reports. ; Interactive: presented and updated real time when a user runs Nmap from the command line. Various options can be entered during the scan to facilitate monitoring. ;

XML Extensible Markup Language (XML) is a markup language and file format for storing, transmitting, and reconstructing arbitrary data. It defines a set of rules for encoding documents in a format that is both human-readable and machine-readable ...

: a format that can be further processed by XML tools. It can be converted into a

HTML The HyperText Markup Language or HTML is the standard markup language for documents designed to be displayed in a web browser. It can be assisted by technologies such as Cascading Style Sheets (CSS) and scripting languages such as JavaScri ...

report using

XSLT XSLT (Extensible Stylesheet Language Transformations) is a language originally designed for transforming XML documents into other XML documents, or other formats such as HTML for web pages, plain text or XSL Formatting Objects, which may subseque ...

. ; Grepable: output that is tailored to line-oriented processing tools such as

grep grep is a command-line utility for searching plain-text data sets for lines that match a regular expression. Its name comes from the ed command ''g/re/p'' (''globally search for a regular expression and print matching lines''), which has the sa ...

sed sed ("stream editor") is a Unix utility that parses and transforms text, using a simple, compact programming language. It was developed from 1973 to 1974 by Lee E. McMahon of Bell Labs, and is available today for most operating systems. sed w ...

, or

awk AWK (''awk'') is a domain-specific language designed for text processing and typically used as a data extraction and reporting tool. Like sed and grep, it is a filter, and is a standard feature of most Unix-like operating systems. The AWK lang ...

. ; Normal: the output as seen while running Nmap from the command line, but saved to a file. ;

Script kiddie A script kiddie, skiddie, kiddie, or skid is an unskilled individual who uses scripts or programs developed by others, primarily for malicious purposes. Characteristics In a Carnegie Mellon report prepared for the U.K. Department of Defense in 2 ...

:meant to be an amusing way to format the interactive output replacing letters with their visually alike number representations. For example, Interesting ports becomes Int3rest1ng p0rtz. This is known as

Leet Leet (or "1337"), also known as eleet or leetspeak, is a system of modified spellings used primarily on the Internet. It often uses character replacements in ways that play on the similarity of their glyphs via reflection or other resemblance. ...

History

Nmap was first published in September 1997, as an article in Phrack Magazine with source-code included. With help and contributions of the computer security community, development continued. Enhancements included operating system fingerprinting, service fingerprinting, code rewrites ( C to

C++ C++ (pronounced "C plus plus") is a high-level general-purpose programming language created by Danish computer scientist Bjarne Stroustrup as an extension of the C programming language, or "C with Classes". The language has expanded significan ...

), additional scan types, protocol support (e.g.

IPv6 Internet Protocol version 6 (IPv6) is the most recent version of the Internet Protocol (IP), the communication protocol, communications protocol that provides an identification and location system for computers on networks and routes traffic ...

SCTP The Stream Control Transmission Protocol (SCTP) is a computer networking communications protocol in the transport layer of the Internet protocol suite. Originally intended for Signaling System 7 (SS7) message transport in telecommunication, the p ...

), and new programs that complement Nmap's core features. Major releases include:

Legal issues

Nmap is a tool that can be used to discover services running on Internet connected systems. Like any tool, it could potentially be used for

black hat hacking A Black Hat (Black Hat Hacker or Blackhat) is a computer hacker who usually violates laws or typical ethical standards. The term originates from the 1950s westerns, when bad guys typically wore black hats and good guys white hats. Black hat hacker ...

, as a precursor to attempts to gain unauthorized access to computer systems; however, Nmap is also used by security and systems administrators to assess their own networks for vulnerabilities (i.e. white hat hacking). System administrators can use Nmap to search for unauthorized servers, or for computers that do not conform to security standards. In 2003

Supreme Court of Finland The Supreme Court of Finland ( fi, korkein oikeus, abbreviated as ''KKO''; sv, högsta domstolen, abbreviated as ''HD''), located in Helsinki, is the court of last resort for cases within the private law of Finland (that is, civil and criminal ...

has ruled the port scanning has amounted to an attempted computer break in, which was illegal under Finnish Penal code at the time:

''In its ruling the Supreme Court stated that the defendant had systematically carried out port scanning operations to gather information for the purpose of unauthorised break-in to the bank's computer network. This amounted to an attempted computer break in.''

License

Nmap was originally distributed under the

GNU Public License The GNU General Public License (GNU GPL or simply GPL) is a series of widely used free software licenses that guarantee end users the four freedoms to run, study, share, and modify the software. The license was the first copyleft for general us ...

(GPL). In later releases, Nmap's authors added clarifications and specific interpretations to the license where they felt the GPL was unclear or lacking. For instance, Nmap 3.50 specifically revoked the license of

SCO Group The SCO Group (often referred to SCO and later called The TSG Group) was an American software company in existence from 2002 to 2012 that became known for owning Unix operating system assets that had belonged to the Santa Cruz Operation (the ...

to distribute Nmap software because of their views on the SCO-Linux controversies. Starting with version 7.90, Nmap transitions to a new custom license NPSL, dual-licensing versions 7.90, 7.91, and 7.92 under both old and new licenses. Several Linux distributions consider the new license non-free.

In popular culture

In ''

The Matrix Reloaded ''The Matrix Reloaded'' is a 2003 American science-fiction action film written and directed by the Wachowskis. It is a sequel to '' The Matrix'' (1999) and the second installment in the ''Matrix'' film series. The film stars Keanu Reeves, Lau ...

'',

Trinity The Christian doctrine of the Trinity (, from 'threefold') is the central dogma concerning the nature of God in most Christian churches, which defines one God existing in three coequal, coeternal, consubstantial divine persons: God the F ...

is seen using Nmap to access a power plant's computer system, allowing Neo to "physically" break into a building. The appearance of Nmap in the film was widely discussed on Internet forums and hailed as an unusually realistic example of hacking. Nmap and NmapFE were used in '' The Listening'', a 2006 movie about a former NSA officer who defects and mounts a clandestine counter-listening station high in the Italian alps. Nmap source code can be seen in the movie '' Battle Royale'', as well as brief views of the command line version of Nmap executing in ''

Live Free or Die Hard ''Live Free or Die Hard'' (released as ''Die Hard 4.0'' outside North America) is a 2007 American action-thriller film directed by Len Wiseman, and serves as the fourth installment in the ''Die Hard'' film series. It is based on the 1997 arti ...

'' and ''

Bourne Ultimatum ''The Bourne Ultimatum'' is the third Jason Bourne (character), Jason Bourne novel written by Robert Ludlum and a sequel to ''The Bourne Supremacy'' (1986). First published in 1990, it was the last Bourne novel to be written by Ludlum himself. Er ...

''. In 2013, Nmap continued to make appearances in movies including popular sci-fi movie ''

Elysium Elysium (, ), otherwise known as the Elysian Fields ( grc, Ἠλύσιον πεδίον, ''Ēlýsion pedíon'') or Elysian Plains, is a conception of the afterlife that developed over time and was maintained by some Greek religious and philos ...

''. The film ''

Dredd ''Dredd'' is a 2012 science fiction action film directed by Pete Travis and written and produced by Alex Garland. It is based on the '' 2000 AD'' comic strip '' Judge Dredd'' and its eponymous character created by John Wagner and Carlos Ezq ...

'', a film adaptation of the famous

Judge Dredd Judge Joseph Dredd is a fictional character created by writer John Wagner and artist Carlos Ezquerra. He first appeared in the second issue of ''2000 AD (comics), 2000 AD'' (1977), which is a British weekly anthology Comic book, comic. He is the ...

comics, was released in 2012 and also contains multiple Nmap scenes. Nmap is used for network reconnaissance and exploitation of the slum tower network. It is even seen briefly in the movie's trailer. The command Nmap is widely used in the video game ''

Hacknet ''Hacknet'' is a 2015 video game that allows the player to perform simulated computer hacking. Gameplay The game simulates a Unix-like operating system, with every main element of the game's interface having its own window. Windows are tiled ...

'', allowing to probe the network ports of a target system to hack it. In '' Snowden'', Nmap is used in the aptitude test scene about 14 minutes into the movie.

In academia

Nmap is an integral part of academic activities. It has been used for research involving the

TCP/IP The Internet protocol suite, commonly known as TCP/IP, is a framework for organizing the set of communication protocols used in the Internet and similar computer networks according to functional criteria. The foundational protocols in the suit ...

protocol suite and networking in general. Besides being a research tool, Nmap has also become a research topic.

Examples

$ nmap -A scanme.nmap.org Starting Nmap 6.47 ( https://nmap.org ) at 2014-12-29 20:02 CET Nmap scan report for scanme.nmap.org (74.207.244.221) Host is up (0.16s latency). Not shown: 997 filtered ports PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 5.3p1 Debian 3ubuntu7.1 (Ubuntu Linux; protocol 2.0) , ssh-hostkey: , 1024 8d:60:f1:7c:ca:b7:3d:0a:d6:67:54:9d:69:d9:b9:dd (DSA) , _ 2048 79:f8:09:ac:d4:e2:32:42:10:49:d3:bd:20:82:85:ec (RSA) 80/tcp open http Apache httpd 2.2.14 ((Ubuntu)) , _http-title: Go ahead and ScanMe! 9929/tcp open nping-echo Nping echo Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose, phone, storage-misc, WAP Running (JUST GUESSING): Linux 2.6.X, 3.X, 2.4.X (94%), Netgear RAIDiator 4.X (86%) OS CPE: cpe:/o:linux:linux_kernel:2.6.38 cpe:/o:linux:linux_kernel:3 cpe:/o:netgear:raidiator:4 cpe:/o:linux:linux_kernel:2.4 Aggressive OS guesses: Linux 2.6.38 (94%), Linux 3.0 (92%), Linux 2.6.32 - 3.0 (91%), Linux 2.6.18 (91%), Linux 2.6.39 (90%), Linux 2.6.32 - 2.6.39 (90%), Linux 2.6.38 - 3.0 (90%), Linux 2.6.38 - 2.6.39 (89%), Linux 2.6.35 (88%), Linux 2.6.37 (88%) No exact OS matches for host (test conditions non-ideal). Network Distance: 13 hops Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel TRACEROUTE (using port 80/tcp) HOP RTT ADDRESS 1 14.21 ms 151.217.192.1 2 5.27 ms ae10-0.mx240-iphh.shitty.network (94.45.224.129) 3 13.16 ms hmb-s2-rou-1102.DE.eurorings.net (134.222.120.121) 4 6.83 ms blnb-s1-rou-1041.DE.eurorings.net (134.222.229.78) 5 8.30 ms blnb-s3-rou-1041.DE.eurorings.net (134.222.229.82) 6 9.42 ms as6939.bcix.de (193.178.185.34) 7 24.56 ms 10ge10-6.core1.ams1.he.net (184.105.213.229) 8 30.60 ms 100ge9-1.core1.lon2.he.net (72.52.92.213) 9 93.54 ms 100ge1-1.core1.nyc4.he.net (72.52.92.166) 10 181.14 ms 10ge9-6.core1.sjc2.he.net (184.105.213.173) 11 169.54 ms 10ge3-2.core3.fmt2.he.net (184.105.222.13) 12 164.58 ms router4-fmt.linode.com (64.71.132.138) 13 164.32 ms scanme.nmap.org (74.207.244.221) OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 28.98 seconds

References

Bibliography

External links

* {{Official website C++ software Cross-platform free software Free network management software Linux security software Lua (programming language)-scriptable software Network analyzers Port scanners Python (programming language) software Security testing tools Unix network-related software Pentesting software toolkits