Hardening Server Security with Nmap Port Scans: A Practical Guide

sudo apt install -y nmap    # Ubuntu / Debian
sudo yum install -y nmap    # CentOS / RHEL
brew install nmap           # macOS

nmap --version

# Single host scan (default 1,000 ports)
nmap 192.168.1.1

# Domain
nmap example.com

# Multiple hosts
nmap 192.168.1.1 192.168.1.2 192.168.1.5

# Range scan
nmap 192.168.1.0/24
nmap 192.168.1.1-50

# Scan yourself (server security check)
nmap localhost

# Specific ports
nmap -p 22,80,443 192.168.1.1

# Port range
nmap -p 1-1024 192.168.1.1

# All ports (65535)
nmap -p- 192.168.1.1

# Top 100 ports (fast scan)
nmap -F 192.168.1.1

# SYN scan (default, requires root) — fast and stealthy
sudo nmap -sS 192.168.1.1

# TCP Connect scan (root not required)
nmap -sT 192.168.1.1

# UDP scan (slow)
sudo nmap -sU 192.168.1.1

# ICMP ping scan (host discovery)
sudo nmap -sn 192.168.1.0/24

# Host discovery without a port scan
nmap -sP 192.168.1.0/24

# Service version detection (-sV)
nmap -sV 192.168.1.1

# OS detection (-O, requires root)
sudo nmap -O 192.168.1.1

# Aggressive scan (-A: OS + version + scripts + traceroute)
sudo nmap -A 192.168.1.1

# Full check of your own server (commonly used in practice)
sudo nmap -A -p- localhost

# Run default safe scripts
nmap --script=default 192.168.1.1

# HTTP-related scripts
nmap --script=http-title,http-headers,http-methods 192.168.1.1

# SSH-related
nmap --script=ssh-auth-methods,ssh-hostkey 192.168.1.1

# SSL/TLS check
nmap --script=ssl-enum-ciphers -p 443 192.168.1.1

# Known vulnerability scan (vuln category)
sudo nmap --script=vuln 192.168.1.1

# Heartbleed check
nmap --script=ssl-heartbleed -p 443 192.168.1.1

# Plain text
nmap -oN result.txt 192.168.1.1

# XML (for parsing)
nmap -oX result.xml 192.168.1.1

# All three formats at once
nmap -oA result 192.168.1.1   # result.nmap, result.xml, result.gnmap

# Grepable format
nmap -oG result.gnmap 192.168.1.1

# T0–T5 (0 = slowest, 5 = fastest, default T3)
nmap -T1 192.168.1.1    # Slow and stealthy (IDS evasion)
nmap -T4 192.168.1.1    # Fast (internal network checks)
nmap -T5 192.168.1.1    # Maximum speed (impacts the network)

# 1. Check open ports
sudo nmap -p- -T4 localhost

# 2. Close unnecessary ports if any
sudo systemctl stop unnecessary-service
sudo ufw deny port-number

# 3. Check service versions (upgrade if outdated)
sudo nmap -sV localhost

# 4. Periodic audit script
sudo nmap -oN /var/log/nmap-$(date +%Y%m%d).txt localhost