Network mapping is as much an art as it is a science. While Nmap provides a vast array of tools, the key to effective scanning lies in matching the scan type to your specific goal, whether that be stealth, speed, or depth.

In this guide, we’ll break down the core scan types and options mentioned in the recent video tutorial to help you master your network discovery.

1. The Stealth Default: SYN Scan (-sS)

The SYN scan is the gold standard for most Nmap users because it strikes a perfect balance between speed and stealth.

• How it works: It is often called a “half-open” scan because it never actually completes the TCP three-way handshake. Nmap sends a SYN packet (the first step of a connection); if it receives a SYN/ACK back, it knows the port is open but immediately sends an RST (reset) packet to close the connection before it’s fully established.
• Why use it: Because the handshake is never finished, many legacy applications and older logging systems won’t record the connection attempt.
• Example: sudo nmap -sS 192.168.1.1

2. The Reliable Alternative: Connect Scan (-sT)

When you don’t have administrative (root) privileges on your machine, the TCP Connect scan is your go-to option.

• How it works: Instead of sending raw packets like the SYN scan, Nmap asks the underlying operating system to establish a full connection to the target.
• Why use it: It works without root access, but the trade-off is that it is “louder” since the handshake is completed, the connection is almost certain to be logged by the target’s firewall or service.
• Example: nmap -sT 192.168.1.1

3. Finding the Hidden: UDP Scan (-sU)

Many critical services—like DNS and SNMP—don’t use TCP at all; they use UDP.

• How it works: UDP is a connectionless protocol, meaning there is no handshake. Nmap sends a UDP packet to a port and waits to see if it gets a response or an error message.
• The Challenge: This process is significantly slower than TCP scanning because Nmap often has to wait for timeouts to confirm a port is open or filtered.
• Example: sudo nmap -sU 192.168.1.1

4. Going Deeper: Service and OS Detection

A simple scan tells you a port is open, but to truly understand your target, you need more depth.

• Service Versioning (-sV): This option probes open ports to determine exactly what service is running and, more importantly, its version number. This is crucial for identifying specific vulnerabilities.
• OS Fingerprinting (-O): By analyzing how a target responds to specific packets, Nmap can “fingerprint” the TCP/IP stack to guess which Operating System the target is running.
• Example (Deep Scan): sudo nmap -sS -sV -O 192.168.1.1

Conclusion: Match the Scan to the Goal

Before you hit enter on your next command, ask yourself what you need most:

• Stealth & Speed? Stick with the SYN scan (-sS).
• No Root Access? Use the Connect scan (-sT).
• Comprehensive Coverage? Don’t forget the UDP scan (-sU) for DNS and SNMP.
• Maximum Detail? Layer on -sV and -O to reveal the software and OS behind the ports.

By picking the right tool for the job, you ensure your network discovery is efficient and effective.