How to install Nmap and run your first scan on a home lab

Install it from a source you trust

On Debian or Ubuntu, Nmap is in the main repository, so sudo apt install nmap is enough. Fedora and RHEL use dnf install nmap. On macOS the Homebrew formula is brew install nmap. On Windows, the official installer from nmap.org bundles Npcap, the packet capture driver Nmap needs to send raw packets. Avoid random mirrors and repackaged “portable” builds, because a scanner runs with high privileges and is an attractive thing to trojanize.

After installing, run nmap --version. The output names the version, the platform, and the libraries compiled in, such as libpcap and OpenSSL. Write the version in your notes. Script behavior and fingerprint databases change between releases, so a result from 7.95 and a result from 7.80 are not always comparable.

Snippet

sudo apt install nmap
nmap --version

Pick a target you are allowed to scan

Your first target should be a machine you own and can see on the same network: a Linux VM on a host-only adapter, a Raspberry Pi, or the scanning machine itself at 127.0.0.1. The project also runs scanme.nmap.org, a host whose owners explicitly allow light scanning for learning. Anything else needs written permission from its owner.

Find your VM’s address with ip addr inside the VM. A host-only network in VirtualBox defaults to 192.168.56.0/24, and VMware host-only usually uses a 192.168.x.0/24 range of its own. Knowing the range before you scan stops you from guessing and sweeping a neighbor’s address by mistake.

Lab: scan one VM and read every line

Run a default scan against the VM. Without options, Nmap resolves the name, checks the host is up, and probes the 1,000 most common TCP ports. Run it once with sudo and once without. With root, Nmap sends raw SYN packets. Without root, it falls back to full TCP connections through the operating system, which is slower and leaves entries in the target’s application logs.

Read the output top to bottom: the “Nmap scan report for” line names the target, “Host is up” shows the latency of the reply, “Not shown: 997 closed tcp ports” summarizes the boring majority, and the table lists PORT, STATE, and SERVICE. The SERVICE column at this point is only a guess from the port number in the nmap-services file, not a check of what is really listening.

Snippet

sudo nmap 192.168.56.101
nmap 192.168.56.101   # unprivileged: TCP connect scan

What to write down

A useful first note has the date, the command, the source address you scanned from, and the open ports. That is enough to rerun the scan next week and see whether anything changed. Keep the raw output with -oN so you are not retyping from a terminal.

Resist reading meaning into the SERVICE column yet. Port 8080 labeled http-proxy might be a Jenkins server, a development web app, or nothing related to a proxy at all. Version detection, covered in its own tutorial, is how you replace that guess with evidence.

Diagram

Your first scan, start to finish

Install
Use the distribution package or the official installer, then check nmap --version.
Command
```
nmap --version
```
Scope
Choose a VM, localhost, or scanme.nmap.org. Write the address down.
Scan
Run a default scan with sudo so Nmap can use raw SYN probes.
Command
```
sudo nmap 192.168.56.101
```
Record
Save output with -oN and note the date, command, and source address.

Check yourself

1. With no port options, which ports does a basic Nmap scan probe?

2. You run nmap without sudo on Linux. What scan type do you get?

3. The SERVICE column says “http-proxy” for port 8080 on a default scan. What does that prove?