Kali Nmap discovery essentials cheat sheet
Discover a lab host’s exposed TCP services and interpret scan states.
Kali Linux with Nmap 7.x. Examples use one explicitly authorized lab host.
Updated · Kali Linux · 7 min read
| Command | What it does |
|---|---|
nmap --version | Check the installed scanner version |
nmap -sn <lab-ip> | Check host discovery responses |
nmap -sT -p 22,80,443 <lab-ip> | Inspect three selected TCP ports |
nmap -sT -sV -p 22,80,443 <lab-ip> | Identify services on selected ports |
Walkthrough
Replace <lab-ip> with the address of a system you own or have permission to assess. These commands send network probes; agree on scope before scanning.
Step 1: Check the installed scanner version
nmap --version
Record the Nmap version and available libraries before following examples. Package versions can differ between Kali installations and rolling updates.
Step 2: Check host discovery responses
nmap -sn <lab-ip>
Replace the placeholder with one approved target. Host discovery does not perform a port scan. A host marked down may simply block the discovery probes; it is not proof the machine is absent.
Step 3: Inspect three selected TCP ports
nmap -sT -p 22,80,443 <lab-ip>
This TCP connect scan checks only the listed ports. Open means a connection was accepted; closed and filtered have different meanings. Results reflect this source host and observation time.
Step 4: Identify services on selected ports
nmap -sT -sV -p 22,80,443 <lab-ip>
Service detection sends additional application probes. Treat product and version matches as evidence to verify with the service owner, not a definitive vulnerability finding.