Find all IPs available in a range:
[root@lnx01 ~]# nmap -sn 192.168.0.0/24
Scan on specific ports:
# nmap -sV -p 22,443 192.168.0.0/24
Which port is open
manu-opensuse:/ # nmap -sT -p- 192.168.x.xxx Starting Nmap 7.92 ( https://nmap.org ) at 2023-02-25 18:16 CET Nmap scan report for 192.168.x.xxx Host is up (0.0018s latency). Not shown: 65520 closed tcp ports (conn-refused) PORT STATE SERVICE 53/tcp open domain 80/tcp open http 443/tcp open https ... MAC Address: 2x:xx:xx (aaaaa SAS) Nmap done: 1 IP address (1 host up) scanned in 8.34 seconds
[root@lnx01 ~]# rpm -ql nmap-ncat /usr/bin/nc /usr/bin/ncat ...
Test a port which is listening
[root@lnx01 ~]# nc -v lnx02 80 Ncat: Version 7.50 ( https://nmap.org/ncat ) Ncat: Connected to 10.10.10.213:80.
[root@lnx01 ~]# nc -v lnx02 22 Ncat: Version 7.50 ( https://nmap.org/ncat ) Ncat: Connected to 10.10.10.214:22. SSH-2.0-OpenSSH_7.4
Test a port which is not open
[root@lnx01 ~]# nc -v lnx02 3333 Ncat: Version 7.50 ( https://nmap.org/ncat ) Ncat: No route to host.
Test a port which is listening
[root@lnx01 ~]# telnet lnx02 80 Trying 10.10.10.213... Connected to lnx02. Escape character is '^]'.
Test a port which is not open
[root@lnx01 ~]# telnet lnx02 888 Trying...
Test all open ports
# nmap -A -T4 scanme.nmap.org Nmap scan report for scanme.nmap.org (74.207.244.221) Host is up (0.029s latency). rDNS record for 74.207.244.221: li86-221.members.linode.com Not shown: 995 closed ports PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 5.3p1 Debian 3ubuntu7 (protocol 2.0) | ssh-hostkey: 1024 8d:60:f1:7c:ca:b7:3d:0a:d6:67:54:9d:69:d9:b9:dd (DSA) |_2048 79:f8:09:ac:d4:e2:32:42:10:49:d3:bd:20:82:85:ec (RSA) 80/tcp open http Apache httpd 2.2.14 ((Ubuntu)) |_http-title: Go ahead and ScanMe! 646/tcp filtered ldp 1720/tcp filtered H.323/Q.931 9929/tcp open nping-echo Nping echo Device type: general purpose Running: Linux 2.6.X OS CPE: cpe:/o:linux:linux_kernel:2.6.39 OS details: Linux 2.6.39 Network Distance: 11 hops Service Info: OS: Linux; CPE: cpe:/o:linux:kernel TRACEROUTE (using port 53/tcp) HOP RTT ADDRESS [Cut first 10 hops for brevity] 11 17.65 ms li86-221.members.linode.com (74.207.244.221) Nmap done: 1 IP address (1 host up) scanned in 14.40 seconds
If you only want to know if the port is open, simply use:
# nc -vz www.microsoft.com 80
You can also use netcat to verify if UDP ports are open:
# nc -vz -u 8.8.8.8 53
And netcat can be used as a port scanner:
# nc -vz <hostname or ip address> 1-1000