Problem solve Get help with specific problems with your technologies, process and projects.

Performing a network security vulnerability assessment with Nmap

Nmap is a handy addition to the value-added reseller (VAR) and consultants' vulnerability assessment toolbox. This tip explains how to perform a network security vulnerability assesment using Nmap's SYN Scan.

Nmap is an important network security vulnerability assessment tool for value-added resellers (VARs) and consultants. This tip explains how to use Nmap to scan open ports with a SYN Scan.

How to scan ports and services with Nmap
Nmap is the ideal tool for performing a simple network inventory or vulnerability assessment. By default, Nmap performs a SYN Scan, which works against any compliant TCP stack, rather than depending on idiosyncrasies of specific platforms. It can be used to quickly scan thousands of ports, and it allows clear, reliable differentiation between ports in open, closed and filtered states.

Once you discover a machine's visible ports, you need to know which services are running on them in order to inventory them or determine to which exploits the machine is vulnerable. The –sV option enables version detection interrogation, but a better option is –A which enables both OS detection and version detection. The following uses the nmap-service-probes database to try and determine the service protocol, the application name, the version number, hostname, device type, the OS family, and other miscellaneous details like the SSH protocol version or whether an X server is open to connections:

nmap –A

If Nmap is compiled with OpenSSL support, it can even connect to an SSL server to deduce the service listening behind that encryption layer. Another advantage of running version detection is that Nmap will try to get a response from TCP and UDP ports that a simple port scan can't determine are open or filtered, and Nmap will change the state to open if it succeeds.

Read more on how to conduct a network security vulnerability assessment with Nmap.



About the author
Michael Cobb, CISSP-ISSAP is the founder and managing director of Cobweb Applications Ltd., a consultancy that offers IT training and support in data security and analysis. He co-authored the book
IIS Security and has written numerous technical articles for leading IT publications. Mike is the guest instructor for SearchSecurity's Web Security School and, as a site expert, answers user questions on application and platform security.

This tip originally appeared on


Dig Deeper on Managed network security services