What Nmap Answers

What is it?

Nmap is a network scanner: you give it targets and it reports which hosts are reachable and which network services they expose. It answers 'what is out there and what is listening?'

Why it matters

You cannot defend or investigate what you cannot see. An accurate map of live hosts and exposed services is the starting point of hardening, vulnerability triage and intrusion analysis.

Where you see it

An admin auditing a subnet before a change; an analyst confirming what a suspicious host exposes; a responder mapping a compromised segment.

What normal looks like

A scan of a known subnet returns the hosts and services you expect: the web server on 80/443, the DB on its internal port, nothing surprising.

What suspicious looks like

A host exposing a service it should not (a database open to the network, an unexpected remote-admin port) — the gap between what you found and your baseline.

How analysts investigate

State the question ('what does this host expose?'), scan only in-scope targets, compare the result to a known baseline, and treat any surprise as a lead.

Common beginner mistakes

Scanning targets you are not authorized to scan — always stay in scope.
Treating the scan as the answer instead of comparing it to a baseline.

A map before a decision

  question: what does 10.20.4.0/24 expose?
     nmap  →  live hosts  →  open ports  →  services
  10.20.4.10  80/tcp http   443/tcp https      (expected: web server)
  10.20.4.55  3306/tcp mysql                    (SURPRISE: DB open to the subnet)
  compare against the baseline; the surprise is the finding

Nmap turns a network question into a map of hosts and exposed services to compare against a baseline.

Quick check

What is the FIRST thing to do with a scan result?

A quick self-check — it doesn't affect your XP or progress.