Nmap (Network Mapper) is a free and open-source network scanner tool that is used to discover hosts and services on a computer network, and to perform security scans and find vulnerabilities.
Nmap works by sending a series of packets to the target host or network and examining the responses. It can determine the operating system and version of the host, the type and version of the services running on the host, and the presence of any firewall or other security measures.
Nmap uses a variety of techniques to scan a network, including:
- TCP SYN scan: A type of scan that sends a SYN packet (a request to initiate a connection) to a target port and waits for a response. If the target port is open, it will respond with a SYN/ACK packet (acknowledgment of the request to initiate a connection). If the target port is closed, it will respond with a RST (reset) packet.
- TCP connect scan: A type of scan that establishes a full TCP connection to the target port and then closes it. This is the most accurate type of scan, but it is also the slowest and most easily detected.
- UDP scan: A type of scan that sends a UDP packet to a target port and waits for a response. If the target port is open, it may send a response. If the target port is closed, it will not send a response.
- ICMP echo request: A type of scan that sends an ICMP echo request (commonly known as a "ping") to the target host and waits for a response. This can be used to determine if the host is up and responding to network traffic.
Nmap can be run from the command line or through a graphical user interface. It can be used for a variety of purposes, including network mapping, security auditing, and vulnerability testing.
