nmap scan types decoded, stealth versus speed versus depth

hook

every "hacker" movie montage has someone typing nmap and suddenly owning a network. what's actually happening is way less dramatic and way more useful to you as a defender: nmap is just asking your own systems a bunch of questions about which doors are open, what's answering, and how loud you want to be while asking. if you've never scanned your own network, you're basically leaving your front door open and hoping nobody checks the handle.

the core idea: every scan type is a tradeoff

nmap doesn't have one "scan mode," it has a handful, and each one trades off stealth, speed, and depth against each other. as a defender, understanding these tradeoffs matters because it tells you what an attacker's scan traffic actually looks like on your network, which helps you spot it in logs.

-sS, the syn scan

nmap -sS 192.168.1.0/24

this is nmap's default and it's called a "half-open" scan. normally a tcp connection is a three-way handshake: syn, syn-ack, ack. this scan sends the syn, gets the syn-ack back if the port's open, then just... never sends the final ack. the connection never fully completes, so a lot of basic logging on the target never registers a full session.

why does that matter to you? because if your firewall or ids only logs completed connections, syn scans against your own network can slide right past you. this is exactly why you should test your own detection setup with a syn scan and confirm your ids actually flags half-open handshakes, not just full ones. also note it needs root or admin privileges, since crafting raw packets isn't something a regular user process can do.

-sT, the connect scan

nmap -sT 192.168.1.0/24

this one completes the full handshake using your os's normal networking stack instead of raw packets. it's louder and slower, but it doesn't need elevated privileges. from a defense standpoint, this is the scan type most likely to show up clean in your logs since it looks like a real, if extremely short, connection. if you're auditing your own exposed services from a locked-down machine without root, this is your option.

-sU, the udp scan

nmap -sU 192.168.1.0/24

udp is connectionless, so there's no handshake to abuse, which is exactly why this scan is slow and annoying. nmap sends a packet and just waits to see if anything comes back or if it gets an icmp "unreachable" response. this is the scan type people skip because it takes forever, and that's precisely why it's worth running against your own hosts. dns, snmp, ntp, and a pile of other services that get forgotten live on udp, and forgotten services are exactly the kind of thing that ends up misconfigured with default credentials or exposed to the wrong subnet.

-sV, -O, and -sC: going deeper

nmap -sV -O -sC 192.168.1.10

-sV grabs service and version banners so you know if you're running an ancient version of ssh or an ftp server nobody patched since 2019. -O tries to fingerprint the operating system based on how the tcp/ip stack responds to odd probes. -sC runs nmap's default script set, which checks for common misconfigurations, weak ssl setups, exposed shares, and other low-hanging fruit. run these against your own boxes and you'll usually find something you forgot you had running.

the takeaway

match the scan to the goal, but flip that goal to defense. use -sT to see what your network looks like from a normal, no-privilege connection. use -sS to test whether your monitoring catches half-open handshakes. use -sU to find the forgotten udp services nobody's watching. use -sV -O -sC to find outdated software and default configs before someone else does. run these against your own ip ranges only, on a schedule, and compare results over time. the goal isn't to feel clever running a scan, it's to close the ports and patch the versions that show up before anyone else gets curious.