Lab 11 of 17 · By Michael Stout
In this lab
Use Copy beside a command to copy it exactly.
Scan and fingerprint a network with Nmap
Chapter 5 covers scanning, enumeration, and asset discovery as the foundation of both offense and defense — you can't secure what you don't know exists. Nmap has been the standard tool for this for over 25 years, and it's free.
Asset inventory starts with a scan
A network diagram tells you what's supposed to be there. A scan tells you what's actually there — including the forgotten test server, the rogue access point, and the printer nobody patched. Chapter 5's asset inventory work depends on being able to run this yourself. Nmap does host discovery, port scanning, service/version detection, and OS fingerprinting, all from one tool.
Scanning a network you don't own or have explicit written permission to test can violate policy and, in many places, the law — even a simple ping sweep. This lab uses scanme.nmap.org, the Nmap project's own public test target, plus your own home network, for exactly this reason.
What you'll need
Windows 7 or later, or Windows Server 2008 R2 or later.
Administrator rights — both the installer and several scan types (OS detection, SYN scans) need raw packet access.
Only scan scanme.nmap.org (explicitly authorized by the Nmap project) or a device on a network you personally own or administer.
20–30 minutes.
Get the scanner and its GUI
- Download it. Go to
nmap.org/download.htmland get the Windows self-installer, e.g.nmap-<version>-setup.exe. - Run the installer. Accept the defaults, including the bundled Npcap driver (required for most scan types) and Zenmap, Nmap's graphical front end.
- Verify it. Open PowerShell as administrator and run:
nmap -V
Discovery, ports, then OS
- Host discovery on your own LAN:Adjust the subnet to match your own network. This pings the whole range and lists what answered — no port scanning yet.
nmap -sn 192.168.1.0/24
- Service and version detection against the public test target:This identifies what's actually listening on each open port, not just that it's open.
nmap -sV scanme.nmap.org
- OS fingerprinting (needs the admin PowerShell session from Part 1):Nmap guesses the target's operating system from how its TCP/IP stack behaves — it's a best guess, not a certainty.
nmap -O scanme.nmap.org
- Open Zenmap and run the same scan through the GUI to see the same output rendered as a topology, if a visual view is easier to read.
You'll see masscan cited alongside Nmap for internet-scale scanning — it trades Nmap's depth for raw speed. It's Linux-native; Windows only has unofficial third-party builds, not something to trust for coursework. If you want to try it, do it inside WSL2 or a Kali VM, the same environment Chapter 2's virtualization lab set up.
Sources. Nmap Project, download page, nmap.org/download.html. Nmap Project, scanme.nmap.org usage terms. Reference for masscan: github.com/robertdavidgraham/masscan.