TechKnowSurge
EC-Council CEH 2.2 CompTIA Security+ 2.4 NIST NICE K0788 NIST NICE K0938 CompTIA PenTest+ 2.4 NIST NICE K0940 NIST NICE S0543
TechKnowSurge Catalog Videos DEMO: Network Scanning with Nmap
VideoSecurityFree

DEMO: Network Scanning with Nmap

Network scanning is a technique used by attackers to discover active devices, open ports, and running services across a network. This content covers the fundamentals of IP scanning using Nmap and Zenmap, demonstrated through a live ping scan against a /24 network.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Network scanning is one of the first actions an attacker takes after gaining a foothold on a network, using tools like Nmap to systematically probe a subnet for live hosts, open ports, and active services. ICMP-based ping scans are a common starting point — the same protocol used by administrators for routine troubleshooting can be turned into a broad reconnaissance sweep that maps every reachable device across an entire address block. A scan of a standard /24 network covering 256 addresses typically completes in about a minute, making it a fast and low-effort method for building a target inventory. The data returned from even a basic ping scan goes beyond simple host discovery. Nmap can resolve MAC addresses and cross-reference them against manufacturer databases, allowing an attacker to identify the likely function of each device — distinguishing Cisco routers and switches from Raspberry Pi nodes, virtualization hosts like Proxmox, or other infrastructure. This level of detail shapes how an adversary prioritizes follow-on activity, targeting high-value systems or those most likely to yield further access. For defenders, understanding the attacker's reconnaissance workflow is critical to detecting scanning activity early and reducing the information available to unauthorized parties.

What you'll learn

What's covered

Network Scanning with Nmap

Aligned to

EC-Council CEH
2.2 Scanning Networks
CompTIA Security+
2.4 Given a scenario, analyze indicators of malicious activity.
NIST NICE
K0788 Knowledge of adversarial tactics principles and practices
K0938 Knowledge of network mapping principles and practices
K0940 Knowledge of subnet tools and techniques
S0543 Skill in scanning for vulnerabilities
CompTIA PenTest+
2.4 Given a scenario, use the appropriate tools for reconnaissance and enumeration.

Key terms

Internet Control Message Protocol
ICMP
A network layer protocol used to send error messages and operational information about network conditions.
IP Address
A numerical label assigned to each device connected to a network that uses the Internet Protocol.
Media Access Control
MAC
A sublayer of the Data Link layer that controls how devices on a network gain access to a medium and transmit data.
Subnet
A logical subdivision of an IP network, used to organize and segment network traffic.
Port Scanning
A technique used to discover open ports and services available on a networked device.
Ping Sweep
A network scanning technique that sends ICMP echo requests to a range of IP addresses to identify which hosts are active on a network.
Network Mapper
Nmap
Network Mapper is an open-source security scanner used for network discovery, port scanning, service detection, and OS fingerprinting to assess the attack surface of networked systems.

Topics

Network Scanning Nmap Ping Sweep Host Enumeration Reconnaissance Networking

Transcript

What Network Scanning Is

If an adversary is sitting on the network, they can start scanning the rest of the network. They can start scanning for active IP addresses and devices on the network. They can scan those ports that are on the network. They can scan for any kind of services. So they can scan this network for certain things.

We're going to take a look at IP scans. What we can do is we can do an ICMP. ICMP is used for troubleshooting, so think of ping. We can ping another device on the network, and it's really handy for us as system administrators and security professionals to really troubleshoot our network and see what's going on on it. However, the adversary can use this as well. They can do an IP scan, and in fact they can use the IP scan and scan a whole block of IP address to see what's live on the network.

This is for ethical hacking purposes only. Make sure you only do this on a network that either you own or have gotten permission to carry out these techniques. I'm on a demo machine here, which is on a demo network, so I'm not going to get into any kind of legal issues by scanning this network.

Nmap and Zenmap

I'm going to be using Nmap, or Network Mapper. Network Mapper is a program that helps me scan blocks of IP addresses and ports to see what's available. I'm actually going to use this front end here, which is Zenmap. So on the back end, it's just using Nmap. You can see the actual Nmap code, but I'm going to use Zenmap to actually enter this code and display the results of it.

What I'm going to do is I'm going to open up a command prompt here and I am going to type in ipconfig. The reason why I'm doing that is, first of all, I can just find out some good information with this. I can find out what LAN this is on, which is Andy. And I can see the IP address, so it's on 10.110.194, which also gives me a hint with that. And the mask tells me exactly what network this is on, so it's on the 10.110/24 network.

So I am going to type in here as the target 10.110.0/24, because that's the network address there. And I don't want to do an intense scan. What I'm going to do is I'm going to do a ping scan here and hit scan on this and let it go. So there it's executed the command and it's starting this through Nmap, and I can see the scans that are active here. So this scan is active, and I'm going to wait until it is done.

Reading the Results

It finished up. It took about a minute to scan this whole network of 256 addresses. On the left-hand side, it found quite a few devices here: 10.110.15.1123vuh 21 194 196 and 197. And I can scroll through these different ones over here on the left-hand side. It's showing me the results right here.

This is the report for 10.1.10.1. It says the host is up, it gives me the latency of that host, and it actually gives me a MAC address. Not only has it given me this MAC address, but it's looked up this first part of who is the manufacturer and gives me that it's Cisco Systems. So Cisco Systems here, that's probably a switch there or a router. And then the 10.5 is another Cisco system there. The 10.11, 12, and 13 are all Cisco. We've got the 10.21, which is a Raspberry Pi. And then we have Proxmox that's running, so we've got 197 and 194. Both those are Proxmox, which is a virtualization server. So you can see that it found a lot of great information about this network, the different devices that are on the network, from this scan.

So here's the attack card for network scanning: we're scanning the rest of the network for any kind of active devices, services, and potential vulnerabilities.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →