Learning to listen with Nmap
Port scanning as a form of listening: what a network quietly reveals before you touch it.
Why I started
I wanted to understand what a port scan actually tells you — not just how to run one. Nmap is easy to invoke and surprisingly hard to read well. The interesting part was learning to treat the output as a map of decisions someone else made.
The setup
I built a small isolated lab with a handful of virtual machines on a host-only network: one Linux server, one deliberately misconfigured service, and a monitoring box. Keeping it isolated meant I could be curious without being careless.
What I tried
- A default
nmapscan, then the same range with service and version detection - SYN scans against filtered ports to see the difference between closed and filtered
- OS fingerprinting on machines I already knew, as a way to calibrate how much to trust it
- Capturing the same traffic in Wireshark to see the scan from the target's side
What stuck with me
A scan is not a verdict. A closed port can be a firewall decision, a service that only listens on localhost, or a host that simply isn't up. The context around the output matters more than the output itself.
The most useful question was not "what is open?" but "why would this be open?"
I also came away with a stronger appreciation for logging and rate limiting. From the target's side, a loud scan is very visible — which is exactly why defenders should be looking.