What happens when I use "nmap google.com" command? [closed]

Question

Hi I have used ping command to check a host, I came to know that nmap can also be used. what this command is actually used for? what it does in background? Can anyone please explain.

Answer 1

This tool should be accessible only to trusted users and should be used only by competent staff, for maintenance and security testing.

The nMap security scanner sends a combination of packets (not only ICMP pings) to discover, identify, fingerprint and deeply analyze any remote host. It discovers open/firewalled/redirected ports, identifies the type of system and (eventual) IDS, gives a unique fingerprint to track the host and shows the type of remote services, all with fallback automation. The scanner can also do script scanning to create reports of possible vulnerabilities and can also exploit remote vulnerabilities, specially if executed with root privileges (raw socket support).

Scanning a remote host without permission is illegal, because an uncontrolled scan can trigger remote server daemons (like knockd), IDS events and even cause a Denial of Service.

Before starting nmap read the man page and the online reference; use only your hosts as a target if you are learning and remember that it can rapidly saturate the bandwidth, so execute it only on private networks.

---

If my answer is useful, please mark it as accepted and click on the left up arrow. If you have more related questions, feel free to comment under here.

Have a nice day!

Answer 2

NMAP is a security scanner used to discover hosts and services on a computer network which features host discovery, port scanning, version, OS identification and detection.

Why is it used?

Especially for auditing the security of a specific device or the entire network, by scanning ports, finding possible vulnerabilities, network mapping.

The reports created by the program can be stored in valid XML format, so it can be processed conveniently later.

What does it do?

"Nmap (“Network Mapper”) is an open source tool for network exploration and security auditing. It was designed to rapidly scan large networks, although it works fine against single hosts. Nmap uses raw IP packets in novel ways to determine what hosts are available on the network, what services (application name and version) those hosts are offering, what operating systems (and OS versions) they are running, what type of packet filters/firewalls are in use, and dozens of other characteristics. While Nmap is commonly used for security audits, many systems and network administrators find it useful for routine tasks such as network inventory, managing service upgrade schedules, and monitoring host or service uptime."

Reference

How exactly?

Please refer to the NMAP source code for understanding.

Thanks