ok so i heard nmap is illegal in some countries, similar to going around and checking the door handle around the neighborhood to see if intrusion is possible.

if i use nmap like

 nmap -0 -sS 

am i scanning the entire network from my isp for everything in .1.1/24 range or am i just scanning within my gateway which is

i ran this but then stopped myself and ran a nmap -sS -O on my ip and it came up everything that was on my network

nmap -O -sS Means that you are scanning the network with a netmask of That is what the /24 at the end means, it is also called CIDR notation. That means that only the IPs from thru are scanned. Nothing outside of your network will be scanned at all.

I use the Online IP Subnet Calculator all the time to see what IP addresses belong to what range. Look at the Mask Bits and that is what the /24 at the end means.


Site with CIDR notation: http://www.subnet-calculator.com/cidr.php


First of all, you need to learn terminology to read nmap properly.

The is network ID. It refers to your local network, and every interface (this is also important - you can have multiple interfaces on same machine) that connects to that network will have address that start with 192.168.0.xxx.It's not scanning outside of your router, so you're not scanning your ISP (and I recommend that you avoid doing that).

Depending on the configuration of your router, network can contain different number of hosts. If you say /24 means you have 256 hosts on the network (this is because each IP address when converted to binary will be 32 bits in length, and we can vary last 8 bits, so those first 24 bits are not changing). When you perform scan like that, nmap also will confirm how many hosts it scanned:

OS detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 256 IP addresses (3 hosts up) scanned in 202.14 seconds

nmap doesn't actually know your network configuration. Use ip addr to find out which exact CIDR-style addressing to use. For example, I have:

$ ip -4 -o addr show                                                                                                     
1: lo    inet scope host lo\       valid_lft forever preferred_lft forever
3: wlan7    inet brd scope global dynamic wlan7\       valid_lft 63435sec preferred_lft 63435sec

Second, you have two examples there. Once ending with .0 and one ending with .1xx. As far as nmap is concerned , it's the same thing. From man nmap:

For example, would scan the 256 hosts between (binary: 11000000 10101000 00001010 00000000) and (binary: 11000000 10101000 00001010 11111111), inclusive. would scan exactly the same targets.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy