Nmap is a network scanning tool used for host discovery and security auditing. It identifies live hosts on a network using ARP, ICMP, and TCP/UDP probes, and can create an inventory of active systems across both IPv4 and IPv6 environments. The tool performs port scanning to discover exposed services and map the network-facing attack surface, utilizing various techniques including full connect, half-open SYN, FIN, and Xmas scans. Nmap can detect the operating system, services, and software versions running on target hosts by analyzing network responses and grabbing service banners. For advanced functionality, it includes the Nmap Scripting Engine (NSE) for extensible, script-based tasks such as vulnerability detection and deeper service interaction. To support security assessments, Nmap incorporates features for evading or testing firewalls and intrusion detection systems, such as decoy and idle/zombie scanning, packet fragmentation, source spoofing, and configurable timing controls. Scan results can be generated in multiple formats, including normal, XML, and grepable.
