Is port scanning illegal?

The law varies and is often unclear, but scanning systems without permission can violate computer misuse laws and acceptable-use terms. Scan only what you own or are authorized to test.

Why does Nmap show a port as filtered?

Filtered means Nmap could not tell whether the port is open because something, usually a firewall, dropped or blocked the probes. It is not the same as closed.

Network Reconnaissance and Scanning with Nmap in Your Lab

Introduction

Nmap is the standard open-source network scanner. Defenders use it to inventory what is exposed and testers use it to map targets. Knowing what your own systems expose is the first step to reducing it. Run these commands only against your lab or systems you own or are authorized to test.

Prerequisites

The home lab lesson
Basic TCP/IP knowledge: IP addresses, ports, TCP and UDP

Step-by-Step Guide

Step 1: Confirm your authorization and target range

Before running any scan, confirm the address range is your lab. Scanning other people's networks without permission may be illegal. The examples use the host-only range 192.168.56.0/24, and you should replace it with your own lab range.

Step 2: Discover which hosts are alive

A ping scan lists live hosts without scanning their ports. On a local network, Nmap uses ARP requests, which are reliable. This is how you build an asset inventory of a network segment.

nmap -sn 192.168.56.0/24

Step 3: Scan ports and identify services

By default Nmap scans the 1000 most common TCP ports. The -p- option scans all 65535 ports, which is slower. The -sV option probes open ports to identify the service and version, which tells you what software is exposed and whether it is outdated. Save results in all formats with -oA so you can compare scans over time.

nmap 192.168.56.101
nmap -p- 192.168.56.101
nmap -sV -p 22,80,443 192.168.56.101
nmap -sV -oA lab-scan-1 192.168.56.101

Step 4: Use default scripts carefully

The Nmap Scripting Engine adds checks for many protocols. The -sC option runs a default set of scripts that are considered safe, such as grabbing banners and listing certificate details. Other script categories, such as intrusive or brute-force scripts, can disrupt services or generate noise, so read what a script does before running it, and use them only on authorized targets.

nmap -sC -sV 192.168.56.101

Step 5: Understand scan types and their trade-offs

The default scan for non-privileged users is a TCP connect scan, while privileged users get a SYN scan, which is faster and does not complete connections. UDP scanning with -sU is much slower because open ports often give no reply. Timing templates from -T0 to -T5 trade speed against reliability and noise, and aggressive timing can overwhelm fragile devices. Any scan is visible in logs, which is exactly what your defensive tools should detect.

sudo nmap -sS 192.168.56.101       # SYN scan (needs privileges)
sudo nmap -sU --top-ports 20 192.168.56.101
nmap -T3 192.168.56.101            # the default timing

Step 6: Turn results into defensive action

For each open port, ask: is this service needed, is it the right version, and who should be able to reach it? Close unneeded services, restrict exposure with a firewall, and patch what remains. Re-scan after changes with the same options and compare the saved output. Finally, check your Wazuh or firewall logs in the lab: you should see traces of your own scan, which is the foundation of detection work.

FAQs

Is port scanning illegal?: The law varies and is often unclear, but scanning systems without permission can violate computer misuse laws and acceptable-use terms. Scan only what you own or are authorized to test.
Why does Nmap show a port as filtered?: Filtered means Nmap could not tell whether the port is open because something, usually a firewall, dropped or blocked the probes. It is not the same as closed.

Summary

Use nmap -sn for host discovery, port scans with -sV for service identification, default scripts with care, save output with -oA, and turn the results into closed ports, patches, and firewall rules. Scan only authorized targets.