TryHackMe: Nmap Basic Port Scans

Room: https://tryhackme.com/room/nmap02

Executive Summary

Nmap is one of the most widely used network scanning tools in penetration testing and defensive security. It enables security professionals to discover live hosts, identify open ports, determine running services, and understand how systems communicate over the network.

In this room, we explored the fundamentals of TCP and UDP ports, learned how TCP flags are used during communication, performed TCP Connect, TCP SYN, and UDP scans, and examined how scan performance can be adjusted using various Nmap options. These concepts provide the foundation for effective network enumeration during security assessments.

Task 2: TCP and UDP Ports

Before performing any scan, it is important to understand the difference between TCP and UDP services and the common ports they use.

Question 1

Which service uses UDP port 53 by default?

Answer: DNS

Explanation

Port 53 is the standard port used by the Domain Name System (DNS).

DNS is responsible for translating domain names such as:

tryhackme.com

into their corresponding IP addresses.

DNS commonly uses:

• UDP 53 for standard queries
• TCP 53 for larger responses such as zone transfers.

Question 2

Which service uses TCP port 22 by default?

Answer: SSH

Explanation

Port 22/TCP is reserved for the Secure Shell (SSH) protocol.

SSH provides encrypted remote administration and secure file transfers between systems.

Question 3

How many port states does Nmap consider?

Answer: 6

Explanation

Nmap classifies ports into six possible states:

• Open
• Closed
• Filtered
• Unfiltered
• Open|Filtered
• Closed|Filtered

These states help analysts determine how a target system responds to network probes.

Question 4

Which port state is the most interesting to discover as a pentester?

Answer: Open

Explanation

An Open port indicates that a service is actively listening for connections.

Open ports are valuable because they provide possible entry points for:

• Enumeration
• Service fingerprinting
• Vulnerability assessment
• Exploitation

Task 3: TCP Flags

TCP communication relies on flags that control how connections are established, maintained, and terminated.

Question 1

What three letters represent the Reset flag?

Answer: RST

Explanation

The RST (Reset) flag immediately terminates an existing TCP connection or rejects an unexpected packet.

It is commonly seen when scanning closed ports.

Question 2

Which flag needs to be set when initiating a TCP connection?

Answer: SYN

Explanation

The TCP three-way handshake begins with the SYN flag.

The connection sequence is:

Client → SYN
Server → SYN-ACK
Client → ACK

This process establishes a reliable TCP connection.

Task 4: TCP Connect Scan

A TCP Connect Scan (-sT) completes the entire TCP three-way handshake with each target port.

Because it establishes full connections, it is highly reliable but easier to detect than stealthier scans.

Question 1

What is the state of the FTP service running on port 21?

Answer: Open

Explanation

The scan identified that port 21 was accepting TCP connections, indicating that the FTP service was actively running.

Question 2

What is Nmap’s guess about the service running on port 53?

Answer: Domain

Explanation

Nmap associates TCP port 53 with the domain service, which represents DNS.

The service name shown by Nmap is:

domain

Task 5: TCP SYN Scan

A TCP SYN Scan (-sS) is commonly known as a half-open scan.

Instead of completing the TCP handshake, Nmap sends a SYN packet and observes the response.

Get Sudoroot’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

If the target replies with:

• SYN-ACK → Port is open.
• RST → Port is closed.

Because the handshake is never completed, SYN scans are faster and generally stealthier than TCP Connect scans.

Scan Performed

nmap -sS 10.10.105.229

Output:

PORT   STATE SERVICE
21/tcp open  ftp
22/tcp open  ssh
53/tcp open  domain
80/tcp open  http

Question 1

After launching a TCP SYN scan, how many SYN-ACK packets are successfully received?

Answer: 4

Explanation

Each open port responds with a SYN-ACK packet.

The scan discovered four open ports:

• 21
• 22
• 53
• 80

Therefore, four SYN-ACK responses were received.

Question 2

How many ports are open on the target machine?

Answer: 4

Explanation

The Nmap output reported the following open ports:

• FTP (21)
• SSH (22)
• DNS (53)
• HTTP (80)

This confirms that 4 ports were open.

Task 6: UDP Scan

Unlike TCP, UDP is connectionless and does not perform a handshake.

This makes UDP scanning slower and often less reliable because many services simply ignore incoming packets instead of replying.

Scan Performed

nmap -sU --top-ports 10 10.49.186.13

Output:

53/udp   open    domain
67/udp   closed  dhcps
123/udp  closed  ntp
135/udp  closed  msrpc
137/udp  closed  netbios-ns
138/udp  closed  netbios-dgm
161/udp  closed  snmp
445/udp  closed  microsoft-ds
631/udp  closed  ipp
1434/udp closed  ms-sql-m

Question 1

What is the state of UDP port 161?

Answer: Closed

Explanation

From the scan output:

161/udp closed snmp

Nmap determined that the SNMP service was not listening on port 161.

Question 2

What is the service name on port 161?

Answer: SNMP

Explanation

Nmap maps UDP port 161 to the Simple Network Management Protocol (SNMP).

Although the service was closed, Nmap still identifies the well-known service associated with that port.

Task 7: Fine-Tuning Scope and Performance

Nmap provides many options that allow analysts to control which ports are scanned and how aggressively the scan is performed.

Question 1

What option scans TCP ports between 5000 and 5500?

Answer:

-p5000-5500

Explanation

The -p option specifies which ports to scan.

Example:

nmap -p5000-5500 target-ip

Only ports between 5000 and 5500 will be scanned.

Question 2

How can you ensure that Nmap runs at least 64 probes in parallel?

Answer:

--min-parallelism=64

Explanation

This option sets the minimum number of probes that Nmap sends simultaneously, increasing scan speed on networks that can handle higher levels of parallelism.

Question 3

What option makes Nmap very slow and paranoid?

Answer:

-T0

Explanation

Nmap timing templates range from T0 to T5:

• T0 — Paranoid
• T1 — Sneaky
• T2 — Polite
• T3 — Normal
• T4 — Aggressive
• T5 — Insane

Using:

-T0

causes Nmap to scan extremely slowly in an attempt to avoid detection by intrusion detection systems (IDS) and firewalls.

Conclusion

This room introduced the core concepts of Nmap port scanning by covering TCP and UDP communication, TCP flags, and several scanning techniques used during network reconnaissance. We learned the differences between TCP Connect and TCP SYN scans, explored how UDP services are identified, and interpreted Nmap scan results to determine open ports and running services. Finally, we examined how scan scope and performance can be adjusted using options such as port ranges, parallelism settings, and timing templates. These foundational skills are essential for efficient enumeration and serve as the basis for more advanced service detection, vulnerability assessment, and penetration testing activities.