Nmap basics: host discovery and port scanning

Host discovery

Which hosts are alive on the lab network, without scanning ports right away.

bash

# Ping sweep without a port scan
nmap -sn 10.10.10.0/24

bash

# Top 1000 ports + service/version info
nmap -sV 10.10.10.20

# All 65535 ports — slower, but misses nothing
nmap -p- -sV 10.10.10.20

[ TIP ]

Always start with the top-1000 scan for speed, and only run a full -p- scan when you have time or when the top 1000 turns up nothing relevant.

bash

nmap -sV -sC 10.10.10.20

-sC runs the "safe" NSE scripts: handy for banner info, but no exploitation.

Add here which services you found on Metasploitable and what your next step was (e.g. searching for exploits per service).