Scanning with nmap: SYN, versions, evasion

Reconnaissance establishes what is reachable and what runs. nmap is the standard tool.

The main types

SYN scan (-sS): sends SYN, if SYN/ACK returns the port is open, then RST without completing the handshake. Semi-stealthy, fast.

Version/OS (-sV -O): probes services to identify software and version — the real attack surface.

Scripts (-sC, NSE): automated checks for known vulnerabilities.

nmap -sS -sV -p- -T4 --open target
nmap -sU --top-ports 50 target   # UDP, slow but reveals DNS/SNMP

Evasion and defence

Slow timing (-T1), fragmentation, decoys (-D) evade naive IDS. On defence: IDS/IPS, rate limiting, and above all reducing the surface — closing unnecessary ports beats hiding the scan.