Scenarios

Scenarios I ran into during hands-on labs, the commands that solved them, and why they worked.

Finding the One Open TCP Port

The goal was to identify the one open TCP port on the target host. I started with a TCP connect scan:

nmap -sT TARGET_IP

The initial scan returned:

Host is up (0.0067s latency).
All 1000 scanned ports on TARGET_IP are in ignored states.
Not shown: 1000 closed tcp ports (conn-refused)

I then scanned the complete TCP port range using the fastest timing template:

nmap -p- -T5 TARGET_IP
  • Why this worked: By default, Nmap scans only the 1000 most common TCP ports. The open port was outside that default set, so the first scan missed it.
  • -p- tells Nmap to scan all 65,535 TCP ports (1-65535), not just the default top 1000.
  • -T5 uses the fastest timing template (insane), which speeds up probe timing and reduces scan time in lab environments. It is noisy and can be unreliable on congested or production networks.

Command Reference

Flag-by-flag lookup lists for both tools.

Nmap

Network scanning tool for host discovery, port scanning, service detection, and OS detection.

Target Specification

  • IP range using -: nmap 192.168.0.1-10 scans from 192.168.0.1 to 192.168.0.10
  • IP subnet using /: nmap 192.168.0.1/24 scans the entire subnet
  • Hostname: Specify target by hostname (e.g., nmap example.thm)

Host Discovery

  • nmap -sL TARGET — List scan: lists targets without scanning
  • nmap -sn TARGET — Ping scan: host discovery only, no port scanning
  • nmap -Pn TARGET — Treat all hosts as online, scan hosts that appear to be down

Port Scanning

  • nmap -sT TARGET — TCP connect scan: completes three-way handshake
  • nmap -sS TARGET — TCP SYN scan: only first step of handshake (stealthier)
  • nmap -sU TARGET — UDP scan: discovers UDP services
  • nmap -F TARGET — Fast mode: scans 100 most common ports (instead of default 1000)
  • nmap -p[range] TARGET — Specify port range (e.g., nmap -p10-1024 TARGET, nmap -p- TARGET scans all ports)

Service & OS Detection

  • nmap -O TARGET — OS detection: makes educated guess about target OS
  • nmap -sV TARGET — Service version detection: identifies service versions
  • nmap -A TARGET — Aggressive: enables OS detection, version scanning, and traceroute

Timing & Performance

  • nmap -T<0-5> TARGET — Timing templates: paranoid (0), sneaky (1), polite (2), normal (3), aggressive (4), insane (5)
  • nmap --min-parallelism <numprobes> --max-parallelism <numprobes> TARGET — Control parallel probes
  • nmap --min-rate <number> --max-rate <number> TARGET — Control packet rate (packets/second)
  • nmap --host-timeout <time> TARGET — Maximum time to wait for a target host

Output Formats

  • nmap -oN <filename> TARGET — Normal output (human-friendly)
  • nmap -oX <filename> TARGET — XML output
  • nmap -oG <filename> TARGET — Grep-able output (useful for grep and awk)
  • nmap -oA <basename> TARGET — Output in all major formats

Common Practical Examples

  • nmap -sn 192.168.1.0/24 — Discover live hosts on a subnet
  • nmap -sV -p 22,80,443 TARGET — Detect service versions on selected ports
  • nmap -sS -Pn TARGET — SYN scan even if ICMP/ping is blocked
  • nmap -A -T4 TARGET — Fast, detailed scan for lab use (noisy; avoid on production without approval)

tcpdump

Network packet capture and analysis tool for monitoring network traffic.

Basic Commands

  • tcpdump -i INTERFACE — Captures packets on a specific network interface
  • tcpdump -i any — Listen on all available interfaces
  • tcpdump -w FILE — Writes captured packets to a file
  • tcpdump -r FILE — Reads captured packets from a file
  • tcpdump -c COUNT — Captures a specific number of packets
  • tcpdump -n — Don't resolve IP addresses
  • tcpdump -nn — Don't resolve IP addresses and protocol numbers
  • tcpdump -v — Verbose display (can be increased with -vv and -vvv)

Examples

  • tcpdump -i eth0 -c 50 -v — Captures and displays 50 packets by listening on the eth0 interface, which is a wired Ethernet, and displays them verbosely.
  • tcpdump -i wlo1 -w data.pcap — Captures packets by listening on the wlo1 interface (the WiFi interface) and writes the packets to data.pcap. It will continue till the user interrupts the capture by pressing CTRL-C.
  • tcpdump -i any -nn — Captures packets on all interfaces and displays them on screen without domain name or protocol resolution.

Filtering Expressions

  • tcpdump host IP — Filters packets by IP address or hostname
  • tcpdump src host IP — Filters packets by source host
  • tcpdump dst host IP — Filters packets by destination host
  • tcpdump port PORT_NUMBER — Filters packets by port number
  • tcpdump src port PORT_NUMBER — Filters by source port
  • tcpdump dst port PORT_NUMBER — Filters by destination port
  • tcpdump PROTOCOL — Filters by protocol (ip, ip6, icmp, etc.)

Filtering Examples

  • tcpdump -i any tcp port 22 — Listens on all interfaces and captures TCP packets to or from port 22, i.e., SSH traffic.
  • tcpdump -i wlo1 udp port 123 — Listens on the WiFi network card and only show packets that use the UDP protocol and the port is 123, the Network Time Protocol (NTP).
  • tcpdump -i eth0 host example.com and tcp port 443 -w https.pcap — Will listen on eth0, the wired Ethernet interface and filter traffic exchanged with example.com that uses TCP and port 443. In other words, this command is filtering HTTPS traffic related to example.com.

Logical Operators

  • and — Captures packets matching both conditions (e.g., tcpdump host 1.1.1.1 and tcp)
  • or — Captures packets meeting either condition (e.g., tcpdump udp or icmp)
  • not — Captures all packets except those matching the condition (e.g., tcpdump not tcp)

Advanced Filtering

  • greater LENGTH — Filters packets with length greater than or equal to specified length
  • less LENGTH — Filters packets with length less than or equal to specified length
  • tcp[tcpflags] == tcp-syn — Capture TCP packets with only SYN flag set
  • tcp[tcpflags] & tcp-syn != 0 — Capture TCP packets with at least SYN flag set

TCP Flag Filtering Examples

  • tcpdump "tcp[tcpflags] == tcp-syn" — Captures TCP packets with only the SYN (Synchronize) flag set, while all the other flags are unset.
  • tcpdump "tcp[tcpflags] & tcp-syn != 0" — Captures TCP packets with at least the SYN (Synchronize) flag set.
  • tcpdump "tcp[tcpflags] & (tcp-syn|tcp-ack) != 0" — Captures TCP packets with at least the SYN (Synchronize) or ACK (Acknowledge) flags set.

Display Options

  • tcpdump -q — Quick and quiet: brief packet information
  • tcpdump -e — Include MAC addresses
  • tcpdump -A — Print packets as ASCII encoding
  • tcpdump -xx — Display packets in hexadecimal format
  • tcpdump -X — Show packets in both hexadecimal and ASCII formats