> For the complete documentation index, see [llms.txt](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/zyberlab/06-network-security-basics/basic-nmap-scanning.md).

# Basic Nmap Scanning

This lab introduces a simple Nmap scan inside the ZyberLab network.

Use this exercise only with systems that belong to your own lab.

## Objective

Use `KALI01` to discover which TCP ports are reachable on `CLIENT01` and compare the results with what you already observed locally on Windows.

## Confirm the Target

On `CLIENT01`, run:

```
ipconfig
```

Record the current IPv4 address.

## Run a Basic Scan

On `KALI01`, open a terminal and run:

```
nmap <CLIENT01-IP>
```

Replace `<CLIENT01-IP>` with the actual lab address.

Nmap will report the state of commonly checked TCP ports.

You may see results such as:

```
open
closed
filtered
```

An open port means a service accepted the connection attempt.

A closed port means the system was reachable but no service accepted the connection on that port.

A filtered result often means a firewall or another network control prevented Nmap from determining the port state clearly.

## Compare with CLIENT01

On `CLIENT01`, run:

```
netstat -ano
```

Compare listening ports with the Nmap output.

Not every locally listening port will necessarily appear as open from another system. Firewall rules and interface bindings can change what is reachable remotely.

## Optional Service Information

For a small lab target, you can request basic service identification:

```
nmap -sV <CLIENT01-IP>
```

Use the result as an observation, not as absolute proof. Service identification is based on how the target responds.

## Verification

The lab is complete when you can explain:

* The target IP address
* Which ports were reported as reachable
* Why Nmap and `netstat` may show different views
* How Windows Firewall can affect the result

## Security Relevance

Service discovery helps identify the network exposure of a system. Defenders use the same type of visibility to confirm that only expected services are reachable and to investigate unexpected changes in exposed ports.