When I started studying penetration testing, I spent a lot of time learning Nmap commands.

But knowing how to run a scan and understanding its results are two different things.

One of the most important distinctions is how Nmap classifies ports.

Open, closed, and filtered

Let’s take a simple TCP Connect scan:

nmap -sT -p 22,80,443 127.0.0.1

This scans three TCP ports on your own computer.

Depending on which services are running, Nmap might return something like:

PORT STATE SERVICE
22/tcp open ssh
80/tcp closed http
443/tcp filtered https

This is an illustrative output, not the result of an actual scan.

Here’s what those states mean:

Open: A service is accepting connections on that port. This doesn’t automatically mean the service is vulnerable.

Closed: The port is reachable, but no application appears to be listening on it.

Filtered: Nmap cannot determine whether the port is open because filtering or another network condition prevents it from getting a conclusive response.

Nmap also reports states such as open|filtered, particularly when a scan cannot distinguish between an open port and a filtered one.

A port number doesn’t confirm the service

Port 22 is commonly associated with SSH, and port 80 with HTTP.

However, seeing http in Nmap’s SERVICE column doesn’t necessarily mean Nmap has verified that an HTTP server is running.

Without service detection, that label may simply come from Nmap’s port-to-service database.

To investigate further, we can use:

nmap -sT -sV -p 22,80,443 127.0.0.1

The -sV option attempts to identify running services and, when possible, their versions.

Even then, the results should be interpreted carefully rather than treated as definitive proof.

Host discovery is another separate step

These two commands are also worth distinguishing:

nmap -sn 192.168.56.0/24

This performs host discovery without a normal port scan.

nmap -Pn -sT -p 80 127.0.0.1

Here, -Pn skips normal host discovery and tells Nmap to treat the specified target as online for the scan.

It doesn’t magically bypass a firewall.

Understanding these differences matters more than memorizing dozens of flags.

Only scan systems and networks you own or have explicit permission to test.

Why I’m documenting this

I’ve been building Cybersecurity Survival Notes, a public GitHub repository where I organize what I’m studying, including Linux, Networking, Nmap, and cybersecurity fundamentals.

The goal is to have a technical reference I can return to during labs, with commands and explanations in one place.

I’ve also made the notes available as a website to make them easier to navigate.

Documentation: https://radz-04.github.io/Cybersecurity-survival-notes/

GitHub: https://github.com/Radz-04/Cybersecurity-survival-notes

The project is still growing, and I’m continuing to review and improve the material as I study.

If you find something inaccurate or have suggestions, feedback is always welcome.