Cyber Security LabsLabsBeginner

Lab: inventory your own lab network with Nmap

By Mohamed Fayas 8 min readUpdated 8 October 2026

In short: Nmap is a free network scanner that tells you which devices are on a network and what they are running. In this lab you scan only your own isolated lab to build an asset inventory, save it, and compare later scans to catch unexpected changes.

Aim and what you need

The aim is to answer three defensive questions: what is on my network, what is each device exposing, and has anything changed? Defenders use Nmap for exactly this, because you cannot protect services you do not know about.

The isolated virtual lab on 10.10.10.0/24 with at least two target VMs.
Nmap, already included in Kali Linux, or installed on Linux, Windows or macOS.
Permission: scan only networks you own. Scanning other people's networks, including your employer's or school's, without written authorisation can break acceptable use policies and the law.

How the scan works

Figure 1. A defensive inventory moves from agreed scope to live hosts, open ports, service versions and saved results.

Host discovery sends a few probes to decide which addresses are alive. A port scan then checks which TCP or UDP ports respond. Service detection connects to open ports and compares the replies to a database of known software.

Figure 2. The six port states Nmap can report; open and filtered are the ones you will act on most.

Steps

Write the scope down: 10.10.10.0/24, your own lab, today's date.
Discover live hosts without port scanning.
Run a SYN scan of the most common ports on each live host (needs root or admin rights).
Identify service versions on open ports and run the default safe scripts.
Check the most common UDP ports, which are slower to scan.
Save everything in all formats with a dated name.

nmap -sn 10.10.10.0/24
sudo nmap -sS --top-ports 1000 10.10.10.20
sudo nmap -sS -p- 10.10.10.20
nmap -sV -sC -p 22,80,443 10.10.10.20
sudo nmap -sU --top-ports 20 10.10.10.20
sudo nmap -sS -sV -O 10.10.10.0/24 -oA inventory-2026-10-08

A week later (or after you install a new service on a target), scan again and compare:

sudo nmap -sS -sV 10.10.10.0/24 -oX inventory-new.xml
ndiff inventory-2026-10-08.xml inventory-new.xml

Verify

Success means you can fill in an inventory table like the one below from your results, and that ndiff reports the change you made (for example a new port 80 after installing a web server).

Host	OS guess	Open ports	Service and version	Expected?
10.10.10.20	Linux	22/tcp	OpenSSH	Yes, admin access
10.10.10.30	Windows	135, 139, 445/tcp	RPC, SMB	Review: is SMB needed?

Every unexpected open port is a question for the system owner: should this be running, and should it be reachable from here? Look up unfamiliar ports with the port lookup tool.

Troubleshooting and clean-up

All ports filtered: a host firewall is dropping probes. That is good defence; check the host locally with ss -tulpn (Linux) or Get-NetTCPConnection -State Listen (Windows).
Host shows as down but is up: it ignores discovery probes. Add -Pn to skip discovery for that one host.
Scan is very slow: full port and UDP scans take time; limit ports or targets.
"requires root privileges": SYN, UDP and OS scans need raw sockets; use sudo.

Clean up by storing results in your lab notes, then removing old XML files you no longer need. Scan output describes weaknesses, so treat it as confidential. At work, regular inventory scans feed asset management and the vulnerability scanning process.

Practice

What does nmap -sn do?

Host discovery only: it finds which addresses are up without scanning ports.

A port is reported as filtered. What does that usually mean?

A firewall dropped the probe, so Nmap cannot tell whether a service is listening.

How can you spot a new service between two scans?

Save both scans as XML and compare them with ndiff.

Key takeaways

Scan only networks you own or have written permission to scan.
Work from discovery to ports to service versions.
Save results with -oA and dated file names.
Compare scans over time with ndiff to catch changes.
Each unexpected open port is a question for the system owner.

Tracks your learning on this device only. See your progress on the learning paths.

About the author

Mohamed Fayas

Founder of FM TecHub. CCNA certified, with a BTEC HND in Network Engineering, and BEng (Hons) in Computer Networking and Cloud Security. He writes practical, plain-English guides on networking, security and cloud.

More about the author