You already know how to use Nmap to find open ports. But in a real-world scenario, networks aren't just sitting there waiting to be scanned. They're protected by firewalls and Intrusion Detection Systems (IDS) designed to spot and block the kind of noisy TCP connect scans you've used so far. To get a clear picture of a well-defended network, you need to be quieter and smarter.

A standard TCP connect scan (-sT) is loud because it completes the full three-way handshake for every port. It's the digital equivalent of knocking on every door and waiting for someone to answer. An IDS will notice this activity immediately.

Stealth scans work by sending TCP packets that don't conform to the normal handshake process. They exploit a subtle rule in the TCP specification (RFC 793): if a port is closed, the receiving system should reply with a reset (RST) packet. If the port is open, it should ignore the malformed packet. This lack of response implies an open port.

These scans are effective against most Unix-based systems. However, Microsoft Windows systems don't follow this part of the RFC and will ignore these packets regardless of whether the port is open or closed. So, if a stealth scan shows all ports as open|filtered, you might be looking at a Windows machine.

Finding an open port is just the first step. The real goal is to understand what's running on that port and if it has any weaknesses. This is where the Nmap Scripting Engine (NSE) becomes incredibly powerful. NSE automates vulnerability detection, advanced reconnaissance, and even some exploitation using a library of scripts written in the Lua programming language.

You can use the --script flag to run specific scripts or entire categories. Some of the most useful categories are:

• safe: Scripts that won't crash the target system.
• discovery: Scripts that try to find more information about the network, like other hostnames or available services.
• vuln: Scripts that actively check for known vulnerabilities.

Running the vuln category is a powerful way to get a quick security assessment, but it comes with trade-offs. These scripts are aggressive and generate a lot of network traffic, which can easily trigger an IDS. You're trading stealth for speed and convenience.

Even with stealth scans, a vigilant IDS can detect you. An IDS might flag activity if it sees a single IP address probing many different ports in a short time. To counter this, you can use timing options (-T0 through -T5) to slow down your scan and make it look more like normal network traffic. A -T2 (polite) scan is much less likely to be detected than the default -T3 or an aggressive -T4.

Another evasion technique is banner grabbing and OS fingerprinting. When Nmap identifies a service, it tries to grab its "banner"—a text response that often includes the software name and version. Similarly, it analyzes TCP/IP stack characteristics to guess the operating system. While useful, these probes are distinctive and can be logged. You can disable them if pure port discovery is your only goal.

For very large networks, a common workflow is to use a fast, broad tool like Masscan to quickly identify live hosts and open ports, then feed that smaller list of targets into Nmap for deeper, more detailed analysis with NSE scripts. This combines the speed of a broad scanner with the precision of a deep one.

These advanced techniques move you from simply mapping a network to truly understanding its potential weaknesses. It's a combination of choosing the right scan type, leveraging automation, and knowing when to be quiet.