To scan a local network for active devices and their open ports using Nmap, you can use the following command:
```bash
nmap -sS -p 1-65535 -O -Pn 192.168.1.0/24
```
Here's a breakdown of the flags used:
* `-sS`: Performs a TCP SYN (half-open) scan, which is faster and more stealthy than a full TCP connect scan. This flag is used to initiate a connection with the target device without completing it.
* `-p 1-65535`: Specifies the port range to scan. In this case, we're scanning all 65,535 possible TCP ports. You can adjust this range based on your specific needs.
* `-O`: Enables Operating System detection, which attempts to determine the operating system running on the target device.
* `-Pn`: Treats all hosts as online, skipping the host discovery phase. This flag ensures that Nmap scans all IP addresses in the specified range, even if it can't reach them.
Replace `192.168.1.0/24` with your actual local network IP range.
For a more comprehensive scan with version detection, you can use:
```bash
nmap -sS -p 1-65535 -O -sV -Pn 192.168.1.0/24
```
The additional `-sV` flag enables version detection, which attempts to determine the version of services running on open ports.
**Best Practices:**
* Always run Nmap with root privileges using `sudo` to ensure access to raw sockets.
* Be cautious when scanning networks, as it may be considered malicious activity in some contexts. Ensure you have permission to scan the target network.
**Example Usage:**
1. Open a terminal in Kali Linux.
2. Type the command with the desired flags and IP range.
3. Press Enter to execute the scan.
Nmap will display the results, including active devices, open ports, and operating system information.
**Additional Tips:**
* To save the scan results to a file, use the `-oN` flag followed by the filename: `nmap -sS -p 1-65535 -O -Pn -oN scan_results.txt 192.168.1.0/24`
* For a faster scan, consider using the `-F` flag to limit the port scan to the top 100 ports: `nmap -sS -F -O -Pn 192.168.1.0/24`