Discover live hosts on a network

Identify open ports and running services

Detect operating systems and versions

Run vulnerability detection scripts

In penetration testing, Nmap is usually the very first tool you run against a target for active scanning.
Why Active Reconnaissance with Nmap Is Critical for Enumeration

In the early stages of a penetration test or bug bounty engagement, one of the most important tasks is enumeration — the process of actively gathering information about the target environment.

Active reconnaissance, especially using tools like Nmap, plays a key role here. One of the first steps is typically external enumeration of hosts, where you identify Internet-facing systems within the target’s network. These are the systems most exposed to potential attackers and therefore, often the most interesting from a security perspective.

Once these hosts are identified, the next step is to determine which services are accessible on them. Ideally, services exposed to the Internet should be minimal and well-secured. However, it’s common to find unexpected services running — sometimes due to misconfigurations or legacy systems that were never decommissioned.

This is where Nmap shines. A well-crafted port scan allows you to:

Discover which services are actually running.

Understand how the network is segmented or exposed.

Start identifying potential vulnerabilities based on service versions and configurations.

In essence, active reconnaissance with Nmap lays the groundwork for a successful assessment by turning unknowns into actionable intelligence.
Port Scanning: How Nmap Probes for Open Services

A port scan is a form of active scanning where the scanning tool sends probes to specific ports on a target IP address to determine whether any services are listening. This technique is foundational in both penetration testing and bug bounty recon because it reveals what the system is exposing to the outside world.

One of the most commonly used methods is the SYN scan (-sS in Nmap). In this method, Nmap sends a TCP SYN packet to a port. This scan is often called “half-open scanning” because it doesn’t complete the full TCP handshake — it just sends the initial SYN and inspects the response.
Here’s how Nmap interprets the responses:

SYN/ACK → The port is open and listening.

RST (Reset) → The port is closed.

No response → The port is marked as filtered, meaning a firewall or other network device may be blocking the probe.

This approach is efficient, stealthier than a full TCP connect scan (-sT), and ideal when you want to scan a large number of ports quickly without triggering too many alarms on the target system.