Tutorials · Security Operations
How to Scan Your Network for Vulnerabilities With Nmap and OpenVAS
Find open ports, outdated services and known vulnerabilities before attackers do. Discover hosts with Nmap, then run authenticated vulnerability scans with Greenbone OpenVAS and fix what matters first.
Before you start
- Written permission to scan the networks (always required)
- A Linux machine or VM on the network to scan
- Nmap (apt install nmap) and Docker for the Greenbone Community Edition
Step by step
Get permission and define scope
List the subnets and the time window, and tell the operations team. Scanning without permission can break fragile devices and may be illegal.
Discover live hosts
A ping sweep shows what is actually on each subnet.
nmap -sn 10.1.10.0/24 10.1.20.0/24 -oN hosts.txtFind open ports and versions
Scan the common ports and detect service versions. Save the output for comparison next month.
nmap -sV -T4 --top-ports 1000 10.1.20.0/24 -oA scan-$(date +%F)Check management exposure
Telnet, HTTP management, SNMP with default communities and SMBv1 should not be reachable from user VLANs.
nmap -p 23,80,161,445,3389,8080 --open 10.1.0.0/16 nmap --script ssl-enum-ciphers -p 443 10.1.20.15
Install Greenbone (OpenVAS)
Follow the Greenbone Community Containers guide: it provides a docker-compose file that runs the scanner, feeds and web UI. The first feed sync takes a while.
Run an authenticated scan
Create a target with SSH or SMB credentials of a read-only scan account. Authenticated scans find missing patches that an unauthenticated scan cannot see.
Prioritise and fix
Sort by severity and by exposure: Internet-facing and critical (CVSS 9+) first, then high. Patch, disable the service or restrict it with firewall rules, then re-scan to confirm.
Repeat on a schedule
Scan monthly and after every major change. Compare the Nmap XML files to spot new open ports.
ndiff scan-2026-10-01.xml scan-2026-11-01.xml
Commands are generic, industry-standard examples. Exact syntax and menu names vary by model and firmware; check your device's manual on the Documentation page.
Pro tips
- Scan network devices gently (-T3) and outside business hours: some old printers and cameras crash under scans.
- Keep a list of accepted risks with an owner and a review date.
- Run an external scan of your public IPs too: that is what attackers see first.
FAQ
Frequently asked questions
Is Nmap legal?
Scanning networks you own or have written permission to test is legal. Scanning other people's networks can be illegal.
How often should we scan?
At least monthly for internal networks, weekly for Internet-facing systems, and after every change.
Keep learning
Related guides
Write firewall rules that protect
Read more →Upgrade firmware safely
Read more →Harden Linux servers
Read more →How to Set Up a WireGuard VPN Server for Remote Access
WireGuard is a fast, modern VPN with a small, auditable code base. Build a WireGuard server on Linux, add users with their own keys and route them only to the networks they need.
Read more →How to Build a Free SIEM With Wazuh for Network and Server Logs
A SIEM collects logs from servers, firewalls and switches in one place and alerts on attacks. Install Wazuh, add agents and syslog sources, and tune the first alerts.
Read more →How to Detect Network Attacks With Suricata IDS on a Mirror Port
An intrusion detection system watches a copy of your traffic and alerts on scans, exploits and malware traffic. Install Suricata on a sensor connected to a switch mirror port.
Read more →Stuck on a step?
Ask Navijin technical support or an authorised partner for help with your configuration.