~/tutorials/004-first-scan.md

004: Your first scan, on your own network

Everything in this lesson is aimed at machines you own. Not because scanning is dangerous, but because the habit of asking permission is the difference between a researcher and a liability. The rule this site runs on is the same one you should: your machines, or somebody's written word.

Find out where you are first

Before you scan anything you should know what network you are on, because a scan of an address range you misread is a scan of somebody else's house.

ip -br addr
ip route

The first tells you your interfaces and addresses. The second tells you your default gateway, which is the address of the router you are behind. A home network is usually 192.168.1.0/24 or 192.168.0.0/24, and the range matters: /24 is 254 addresses, and every one of them is somebody's device.

Scan your own machine first

nmap 127.0.0.1
nmap -sV 127.0.0.1

The first run lists open ports. The second asks the services on those ports what they are, and it is a different kind of question: it connects and talks, rather than just looking for a listener. Expect it to be slower, and expect some services to refuse to identify themselves.

Try to be surprised by something. There is nearly always a port open that you did not open yourself, and finding it is the actual exercise.

Then your own network

nmap -sn 192.168.1.0/24

-sn means "do not port scan, just tell me who is alive". This is the least intrusive useful scan there is. You should recognise every device in the answer. If you do not, that is not automatically an intruder: it is more often a television, a printer, a power meter, or a device you forgot you plugged in three years ago.

Identify before you conclude. A responsible follow-up is checking the device's own interface, or the router's client list, not escalating a scan against something you have not identified.

Read it like lesson one

A closed port means that machine, at that moment, with that probe, got no answer. It does not mean the port is closed forever, and it does not mean nothing is listening on something else.

Firewalls also lie in a specific way: a filtered port is one where the reply was dropped rather than refused, and nmap distinguishes them for a reason. Filtered and closed are different answers, and collapsing them into "nothing there" is exactly the kind of confident summary lesson one warned you about.

Try it

1. Scan localhost and identify every open port. Look up anything you do not recognise.
2. Do an -sn sweep of your own network and write down what each device is before you check any of them against the router.
3. Pick one device you own, scan it, then log into it and compare. The difference between what it reports about itself and what it shows the network is the most interesting thing in this lesson.