~/tutorials/016-the-full-scan.md

016: The full scan

First Steps handed you the commands. Field Work starts with holding yourself to them: every port, versions, and a written answer for what you saw. No shortcuts, including the ones that look like judgement.

Two passes, or it is not full

nmap 127.0.0.1
nmap -sV 127.0.0.1

The first pass finds doors. The second asks each door what it is, and a scan that never asked is a scan that half-finished. Run both, every time, and read the second one against the first.

The line that makes it a census

nmap -sV 127.0.0.1 | grep closed

Not shown: 997 closed tcp ports (reset)

That line is the difference between a scan and a list. Three ports open, 997 refused: the scanner probed a thousand doors and is accounting for all of them. grep open | wc -l counts the doors that opened. The two numbers together, 3 and 997, are the posture of this host: three doors, 997 shut, and nobody hiding the arithmetic.

What asking costs

nmap 127.0.0.1 | grep done

Nmap done: 1 IP address (1 host up) scanned in 0.08 seconds

nmap -sV 127.0.0.1 | grep done

Nmap done: 1 IP address (1 host up) scanned in 6.41 seconds

Same host, same thousand doors. Looking cost 0.08 seconds, asking cost 6.41. That ratio is normal, and it is the reason people skip the second pass. A full scan is the discipline of paying it anyway, because the version column is where the interesting answers live.

The shortcut, and the flag that cannot help

nmap -p 22 127.0.0.1

Count the rows before you read on. One came back, because the list constrains the scan: ask for one door and you get one door, and the closed-port count moves with it.

Worth checking rather than assuming, because the difference between a flag that works and a flag that does nothing is invisible until you count. A constraint you did not verify is not a constraint.

Some flags here genuinely have nothing to act on. -T4 sets timing, and there is no scan to time, because this answer is a snapshot taken on 2026-09-21. A flag that cannot change the outcome should do nothing and let you notice, and the only test is to run it twice and compare the two answers. That is the same test as above, pointed at a tool that will not cooperate.

Try it

Each of these has one answer, and the shell gives it to you. Check yourself.

Run both passes and count open ports each way. Three and three at the time of writing, and a mismatch means one of the two scans deserves a closer read.
How many ports did the scan probe? Two numbers from one output, added.
Which pass took longer, and which grep line proves it?
Run the -p 22 scan and count the rows. Which service came back, and what does the count prove about the flag?

Every number here is from a snapshot stamped 2026-09-21 and says so in its own output. The commands are the current truth.