How do I scan my own phone with Nmap?

A simple starting point is scanning the local loopback address 127.0.0.1 from Termux.

Setting Up Nmap in Termux: Complete Network Scanning Guide ~ HACKER WORLD

Q: What does Nmap -sV do?

The -sV option enables service and version detection. Nmap probes discovered ports to determine information about the service listening on them.

Q: What does Nmap -sn do?

The -sn option performs host discovery without the normal port-scanning stage.

Nmap, short for Network Mapper, is one of the most widely used tools for network discovery, port scanning and security auditing. With Termux, Android users can run Nmap directly from a mobile terminal without requiring a traditional desktop Linux environment.

In this guide, you will learn how to install Nmap in Termux, verify the installation, understand ports and services, perform basic scans, discover devices on a network you administer, identify services and save scan results.

Important: Only scan systems, devices, applications and networks that you own or have explicit permission to test. Unauthorized scanning can violate organizational policies, terms of service or local law. The commands in this tutorial are intended for your own devices, authorized networks and cybersecurity laboratories.

1. What Is Nmap?

Nmap is an open-source network exploration and security auditing utility. It can help administrators identify hosts, examine network ports, determine services running on accessible ports and gather additional information about systems during authorized assessments.

A typical Nmap result contains information about the target, discovered ports, port states and associated services. Depending on the scan options used, additional information may be available.

2. Why Use Nmap in Termux?

Termux provides an Android terminal environment where many Linux command-line utilities can be installed. Installing Nmap gives you a convenient way to perform basic network administration and security-testing tasks from an Android phone or tablet.

Portable network troubleshooting
Learning network security
Testing your own home lab
Checking services on devices you administer
Learning TCP/IP and port concepts
Practicing authorized penetration-testing techniques

3. Requirements

Before installing Nmap, make sure you have:

An Android device
A supported Termux installation
An active internet connection for package installation
Permission to test the target systems
Basic familiarity with the Termux command line

Tip: If you encounter repository or package errors, check your Termux installation and package repositories before troubleshooting Nmap itself.

4. Update Termux Packages

Start by updating the package information and installed packages.

pkg update
pkg upgrade

If Termux asks you to confirm an upgrade, follow the prompt shown by your installation.

5. Install Nmap in Termux

Once the package repositories are working, install Nmap with:

pkg install nmap

After installation completes, Termux should provide the nmap command.

6. Verify Nmap Installation

Check the installed Nmap version:

nmap --version

You should see information about the installed Nmap release and related build information.

You can also check where the executable is located:

which nmap

7. Get Nmap Help

Nmap includes built-in help documentation.

nmap --help

For a more detailed reference on a supported installation, you can also use:

man nmap

If the manual page is unavailable, the command-line help remains useful for quickly checking available options.

8. Scan Your Android Device

A safe first experiment is to scan your own Android device through the local loopback interface.

nmap 127.0.0.1

The address 127.0.0.1 refers to the local host. The result shows ports that Nmap can identify on that target.

Why start with localhost?
It gives beginners a controlled environment for learning how Nmap reports ports and services without immediately interacting with another device.

9. Basic Host Scan

The basic Nmap syntax is:

nmap TARGET

For example, if you administer a device at 192.168.1.10:

nmap 192.168.1.10

Replace the example IP address with an authorized target on your own network.

10. Understanding Ports

A network port is a logical endpoint used by network applications. TCP and UDP each have their own port space, and applications commonly listen on particular ports.

Port	Common Association
22	SSH
25	SMTP
53	DNS
80	HTTP
443	HTTPS
3306	Commonly associated with MySQL
5432	Commonly associated with PostgreSQL

Remember that a port number does not guarantee which application is actually running. Administrators can configure applications to listen on non-standard ports.

11. Scan Specific Ports

Use -p to specify ports you want to examine.

nmap -p 22 192.168.1.10

Multiple ports can be specified:

nmap -p 22,80,443 192.168.1.10

This can be useful when you want to check a small set of services instead of performing a broader scan.

12. Scan a Port Range

You can scan a range of TCP ports using a hyphen:

nmap -p 1-1000 192.168.1.10

This checks ports from 1 through 1000 on the authorized target.

13. Scan Common Ports

Nmap provides options for scanning commonly used ports without explicitly entering every port number.

nmap -F 192.168.1.10

The -F option means fast mode and scans fewer ports than the default scan.

You can also select a number of common ports:

nmap --top-ports 20 192.168.1.10

This is useful when you need a quick overview of frequently used ports on a system you are authorized to assess.

14. Service and Version Detection

Finding an open port does not always tell you exactly what software is listening on it. Nmap's -sV option performs service and version detection by probing discovered services.

nmap -sV 192.168.1.10

Depending on the target's responses, Nmap may identify an application and version information. Version detection is particularly useful during authorized inventory and security assessments.

Example: If an authorized lab server exposes HTTP, an -sV scan may provide more information than a basic port scan.

15. Host Discovery on Your LAN

If you administer a private network, Nmap can be used to determine which hosts respond to discovery probes.

For example, on a private network using the 192.168.1.0/24 address range:

nmap -sn 192.168.1.0/24

The -sn option performs host discovery without performing the normal port scan.

Only use a subnet range that belongs to a network you own or are explicitly authorized to administer.

16. Understanding Subnet Notation

CIDR notation is commonly used when describing networks.

Example	Meaning
192.168.1.10	Single IP address
192.168.1.0/24	Typical private IPv4 subnet containing 256 addresses
10.0.0.0/24	Another private IPv4 subnet example

The exact subnet in your environment depends on your router and network configuration.

17. TCP Scanning

TCP is one of the primary protocols used for network services. Nmap supports several TCP scanning techniques.

A common technique is SYN scanning:

nmap -sS 192.168.1.10

On some Android/Termux environments, permissions or networking limitations can affect raw-packet-based scan techniques. If a particular scan requires privileges that are unavailable, use a scan method supported by your environment and authorization.

18. UDP Scanning

Nmap can also examine UDP ports using -sU.

nmap -sU -p 53 192.168.1.10

UDP scanning can take longer than many TCP scans because UDP services do not necessarily respond to empty probes. Results can include states such as open and open|filtered.

Tip: When learning UDP scanning, begin with a small number of ports on a device or laboratory system that you control.

19. Operating System Detection

Nmap includes operating-system detection capabilities. The -O option requests OS detection.

nmap -O 192.168.1.10

OS detection depends on the responses available from the target and may not always produce an exact identification.

20. Timing and Performance

Nmap provides timing templates that can affect scan speed and network load. One commonly used template is -T4.

nmap -T4 192.168.1.10

Faster scanning is not automatically better. On mobile devices, busy Wi-Fi networks and sensitive production systems, aggressive timing may be undesirable.

When learning, use conservative scans and increase speed only when you understand the effect on your network.

21. Save Nmap Scan Results

Saving results is useful for comparing scans and documenting authorized network assessments.

Normal output

nmap 192.168.1.10 -oN scan.txt

XML output

nmap 192.168.1.10 -oX scan.xml

All major output formats

nmap 192.168.1.10 -oA myscan

The -oA option is convenient when you want Nmap to save the scan in several standard output formats.

22. Nmap Scripting Engine

Nmap includes the Nmap Scripting Engine, commonly abbreviated as NSE. NSE expands Nmap beyond basic port scanning by allowing scripts to perform additional network discovery and security-assessment tasks.

A default-script scan can be requested with:

nmap -sC 192.168.1.10

Combine it with service detection when appropriate:

nmap -sC -sV 192.168.1.10

NSE scripts can generate additional traffic and may interact with services in ways that a simple port scan does not. Use scripts only against systems you are authorized to test and understand the purpose of the scripts before running them.

23. Useful Nmap Commands for Beginners

Command	Purpose
`nmap 127.0.0.1`	Scan the local device
`nmap TARGET`	Basic scan of an authorized host
`nmap -p 80 TARGET`	Scan port 80
`nmap -p 22,80,443 TARGET`	Scan selected ports
`nmap -p 1-1000 TARGET`	Scan ports 1–1000
`nmap -F TARGET`	Fast scan of fewer ports
`nmap --top-ports 20 TARGET`	Scan 20 common ports
`nmap -sV TARGET`	Detect services and versions
`nmap -sn SUBNET`	Host discovery without normal port scanning
`nmap -sU -p 53 TARGET`	Check UDP port 53
`nmap -O TARGET`	Attempt OS detection
`nmap -sC TARGET`	Run default NSE scripts
`nmap -sC -sV TARGET`	Default scripts plus service detection
`nmap TARGET -oN scan.txt`	Save normal output
`nmap TARGET -oA scan`	Save multiple output formats

Replace TARGET and SUBNET with systems or networks that you are authorized to assess.

24. A Practical Beginner Workflow

Instead of immediately using advanced options, beginners can follow a simple progression.

Step 1 — Check installation

nmap --version

Step 2 — Scan localhost

nmap 127.0.0.1

Step 3 — Scan a specific authorized host

nmap 192.168.1.10

Step 4 — Check selected ports

nmap -p 22,80,443 192.168.1.10

Step 5 — Identify services

nmap -sV 192.168.1.10

Step 6 — Save the result

nmap -sV 192.168.1.10 -oN scan.txt

This workflow helps you understand what each option does instead of treating Nmap as a collection of commands to copy and paste.

25. Reading Nmap Results

A typical port table may contain columns such as:

PORT     STATE     SERVICE

Open

An open port generally means an application is listening and responding on that port.

Closed

A closed port is reachable but does not currently have an application listening.

Filtered

A firewall, filtering device or other network obstacle prevents Nmap from determining whether the port is open or closed.

Open|filtered

Nmap cannot determine with certainty whether the port is open or filtered. This is particularly relevant in some UDP scanning situations.

26. Why Does Nmap Show a Port as Open?

An open port generally indicates that a service is listening and accepting network connections or packets.

Finding an open port is not automatically evidence of a vulnerability. Security assessment requires understanding what service is running, how it is configured, whether it is exposed intentionally and whether it is properly secured.

27. Checking a Web Server on Your Own Device

Suppose you operate a test web server on your local network at 192.168.1.20.

Start with:

nmap -p 80,443 192.168.1.20

Then request service detection:

nmap -sV -p 80,443 192.168.1.20

This provides a basic way to verify whether expected HTTP or HTTPS services are reachable from your testing device.

28. Checking Your Home Network

If your router uses the private subnet 192.168.1.0/24, you can perform authorized host discovery with:

nmap -sn 192.168.1.0/24

After identifying devices that you recognize and are authorized to manage, you can inspect a particular device more closely.

nmap -sV 192.168.1.10

Security tip: If you discover a service that you do not recognize, identify the device and service before taking action. Do not assume that every unfamiliar port is malicious.

29. Nmap on Mobile: Important Limitations

Running Nmap through Termux is convenient, but Android is not identical to a traditional Linux workstation.

Some scan techniques may require privileges that are unavailable.
Android networking behavior can differ between devices and versions.
VPNs can change the routes and interfaces visible to applications.
Wi-Fi isolation may prevent devices from communicating with each other.
Firewalls can cause ports to appear filtered.
Some networks block or rate-limit scanning traffic.

If a command behaves differently from a desktop Linux installation, check the exact error message rather than assuming that Nmap itself is broken.

30. Common Termux + Nmap Errors and Fixes

Error: package cannot be found

Try updating the package lists:

pkg update
pkg upgrade

Then try:

pkg install nmap

Error: repository or mirror problem

If Termux package commands repeatedly fail, the issue may be related to the package repository or mirror rather than Nmap.

Termux provides repository-management tools that can help change mirrors when necessary.

termux-change-repo

Error: command not found

Check whether Nmap is installed:

which nmap

If nothing is returned, reinstall the package:

pkg install nmap

Permission-related errors

Some Nmap techniques require capabilities that a normal Android application environment does not provide. Try a less privileged scan or use a properly configured laboratory environment.

31. How to Make Your Nmap Learning Safer

Start with 127.0.0.1.
Create a small home cybersecurity lab.
Use virtual machines that you control.
Scan only devices you own or administer.
Keep a record of your test targets.
Learn what each option does before using it.
Avoid scanning random public IP addresses.
Do not use scanning as a way to bypass authorization.

32. Best Practices for Nmap

Use the minimum scan necessary for your task.
Prefer controlled lab environments when learning.
Save important results for later comparison.
Use service detection when you need to identify applications.
Do not treat an open port as proof of a vulnerability.
Understand firewall and network effects before interpreting results.
Keep Termux and installed packages maintained.
Respect organizational security policies.
Obtain explicit permission before scanning third-party infrastructure.

33. Beginner Nmap Cheat Sheet

# Check Nmap
nmap --version

# Localhost
nmap 127.0.0.1

# Basic authorized host scan
nmap TARGET

# Specific port
nmap -p 80 TARGET

# Multiple ports
nmap -p 22,80,443 TARGET

# Port range
nmap -p 1-1000 TARGET

# Fast scan
nmap -F TARGET

# Top common ports
nmap --top-ports 20 TARGET

# Service/version detection
nmap -sV TARGET

# Host discovery on your own subnet
nmap -sn 192.168.1.0/24

# UDP port
nmap -sU -p 53 TARGET

# OS detection
nmap -O TARGET

# Default NSE scripts
nmap -sC TARGET

# Save normal output
nmap TARGET -oN scan.txt

# Save multiple formats
nmap TARGET -oA scan

34. What Should You Learn After Nmap?

Once you understand basic Nmap usage, the next step should be learning the networking concepts behind the results.

TCP/IP fundamentals
IPv4 and IPv6 addressing
Subnetting and CIDR
TCP and UDP
DNS
HTTP and HTTPS
SSH
Firewalls
Routing
Network segmentation
Vulnerability management
Security logging and monitoring

Understanding these topics will make Nmap output much easier to interpret and will help you use network-scanning tools responsibly.

35. Frequently Asked Questions

What is Nmap in Termux?

Nmap in Termux is the Nmap network-scanning utility running inside the Termux Android terminal environment. It can be used for authorized network discovery, port scanning and security auditing.

Is Nmap free?

Yes. Nmap is an open-source network exploration and security-auditing tool.

Can I install Nmap without root?

Nmap can be installed in Termux without rooting the phone, although certain advanced scanning techniques may require privileges or capabilities that are not available in an ordinary Android environment.

What command checks whether Nmap is installed?

nmap --version

How do I scan my own phone?

Start with the local loopback address:

nmap 127.0.0.1

How do I scan a specific port?

Use the -p option:

nmap -p 443 TARGET

What does Nmap -sV do?

-sV enables service and version detection. Nmap probes discovered ports to determine information about the service that is actually listening.

What does Nmap -sn do?

-sn performs host discovery without the normal port-scanning stage.

Can Nmap find devices on my Wi-Fi?

It can perform host discovery on a private network when the network configuration permits it. Client isolation, firewalls and other network controls can affect the results.

Is scanning someone's IP address legal?

You should not assume that you are authorized to scan infrastructure simply because it is reachable. Obtain permission before scanning systems that you do not own or administer.

Conclusion

Nmap is an excellent tool for learning how network services work and for performing legitimate network administration and security assessments. Installing it in Termux makes basic Nmap functionality available directly from an Android device.

Beginners should start with localhost and controlled laboratory systems, learn how to interpret port states, and gradually move toward service detection, host discovery and other authorized assessment techniques.

Hacker World Recommendation: Do not focus only on memorizing Nmap commands. Learn networking fundamentals alongside Nmap. Understanding why a port is open, closed or filtered is much more valuable than simply knowing how to run a scan.

Disclaimer: This article is provided for educational, defensive-security and authorized network-administration purposes. Hacker World does not encourage unauthorized scanning, intrusion, exploitation or disruption of computer systems and networks.

Author: Hacker World

HACKER WORLD

Sunday, August 23, 2026