Seeing the Invisible: My First Deep Dive into Nmap and Wireshark
Introduction
This is Blog #9 on Net with Hiru - and honestly, this one felt different.😀
Every other lab I've done, I more or less knew what tools I needed before I started. This time? I sat down to run my first Nmap scan and hit an immediate wall: Nmap wasn't even installed on my machine. That tiny obstacle turned into the most satisfying lab I've done so far because by the time I got past it, I wasn't just following steps. I actually understood what I was doing and why.
In this post I'll walk you through how I set up a local Python web server, installed Nmap, ran two different port scans (SYN and TCP Connect), and then the really cool part - verified everything I saw in the terminal using Wireshark packet captures. Real packets, real evidence, real understanding.
What is a Port Scanner - and Why Should You Care?
Imagine a building with hundreds of doors. A port scanner is someone walking down the hallway, knocking on each door, and listening for a response -without ever opening one.
Every computer connected to a network has 65,535 TCP ports. Each port is like a door for a specific type of communication. Port 80 is for HTTP web traffic. Port 443 is HTTPS. Port 22 is SSH. Port 8080 is a common alternative HTTP port.
Nmap (Network Mapper) is the world's most widely used open-source port scanner. It was created by Gordon Lyon in 1997 and is trusted by security professionals, network engineers, and students worldwide. It can tell you:
- Which ports on a host are open, closed or filtered
- What services are running on those ports
- What operating system a host might be running
Fun fact: Nmap has appeared in several Hollywood films, including The Matrix Reloaded and Die Hard 4, because filmmakers wanted realistic hacking visuals. That's how iconic this tool is.
For networking students, learning Nmap is like learning to use a stethoscope🩺 - it lets you listen to what a network is actually doing.
Setting Up: Python Server, Nmap Install and the First Surprise
Step 1 - Start a Python Web Server
Before scanning anything, I needed something to scan at. I fired up a simple Python HTTP server on port 8080 - just one command in CMD:
python -m http.server 8080This starts a lightweight web server on my own machine (127.0.0.1), listening on port 8080. Any browser or scanner hitting that port would get a response. Instant target.
Step 2 - The Surprise: Nmap Isn't Installed by Default
Here's where things got interesting. I opened a new CMD window and typed nmap.
Error. Command not found.
This was my first lesson of the day: Nmap is not bundled with Windows (or most operating systems). It's a separate tool you have to download and install. I headed to nmap.org, grabbed the Windows installer, and ran it. A few clicks later - Nmap 7.93 was ready.
That small detour actually made the whole experience more real. I wasn't just running pre-installed tools in a sandboxed lab. I was setting up my own environment, the way a network engineer actually would.
Step 3 - Start Wireshark
With Nmap installed, I opened Wireshark and set the display filter to:
tcp.port == 8080
This meant Wireshark would only show me packets coming from or going to port 8080 - exactly what my Python server was listening on. Clean, focused capture. Then I was ready to scan.
SYN Scan (-sS): The Half-Open Handshake
The Command
nmap -sS -p 8080 127.0.0.1Nmap reported: 8080/tcp open http-proxy. Perfect. But how did it know?
What a SYN Scan Actually Does
To understand the SYN scan, you first need to know how a normal TCP connection is established - the Three-Way Handshake:
- Client sends SYN → "Can I connect?"
- Server replies SYN/ACK → "Yes, I'm open."
- Client sends ACK → "Great, connection established."
A SYN scan deliberately breaks this pattern. Instead of completing the handshake, Nmap sends a SYN and if the server responds with SYN/ACK (meaning the port is open), Nmap immediately sends a RST (Reset) packet to abort the connection before it fully opens.
This is why it's called a Half-Open scan or Stealth scan - the full TCP connection is never completed.
The Wireshark Proof
My Wireshark capture showed exactly three packets for this scan:
Packet | Direction | Flag | Meaning |
|---|---|---|---|
1 | 55085 → 8080 | SYN | Nmap asks: "Is this port open?" |
2 | 8080 → 55085 | SYN, ACK | Python server: "Yes, I'm open!" |
3 | 55085 → 8080 | RST | Nmap: "Thanks. I'm done here." |
Source port 55085 was Nmap's randomly chosen temporary (ephemeral) port for this scan.
Why is This Interesting?
Because the connection is never fully established, many older intrusion detection systems (IDS) and application logs don't record it. The server's application layer never gets notified only the TCP/IP stack saw the SYN/ACK exchange. This makes the SYN scan one of the most widely used reconnaissance techniques in both ethical penetration testing and malicious network reconnaissance.
Note: Running a SYN scan requires administrator/root privileges because it constructs raw TCP packets manually, bypassing the OS's normal socket API.
Connect Scan (-sT): The Full Handshake
The Command
nmap -sT -p 8080 127.0.0.1Same result: 8080/tcp open http-proxy. But the way it got there was completely different.
What a TCP Connect Scan Does
Unlike the SYN scan, the Connect scan tells the operating system to open a real TCP connection using the standard socket API — the same mechanism your web browser uses when you visit a website. The full Three-Way Handshake completes:
- Scanner → Server: SYN
- Server → Scanner: SYN/ACK
- Scanner → Server: ACK (handshake complete!)
- Scanner → Server: RST/ACK (connection torn down)
The Wireshark Proof
My Wireshark capture showed four packets for this scan - more than the SYN scan:
Packet | Direction | Flag | Meaning |
|---|---|---|---|
13 | 4620 → 8080 | SYN | Connection request |
14 | 8080 → 4620 | SYN, ACK | Server: "I'm open" |
15 | 4620 → 8080 | ACK | Handshake complete |
16 | 4620 → 8080 | RST, ACK | Connection torn down |
Notice that Packet 15 is the ACK - this is the critical difference. The handshake went all the way through. The server's application layer was notified. This connection would appear in the Python server's logs.
Also notice the source port changed to 4620 - that's because this is a brand new scan session and the OS assigned a different ephemeral port.
Why Use This Instead of SYN Scan?
The Connect scan doesn't require admin privileges - any regular user can run it, because it uses the OS's built-in socket system rather than raw packet crafting. The trade-off: it's noisier and more detectable by firewalls and IDS tools, since the full connection gets logged.
Interesting Facts That Blew My Mind
🔍 Nmap's RST packet isn't a bug - it's a feature. The SYN scan's RST response is intentional. Nmap sends it to cleanly close the half-open connection before the OS's TCP stack tries to take over and complete it on its own. Without that RST, you'd have orphaned half-open connections piling up.
📡 Your source port is random every time. Ephemeral ports (the temporary ports on the scanner side, like 55085 or 4620) are assigned by the OS from a pool, typically 49152–65535. That's why the source port changed between my two scans - same machine, same Nmap, different ephemeral port each time.
🛡️ 127.0.0.1 is special - it never leaves your computer. The loopback address means every packet I scanned stayed entirely within my machine. Nothing touched the physical network adapter. Wireshark was capturing on a virtual loopback interface - a clean, isolated environment for learning.
⚡ Why is port 8080 so commonly used for testing? Port 80 is the standard HTTP port, but on most systems only root/admin can bind to ports below 1024. Port 8080 is a high port that any user can open, making it the go-to for dev servers, test services and labs like this one.
🎬 Nmap is Hollywood-famous. Production teams on The Matrix Reloaded, Die Hard 4.0, Dredd, and other films actually used real Nmap scans as their "hacking" visuals. The Nmap website keeps a running list of its film appearances. It's that embedded in real security culture.
📖 The RST, ACK at the end of Connect Scan is curious. You might expect a FIN, ACK (a graceful teardown) after a successful connection. But Nmap uses RST, ACK for speed - it immediately terminates without going through the full four-way FIN handshake. It's brusque, but efficient.
What I Learned - and What's Next
This lab taught me something that goes beyond the two scan types.
Before this, Wireshark felt like a tool I used after understanding something, to confirm it. But this time, Wireshark was the thing that made me understand. Seeing those three packets for -sS and four packets for -sT - with my own eyes, on my own machine, in real time - converted a textbook concept into something I won't forget.
That's the power of packet-level verification. The terminal output tells you the answer. Wireshark tells you how the answer was found.
A few things I'm taking away:
- Installing tools is part of learning. That unexpected Nmap setup moment taught me to check my environment before assuming anything is ready.
- The SYN scan is elegant precisely because of what it doesn't do. Half-open is not a bug - it's deliberate design.
- Ephemeral ports are your scanner's fingerprint. The OS picks them randomly, but Wireshark lets you track exactly which port was used for which session.
- Wireshark never lies. If something happened at the packet level, it will be there.
Next up, I want to explore more Nmap scan types - UDP scanning, OS detection (-O), and service/version detection (-sV). Each one is a different conversation the scanner has with the network, and I want to see all of them in Wireshark.
If you're following along on this blog, try setting up the same environment - Python server, Nmap, Wireshark - and run both scans yourself. Count the packets. Spot the ACK. It clicks in a way that reading about it never quite does.
Hiru | Net with Hiru | netwithhiru.blogspot.com
Tags: Nmap, Wireshark, TCP, SYN Scan, Connect Scan, Network Security, Packet Analysis
Comments
Post a Comment