Skip to content

NMAP – How to run packet traces on Windows 7 – The Visual Guide


NMAP on Windows 7 can run a packet tracer.  Always scan the absolute minimum of ports when packet tracing.

Step 1 – Zenmap (NMAP on Windows).

Scan for an active host and ports using the -sS SYN Stealth Scan.  Use the 192.168.1.*/24 to scan the home network.

 nmap -sS 192.168.1.*/24



Step 2 – Find the open ports on a single device

nmap packet trace

Step 3 – Use the –packet-trace

To discover all packets sent and received, we packet trace on a single IP.  The first time you packet trace, use this command to ensure that you’re getting output.

nmap –packet-trace

nmap packet trace single ipThis will output all the packet traces for the scans.  Look for an SA or RA in the log…these are important – and are discussed later on.


We can packet trace on a single port – for instance port 23 for Telnet services.

nmap -p23 -d –packet-trace

nmap packet trace telnetWe can use packet trace multiple ports during a single scan.

nmap  -p 23,21,139 -d –packet-trace

nmap multiple portWe selected port 139 as we know this is closed.  Nmap shows the resets for port 139 in Red.

The syn-acks for open ports are shown in green.



Step 3 – How NMAP interprets the SYN probe

TCP SYN/ACK Response = Open Port

TCP RST Response = Closed

No Response = Filtered

ICMP Unreachable error = Filtered


Look in the packet tracer logs for an SA or an RA.

An SA or SYN-ACK means the port is open and responding.

An RA or RESET ACK means the port is closed.

nmap sa

Anything else indicates a firewall and filtering.




Professor Messer Guide to NMAP

Download NMAP with Windows Installer (Zenmap)

Nmap Commands – Cyberciti

NMAP SCANNING Book – Written by the developer of NMAP **AMAZING STUFF

Leave a Comment

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: