Intro To Tools: Nmap, Wireshark, Netstat

Intro To Tools: Nmap, Wireshark, Netstat

In network and cybersecurity, understanding your network and monitoring traffic is essential. Three foundational tools that help with this are Nmap, Wireshark, and Netstat. Each serves a different purpose but together they provide a strong foundation for network analysis and security testing.

This guide explains these tools in a beginner-friendly way.

Nmap

What Is Nmap

Nmap (Network Mapper) is a network scanning tool that allows you to discover devices, services, and open ports on a network. It is widely used for:

• Network inventory
• Security auditing
• Identifying vulnerable services

Official website: Nmap

How Nmap Works

Nmap sends packets to a target machine and analyzes responses to determine:

• Which hosts are active
• Which ports are open or closed
• What services are running
• Operating system information

Basic Nmap Commands

Scan a Single IP

nmap 192.168.1.10

Scan a Range of IPs

nmap 192.168.1.1-20

Scan Common Ports Only

nmap -F 192.168.1.10

Scan All Ports

nmap -p- 192.168.1.10

Service Detection

nmap -sV 192.168.1.10

This detects running services and versions.

Wireshark

What Is Wireshark

Wireshark is a network protocol analyzer. It captures network traffic and allows you to inspect packets in detail.

It is used for:

• Troubleshooting networks
• Analyzing protocols
• Detecting suspicious activity
• Learning how networks work

Official website: Wireshark

How Wireshark Works

Wireshark captures packets from a network interface and displays:

• Source and destination IP addresses
• Protocol used (TCP, UDP, HTTP, etc.)
• Packet content
• Timing and sequence of packets

Basic Usage

1. Open Wireshark.
2. Select the network interface to capture.
3. Start capture.
4. Analyze captured packets.

Filtering Traffic

Example: Show only HTTP traffic:

http

Show packets from a specific IP:

ip.addr == 192.168.1.10

Netstat

What Is Netstat

Netstat (Network Statistics) is a command-line tool that shows current network connections, listening ports, and routing tables.

It is available on:

• Windows
• Linux
• macOS

Basic Netstat Commands

Show Active Connections

netstat -a

Show Listening Ports

netstat -l

Show PID With Connection (Linux)

netstat -tulpn

Windows Example

netstat -ano

This shows:

• Active connections
• Listening ports
• Process IDs

Practical Use Cases

1. Nmap – Find which devices are on your network and which ports they expose.
2. Wireshark – Inspect network packets to debug network issues or detect attacks.
3. Netstat – Check which applications are using network connections on your system.

Simple Combined Example

Below is a conceptual workflow using all three tools:

# 1. Scan the local network for live hosts and open ports
nmap -sV 192.168.1.1-20

# 2. Start Wireshark on the main network interface to capture traffic
wireshark

# 3. Check your local machine's active connections
netstat -tulpn

This combination allows you to:

• Discover devices (Nmap)
• Analyze traffic (Wireshark)
• Monitor your own connections (Netstat)

Final Notes

• Nmap is primarily used for reconnaissance and scanning.
• Wireshark is used for packet capture and deep analysis.
• Netstat is used for monitoring your own system’s network connections.

Together, these tools give you a complete beginner-friendly toolkit for network analysis and security awareness.

# Nmap Examples
nmap 192.168.1.10
nmap 192.168.1.1-20
nmap -F 192.168.1.10
nmap -p- 192.168.1.10
nmap -sV 192.168.1.10

# Wireshark Filters (run inside Wireshark)
http
ip.addr == 192.168.1.10

# Netstat Examples
netstat -a
netstat -l
netstat -tulpn  # Linux
netstat -ano     # Windows

# Combined Example Workflow
nmap -sV 192.168.1.1-20
wireshark
netstat -tulpn