How to Install Nmap on Debian Linux

Nmap (Network Mapper) scans networks to discover hosts, open ports, running services, and operating system details. Whether you need to audit your home network for security vulnerabilities, verify firewall rules are working correctly, or inventory devices on a corporate network, Nmap provides the scanning capabilities to accomplish these tasks. By the end of this guide, you will have Nmap installed on your Debian system, ready to perform network discovery and security assessments from the command line.

Choose Your Nmap Installation Method

Debian offers Nmap through its default repositories, which provides a stable and tested version. Alternatively, you can compile Nmap from source to access the latest features and scanning scripts. The table below compares both approaches:

Method	Channel	Version	Updates	Best For
APT Package Manager	Debian Repos	Stable	Automatic via apt upgrade	Most users who want easy installation and maintenance
Source Compilation	Nmap.org	Latest	Manual recompilation	Users needing latest NSE scripts or bleeding-edge features

For most users, the APT method is recommended because it integrates with Debian’s package management, receives security updates automatically, and requires no compilation. Only compile from source if you specifically need features unavailable in the repository version.

Method 1: Install Nmap via Debian’s Default Repository

Update System Packages

Before proceeding with the installation process, ensuring that your system packages are up-to-date is essential. This can be achieved by executing the following command in the terminal:

sudo apt update && sudo apt upgrade

By doing so, you can avoid any conflicts during the installation or operation of Nmap.

Install Nmap via APT Command

Once you have ensured that your system packages are up-to-date, you can proceed with the Nmap installation process. Fortunately, Nmap is available in Debian’s default repository, making the installation process straightforward. You can install Nmap by executing the following command in the terminal:

sudo apt install nmap

This command downloads and installs Nmap along with its dependencies from Debian’s official repositories.

Verify Nmap Installation

After installation completes, verify that Nmap is working correctly by checking the installed version:

nmap --version

Expected output:

Nmap version 7.93 ( https://nmap.org )
Platform: x86_64-pc-linux-gnu
Compiled with: liblua-5.3.6 openssl-3.0.x libssh2-1.10.0 libz-1.2.13 libpcre-8.39 libpcap-1.10.3 nmap-libdnet-1.12 ipv6
Compiled without:
Available nsock engines: epoll poll select

Nmap versions vary by Debian release: Debian 11 (Bullseye) includes version 7.80, Debian 12 (Bookworm) includes 7.93, and Debian 13 (Trixie) includes 7.95. Your output will reflect whichever version your repository provides.

Method 2: Install Nmap via Source

In some situations, users might need the latest version of Nmap, and the version in Debian’s repositories might not be good enough. Compiling Nmap from its source code can solve this problem, providing the newest features and updates. This method requires more steps and frequent updates, but it can be helpful for advanced users or those with specific needs.

Install Build Dependencies

Before looking at the source code, we must prepare our system with the necessary tools. The build-essential package includes important packages for compiling Debian software, including tools like the gcc compiler and make. Installing this package is essential to compiling and building Nmap from its source.

To proceed, open your terminal and input:

sudo apt install build-essential libssh2-1-dev libssl-dev libpcre2-dev wget

These packages provide: build-essential (GCC compiler and make utility), libssh2-1-dev (SSH2 protocol support), libssl-dev (OpenSSL cryptographic libraries), libpcre2-dev (Perl Compatible Regular Expressions library for pattern matching), and wget (for downloading the source archive).

Download Nmap Source Archive

Our next move is to fetch the Nmap source code. The official Nmap download page is the trusted source for this. We’ll employ the wget command to download the current stable release for this guide. It’s worth noting that the version changes over time. As of this guide, the latest stable release is 7.95. However, always refer to the download page for the most recent version and adjust your command accordingly.

To fetch the Nmap source code, execute:

wget https://nmap.org/dist/nmap-7.95.tar.bz2

Note: Visit the download page to get the latest version! This command is just an example and will soon be outdated.

Extract Nmap Source Archive

With the Nmap source code in hand, our next task is to unarchive the files. To achieve this, run:

tar -xjf nmap-7.95.tar.bz2
cd nmap-7.95

Note: Adjust the filename to match the version you downloaded.

Configure Build Options

Next, run the configure script to detect your system’s configuration and prepare the build. The --with-localdirs flag tells Nmap to search for libraries in /usr/local directories:

./configure --with-localdirs

Expected output:

checking build system type... x86_64-pc-linux-gnu
checking host system type... x86_64-pc-linux-gnu
checking for gcc... gcc
checking whether the C compiler works... yes
checking for C compiler default output file name... a.out
checking for suffix of executables... 
checking whether we are cross compiling... no
checking for suffix of object files... o
checking whether we are using the GNU C compiler... yes
checking for OpenSSL... yes
checking for libpcre... yes
checking for libz... yes
checking for libssh2... yes
checking for libpcap... yes
configure: creating ./config.status
config.status: creating Makefile
config.status: creating config.h

Configuration complete. Type make (or gmake on some *BSD machines) to compile.

Compile Nmap Source via make

With our build ready, it’s time to compile the source code. The make command facilitates this, interpreting the Makefile in the Nmap source directory to compile the source code:

make

The compilation process will take several minutes. Expected output at completion:

Compiling liblua
Compiling liblinear
Compiling libnetutil
Compiling libnsock
Compiling nbase
Compiling nmap
Compiling ncat
Compiling nping
make[1]: Entering directory '/home/user/nmap-7.95/nping'
g++ -c nping.cc -o nping.o
g++ -c ProbeMode.cc -o ProbeMode.o
g++ -c EchoServer.cc -o EchoServer.o
make[1]: Leaving directory '/home/user/nmap-7.95/nping'
Compilation complete. Nmap compiled successfully!

Install Nmap via make install Command

Having compiled the source code, we’re now poised to install Nmap. This phase situates the compiled software in the relevant directories of your system. To finalize the Nmap installation, run:

sudo make install

This command installs Nmap to /usr/local/bin and copies the NSE scripts and other resources to their respective directories.

Confirming the Nmap source Installation

Post-installation, verifying that Nmap has been accurately installed from the source and reflects the latest version is paramount. To authenticate this, execute:

nmap --version

Expected output:

Nmap version 7.95 ( https://nmap.org )
Platform: x86_64-pc-linux-gnu
Compiled with: liblua-5.4.6 openssl-3.3.x libssh2-1.11.0 libz-1.3.1 libpcre2-10.42 libpcap-1.10.5 nmap-libdnet-1.12 ipv6
Compiled without:
Available nsock engines: epoll poll select

This output confirms the installed Nmap version aligns with the source code version you compiled. You have successfully built and installed the latest version of Nmap from source on your Debian system.

Basics of Nmap Command Examples

To become familiar with Nmap, it is important to have a basic understanding of its commands. These commands are essential to utilize the full functionality of Nmap. For a comprehensive guide covering more scan types, timing templates, and NSE scripts, see our Nmap Commands for Beginners guide.

Nmap Port States Definitions

When scanning for open ports on a target system, Nmap reports the state of each port it probes. The following table outlines the different port states that Nmap may report:

Port State	Description
Open	An application is actively accepting TCP connections, UDP datagrams, or SCTP associations on this port.
Closed	The port is accessible (it receives and responds to Nmap probe packets), but there is no application listening on it.
Filtered	Nmap cannot determine whether the port is open because packet filtering prevents its probes from reaching the port. Firewalls or router rules may be blocking the probes.
Unfiltered	The port is accessible, but Nmap is unable to determine whether it is open or closed. Only the ACK scan reports ports in this state.
Open|Filtered	Nmap places ports in this state when it is unable to determine whether a port is open or filtered. This occurs for scan types in which open ports give no response.
Closed|Filtered	This state is used when Nmap is unable to determine whether a port is closed or filtered. It is only used for the IP ID idle scan.

Nmap Basic Commands

The following sections provide an overview of some basic Nmap commands.

Scan Host

To scan a host, whether internal or external, you can use the following command:

nmap [IP address] or [website address]

Alternatively, you can scan internally using the following command:

nmap localhost

To perform a scan quickly, you can use the -F flag:

nmap -F [IP address] or [website address]

Operating System Scan

To initiate an operating system scan, you can use the following command:

nmap -O --osscan-guess [IP address] or [website address]

Port Specification and Scan Order

To initiate a custom port scan, you can use the -p flag followed by the ports you wish to scan:

nmap –p 80,443,8080,9090 [IP address] or [website address]

Services Scan

To initiate a services scan, you can use the following command:

nmap -sV [IP address] or [website address]

TCP SYN Scan

To initiate a TCP SYN scan, you can use the following command:

nmap -sS [IP address] or [website address]

Nmap Help

Overall, Nmap has many features and combinations. To learn more about these, you can use the following command to bring up the list of commands and optional flags that can be used with your scans:

nmap --help

By utilizing these basic Nmap commands, you can perform effective network scans, identify vulnerabilities, and enhance the security of your system.

Additional Tips on Nmap

Remove (Uninstall) Nmap

Removing the Packaged Version of Nmap

If you installed Nmap using the package manager (apt), you can uninstall it with the following command:

sudo apt remove nmap

This command will remove Nmap and any associated configuration files. If you also want to remove the dependencies that were installed with Nmap and are no longer used by any other programs, you can use:

sudo apt autoremove

To verify successful removal, check that the Nmap binary is no longer available:

which nmap

If Nmap was removed successfully, this command will return no output.

Removing the Compiled Version of Nmap

The removal process is slightly different if you’ve compiled Nmap from source and installed it. Typically, if you used make install to install Nmap, you can navigate to the source directory and use make uninstall to remove it. However, not all Makefiles include an uninstall target.

Navigate to the Nmap source directory:

cd /path/to/nmap/source/directory

Then run the following command:

sudo make uninstall

You should see something similar below:

running uninstall
Removing '/usr/local/bin/nmap'.
Removing '/usr/local/share/man/man1/nmap.1'.
Removing '/usr/local/share/nmap' directory.
make[1]: Entering directory '/home/user/nmap-7.95/nping'
rm -f /usr/local/bin/nping
rm -f /usr/local/share/man/man1/nping.1
make[1]: Leaving directory '/home/user/nmap-7.95/nping'
NMAP SUCCESSFULLY UNINSTALLED

Conclusion

You have successfully installed Nmap on your Debian system using either APT or source compilation. From here, you can begin exploring your network by running basic scans against localhost or your local network. Start with version detection (nmap -sV) to identify running services, then progress to OS fingerprinting (nmap -O) for deeper reconnaissance.

For more advanced security work, consider pairing Nmap with complementary tools. Wireshark enables packet-level analysis of the traffic Nmap generates, while Chkrootkit can help verify the integrity of systems you’ve scanned. To manage remote access during security audits, see our guide on enabling SSH on Debian.