54 Scanning and Enumeration – Zenmap Expanded

Kaden Hayrynen and Mathew J. Heath Van Horn, PhD

“Zenmap is the official Nmap Security Scanner GUI. It is a multi-platform (Linux, Windows, Mac OS X, BSD, etc.) free and open source application that aims to make Nmap easy for beginners to use while providing advanced features for experienced Nmap users. Frequently used scans can be saved as profiles to make them easy to run repeatedly. A command creator allows interactive creation of Nmap command lines. Scan results can be saved and viewed later. Saved scan results can be compared to see how they differ. The results of recent scans are stored in a searchable database.” Zenmap Homepage

This Zenmap chapter expands upon the defensive chapter because we are using it in a slightly different way. This chapter takes advantages of the unique GUI features for offensive techniques where the previous chapter used CLI and scanned for defensive operations. Finally, some schools reported that they only use the defensive or offensive sections, so we figured it wouldn’t hurt to have a Zenmap chapter in each section with the appropriate focus.

Phase 0 – Professional Alignment

Understanding the structure of an enterprise network is essential for effective administration, security assessment, and incident response. In this chapter, you will use Zenmap, the graphical interface for Nmap, to discover network hosts, perform targeted scans, identify active services, and visualize network topology. These activities demonstrate how graphical reconnaissance tools help IT professionals analyze network environments, document infrastructure, and identify potential security risks.

DCWF Work Roles

The knowledge and skills developed in this chapter align with the following Department of Defense Cyber Workforce Framework (DCWF) work roles:

  • 541 – Cyber Defense Analyst
  • 511 – Network Operations Specialist
  • 451 – System Security Analyst

NICE Work Roles

This chapter supports competencies associated with the following NICE Workforce Framework for Cybersecurity work roles:

  • Cyber Defense Analyst
  • Vulnerability Assessment Analyst
  • Network Operations Specialist

Professional Skills

By completing this chapter, you will begin developing the ability to:

  • Perform graphical network discovery and host enumeration using Zenmap.
  • Identify active hosts, open ports, and network services.
  • Generate and interpret network topology visualizations.
  • Compare scan results to identify changes in enterprise environments.
  • Analyze scan data to support security assessments and network troubleshooting.
  • Document network assets and connectivity using graphical reconnaissance tools.

What You’ll Be Able to Do

After completing this chapter, you should be able to:

  • Configure and perform Quick and Intense scans using Zenmap.
  • Discover hosts and identify active network services within the Eagle Net environment.
  • Generate and interpret graphical network topology and traceroute visualizations.
  • Analyze host details, including operating system and service information, from scan results.
  • Compare scan results to improve network documentation and security awareness.
  • Explain how graphical reconnaissance tools support enterprise network administration and cybersecurity assessments.

Learning Objectives

  • Download and explore Zenmap
  • Use Zenmap to scan a host
  • Use Zenmap to perform a quick scan
  • Use Zenmap to perform an intense scan

Prerequisites

Deliverables

  • Five screenshots are needed to earn credit for this exercise:
    • Screenshot of a subnet scan
    • Screenshot of a topology of the subnet
    • Screenshot of a targeted scan
    • Screenshot of the host details
    • Screenshot of the traceroute-topology

Resources

Contributors and Testers

  • TBD

Phase I – Getting Started

Zenmap is sometimes included with Kali; it comes and goes as a default app. This section checks whether Zenmap is installed and, if not, provides instructions for installing it.
  1. BEFORE starting GNS3, navigate to VirtualBox
    1. Ensure the Kali VM network settings are set to NAT or NAT-Network
    2. Start the Kali VM
    3. Check if Kali has Zenmap installed type 
      zenmap --version
    4. You should get a version response
      Zenmap is installed
      Figure 1 – Zenmap is installed
    5. If you get a message that it is not installed, then install it following these steps
      1. Update the Kali VM sudo apt update
      2. Upgrade the Kali VM sudo apt upgrade
      3. Install Zenmap on the Kali VM sudo apt install zenmap
  2. Shutdown the Kali VM
  3. Change the network settings back to generic driver
  4. Use Eagle Net as the baseline network environment for this lab
    1. Start all machines

      NOTE: Depending on how long you take on this lab, some machines might enter sleep mode and become unusable. If this occurs, simply stop the machines in GNS3, then start them up again.

    2. Ensure that the Kali and Metaspolitable boxes are all able to receive IP addresses

Phase II – Scanning a Network

Now that you have verified or installed Zenmap, you will want to put it to use. Remember, Nmap is the actual tool, but Zenmap creates the GUI that can aid people in understanding the scan results.

  1. Start Zenmap

    zenmap

     

Figure 2 - Zenmap starts
Figure 2 – Zenmap starts
  1. We will scan our BLUE network
    1. TARGET: 200.200.200.0/24
    2. PROFILE: Quick Scan
      Figure 3 - our first scan
      Figure 3 – our first scan
    3. Notice that our selections automatically generate a Nmap scan command
    4. Press scan
    5. Soon you will have results displayed on the screen.  If your baseline network is working properly, you should have 4 hosts identified. Your IP addresses will be different, but your results should be similar to the figure
Figure 4 - our first scan results
Figure 4 – our first scan results

Phase III – Viewing and Interpreting Results

Zenmap provides the same tools as Nmap, but in a graphical format.  In this section we will look at the different views.

  • Nmap Output: Displayed by default which you saw in figure above
  • Ports/Hosts:
    • If you are looking at hosts, it shows the known ports of the host
    • If you are looking at services, it shows the known hosts running that service
  • Topology: An interactive view of the connections of the scanned hosts
  • Host details: Shows all known information of the host
  • Scans: All the commands used to create the scan results being viewed
  1. Nmap Output Tab:
    1. The Nmap output is the raw Nmap scan output that you would see if you ran Nmap instead of Zenmap. You can scroll up and down and take notes of hosts services and ports. Clicking on a host number such as 200.200.200.1, the text report will jump to that information without needed to scan
    2. Click on the top IP address for the host and watch the text ‘jump’ to that part of the text. In our example we are using 200.200.200.1
      Figure 5 - jumping to first host information
      Figure 5 – jumping to first host informatio
  2. Ports/Hosts Tab:
    1. Leave the first host selected and change the tab to Ports/Hosts and you can see the information for just that host without having to scroll through all the ‘noise’ of a text output of the entire scan results
      Figure 6 - look at ports
      Figure 6 – look at port
    2. Click on the Services tab
    3. Select ssh
    4. Now you can see all of the devices where ssh protocols were detected
      Figure 7 - look at services
      Figure 7 – look at services
  3. Topology Tab:
    1. You can see big jumble of symbols that are a little hard to read
      Figure 8 - topology tab
      Figure 8 – topology tab
    2. You can zoom in/out using the mouse wheel or by clicking on controls. Using the mouse wheel can take a while, depending on your mouse settings

      Figure 9 - topology tab with controls selected
      Figure 9 – topology tab with controls selected

       

      Figure 10 - topology zoomed in
      Figure 10 – topology zoomed in
    3. Each ring indicates a network hop.  Since we are only scanning a single subnet off of a router, we only have one hop and thus only one ring. Scanning live networks can get pretty busy
    4. Click on the Legend button and you can see what the different colors and symbols mean

      Figure 11 - topology legend
      Figure 11 – topology legend
      Figure 12 - topology legend zoomed in
      Figure 12 – topology legend zoomed in
    5. A full explanation of the topology legend can be viewed on Zenmap’s documentation
    6. If we click on host 200.200.200.1, the topology changes significantly
      Figure 13 - topology viewed from localhost
      Figure 13 – topology viewed from localhost
    7. Remember, we are performing a scan from our Kali VM, which is outside the network being scanned. So we can interpret the diagram in this way
      1. Host 200.200.200.1
        • Is one hop from us (Kali VM) in that we are on ring 1, and the host is in the center
        • Has 3 to 6 open ports
      2. Host 200.200.200.5
        •  Is one hop (router) from us, but from our perspective, it is two hops away (e.g., Kali VM –> (our hop to router) –>200.200.200.1 –> (router’s hop to host) –> 200.200.200.5)
        • Has more than 6 open ports
      3. Host 200.200.200.6
        • Is one hop (router) from us, but from our perspective, it is two hops away (e.g., Kali VM –> (our hop to router) –>200.200.200.1 –> (router’s hop to host) –> 200.200.200.6)
        • Has fewer than 3 open ports
      4. Host 200.200.200.7
        • Is one hop (router) from us, but from our perspective, it is two hops away (e.g., Kali VM –> (our hop to router) –>200.200.200.1 –> (router’s hop to host) –> 200.200.200.7)
        • Has more than 6 open ports
        • Has ports that are filtered from our scans
  4. Host Details Tab:
    1. Again, it gives us information on just one of the hosts without us needing to scroll through text
      Figure 14 - Host details
      Figure 14 – Host details
    2. It also gives us a couple of symbols to aid in our understanding
      • We are unsure what the OS is running on the host
      • There are 5-6 open ports
        Figure 15 - Host details legend
        Figure 15 – Host details legend
  5. Scans Tab: simply shows us a history of scans that, as we progress in our scans, we can click on and see the results
    Figure 16 - scan history
    Figure 16 – scan history
  6. Use this information to perform an intense scan on a target. In our example, we are targeting 200.200.200.5

Phase IV – Performing a targeted scan

At this point we have a good overview of our target network (reconnaissance) and now we want to perform a full investigation on a target (footprinting).

  1. Change the scan settings to the following:
    1. TARGET: 200.200.200.5
    2. PROFILE: Intense Scan
      Figure 17 - intense targeted scan
      Figure 17 – intense targeted scan
  2. Press the Scan button and let it run
  3. After a few minutes you will receive a few pages of information regarding IP routes, Operating System, etc., just like nmap
    Figure 18 - intense targeted scan results
    Figure 18 – intense targeted scan results
  4. Select the host 200.200.200.5 on the left and then click the Host Details tab. You can see that we have much more information about the host than we had before
    Figure 19 - intense targeted scan results
    Figure 19 – intense targeted scan results
  5. You are not limited to the default scans (though they are pretty good). Type nmap commands directly into the command line such as

    nmap -D RND:20 200.200.200.5

     

    Figure 20 - typing a manual command
    Figure 20 – typing a manual command
  6. Keep your target at 200.200.200.5, select the quick traceroute option, and press the Scan button
    Figure 21 - traceroute
    Figure 21 – traceroute
  7. Now select the Topology view and you can now see the blue line indicating the completed trace route
    Figure 22 - traceroute-topology
    Figure 22 – traceroute-topology

Career Connection

Network visualization and asset discovery are essential activities in enterprise operations, vulnerability management, and incident response. Network engineers use tools such as Zenmap to document infrastructure and troubleshoot connectivity, while cybersecurity professionals use the same capabilities to identify exposed services, validate security controls, and assess potential attack surfaces. The graphical interface provided by Zenmap makes reconnaissance results easier to interpret and communicate, supporting both technical investigations and enterprise network documentation.

 

End of Lab

Deliverables

Five screenshots are needed to earn credit for this exercise:

  • Screenshot of a subnet scan
  • Screenshot of a topology of the subnet
  • Screenshot of a targeted scan
  • Screenshot of the host details
  • Screenshot of the traceroute-topology

Homework

Assignment 1 – Perform a new targeted scan

Perform a targeted scan on the other vulnerable device. For example, if you performed the targeted scan on the Metasploitable Windows VM during the walk through, now target scan the Metasploitable Linux VM. Get as much evidence about the target as you can, such as open ports, operating system, software versions, etc.

RECOMMENDED GRADING CRITERIA: Same as the walk-through deliverables.

Assignment 2 – Add a VPCS to the blue environment

Daisy-chain a switch to the existing Blue network and add a VPCS to the new switch. Also add a vulnerable machine from VulnHub.  Conduct your scans until you at least identify the operating system. You will need to visit the nmap homepage to learn about various scans. Gather as much information as you can from the VPCS and the VulnHub machine. Make sure to discuss the results of your scans.

RECOMMENDED GRADING CRITERIA:

  • Screenshot of a topology of the subnet
  • Screenshot of host details – VulnHub
  • Screenshot of the host details – VPCS
  • Screenshot of the GNS3 Environment
Feedback email
Figure 00 – Contact us via prmaster@erau.edu

License

Icon for the Creative Commons Attribution-NonCommercial 4.0 International License

Mastering Enterprise Networks (3rd Ed) Copyright © 2026 by Mathew J. Heath Van Horn is licensed under a Creative Commons Attribution-NonCommercial 4.0 International License, except where otherwise noted.

Share This Book