The Exploit HQ

Nmap for Beginners · lesson 4 · 2026-08-17 · updated 2026-10-12

Nmap for Beginners: Scan Your Whole Home Network (Part 4)

Before you start

Welcome back to The Exploit HQ. This is part four of our beginner Nmap series, and as always, you need zero experience to follow along.

Let’s remember our journey. In part one, we found the open doors on a computer. In part two, we learned what software was running behind them. And in part three, we learned what open, closed, and filtered doors mean.

Today we take a big step. Instead of scanning just one computer, we will scan many at once. And here is the exciting part. We will scan a real network, your own home network, safely.

This matters, because in real life you check many computers, not just one. And your own home network is the perfect, safe place to practice.

As always, we begin at the very start. Open the terminal window.

And remember, when you see the prompt, the short line that ends in a dollar sign, the computer is ready for you to type.

So far, every scan has looked at one computer at a time, our friendly practice server, scanme dot nmap dot org.

Let’s run it once more as a quick warm up. Type, nmap, space, scanme dot nmap dot org, and press Enter.

nmap scanme.nmap.org

There is our familiar result, a few open doors on that one server. Now let’s go bigger, and look at a whole network.

Every home has a small network. Your router, your phones, your laptops, maybe a smart TV, all connected together.

On most home networks, every device has an address that begins with, one ninety two dot one sixty eight. Yours very likely does too.

Nmap can look at that whole network at once. Let’s begin by simply finding every device that is switched on.

We will use a new option, dash s n. That tells Nmap, just find which devices are alive. Do not knock on their doors yet. Think of it as a quick roll call.

We will also add dash n. That tells Nmap to show plain numbers instead of device names. It is faster, and it keeps everyone’s device names private.

And to mean the whole network, we write our address, then slash twenty four. That slash twenty four is simply a shortcut for, this entire local network.

One more piece, and it is a genuinely useful trick. We will leave our own computer out of the scan, using dash dash exclude, then its address. That is perfect for skipping a machine you do not own, or one you just do not need to scan.

Type it with me now. nmap, space, dash s n, space, dash n, space, dash dash exclude, space, one ninety two dot one sixty eight dot one dot thirty nine, space, one ninety two dot one sixty eight dot one dot zero, slash, twenty four. Press Enter.

nmap -sn -n --exclude 192.168.1.39 192.168.1.0/24

Look at that. Nmap quietly checked the whole network and listed every device that answered, shown as clean numbers, with our own computer left out, exactly as we asked.

That is a real map of a real home network. And notice, there are no names here, only addresses. Tidy, and private.

Now that we can see our devices, let’s actually check the doors on a couple of them.

We will pick two. Our router, which is almost always at address one, and one other device on the network. We will scan them together, as a list, separated by a space.

We will also add dash, capital F. That means a fast scan. It checks the hundred most common doors instead of a thousand, so we get our answers quickly.

nmap, space, dash n, space, dash capital F, space, one ninety two dot one sixty eight dot one dot one, space, one ninety two dot one sixty eight dot one dot two hundred. Press Enter.

nmap -n -F 192.168.1.1 192.168.1.200

Here is the real payoff of a list. Nmap gave us a separate report for each device, one after the other.

And look how different they are. Our router has doors eighty and four forty three open. Those are the doors for web pages, which is how you reach its settings screen.

The other device shows a completely different set of open doors. Every device has its own personality, its own open doors, and now you can see them side by side.

Listing devices one by one is great for a few. But what if you want a whole row of addresses at once?

That is where a range comes in. You write the first address, then a dash, then just the last number.

We will check doors eighty and four forty three across the first six addresses. Adding dash p, space, eighty comma four forty three tells Nmap to check just those two doors, to keep things quick.

nmap, space, dash n, space, dash p, space, eighty comma four forty three, space, one ninety two dot one sixty eight dot one dot one, dash, six. Press Enter.

nmap -n -p 80,443 192.168.1.1-6

Nmap checked all six addresses in one single command. Most had those doors closed, while our router had them open. One short line, a whole row of computers.

Here is one last handy trick, perfect for when you scan the same devices again and again. Save your targets in a file, and point Nmap at the file.

Let’s save our router’s address into a file called, my targets dot t x t. Type, echo, space, one ninety two dot one sixty eight dot one dot one, space, the greater than sign, space, mytargets dot t x t. Press Enter.

echo 192.168.1.1 > mytargets.txt

That greater than sign simply means, save this into a file. Notice there was no output. That is perfectly normal. It quietly did its job.

Let’s peek inside the file, just to be sure. Type, cat, space, mytargets dot t x t, and press Enter.

cat mytargets.txt

The cat command shows us what is inside a file. And there it is, our router’s address, saved and ready.

Now we read it with a new flag, dash, capital I, capital L. A nice way to remember it is, input list. It tells Nmap, read the targets from this file.

nmap, space, dash n, space, dash p, space, eighty comma four forty three, space, dash capital I capital L, space, mytargets dot t x t. Press Enter.

nmap -n -p 80,443 -iL mytargets.txt

And there we go. Nmap opened the file, found the address inside, and scanned it. With a bigger file, it would scan every device listed inside.

Now, our golden rule, and it matters more here than anywhere.

You may scan your own network, exactly like we just did, or a network you have clear, explicit permission to test. Scanning a network that is not yours is not allowed. Your own home network is always the perfect place to practice.

Let’s go over what you learned today.

To find every device, you scan the whole network with slash twenty four, using dash s n for a quick roll call, and dash n to keep it clean and private.

To leave a machine out, you use dash dash exclude. To scan several devices, you list them with spaces, or use a range with a dash. And to reuse a group, you save them in a file and read it with dash, capital I, capital L.

Take your time, and try these gently on your own network at home. Watching your real devices appear is what makes it all click.

In the next tutorial, part five, we will make our scans faster and more focused. How to check just the doors you care about, and get your results in a fraction of the time.

Thanks for learning with The Exploit HQ. I will see you in part five.