Host discovery and port states
Find live hosts, then mark ports open, closed, or filtered. TCP SYN, TCP connect, and UDP scans are the everyday set. Port scan types
Version 7.991 · 6 August 2026
See your network with greater clarity.
Explore active devices, examine open ports, and identify network services with Nmap's established discovery and security-auditing tools.
Nmap 7.991 is the current free network scanner. It shows which machines answer, which TCP and UDP ports are open or closed, and, when version detection is on, the service name on those ports. Test only hosts you are permitted to scan.
These five rows are the Quick scan of the project's practice host. The Ports / Hosts window is on the features page.
What Nmap is
A host and service map, not a packet recorder
Nmap sends probes to learn which hosts are up, which ports accept traffic, which application and version is listening, and often which operating system the stack resembles. It is built for one host or for a large network you administer. Zenmap is the window. Ncat moves data. Ndiff compares two saved scans. Nping builds packets and shows the replies.
Open means an application accepted the probe. Closed means the host answered and nothing is listening. Those states are the filled and hollow marks in the sheet above. Zenmap's Ports / Hosts tab, topology ring, profile editor, and the older setup window live on the features page.
- Windows filenmap-7.991-setup.exe
- Size36 MB
- LicenseNmap Public Source License
- SHA-256 prefix93BFD37B DB31A7AD
In 7.991
What this release actually includes
Each row is a real part of the suite. Longer notes, screenshots, and flags are on the features page.
Version and OS detection
-sV reads a service banner. -O guesses the operating system. The 7.99 release added a large batch of IPv4 and IPv6 OS fingerprints. Version detection
NSE, 620 scripts
The Nmap Scripting Engine in 7.991 ships 620 scripts. A script that runs more than 5 seconds without yielding is stopped. NSE limits
Zenmap, Ncat, Ndiff, Nping
Profiles such as Quick scan and Intense scan fill in the real command before you press Scan. The rest of the suite
Who it is for
Three jobs people open Nmap to finish
Network inventory
List hosts that answer on a subnet you manage before you walk the racks or update a spreadsheet. A ping scan (-sn) or a Quick scan is the usual start.
Upgrade schedules
Version detection returns strings such as an OpenSSH or httpd version, so you can see which machines still run an old service. That is the use behind the service column in Zenmap.
Change checks
Save a scan, run it again later, and compare the two files with Ndiff. People use that to notice a new host or a port that was closed last week.
Same shelf, different job
Nmap beside Zenmap, Wireshark, and Masscan
Zenmap is not a second scanner. It is the window in front of Nmap. Wireshark records packets. Masscan is a fast port scanner for very large address lists and does not replace version detection or NSE.
| Criterion | Nmap | Zenmap | Wireshark | Masscan |
|---|---|---|---|---|
| Price | Free | Free, included | Free | Free |
| Primary job | Host, port, and service map | GUI and result viewer for Nmap | Capture and inspect packets | Very fast TCP scans of large ranges |
| TCP port scan | Yes, including SYN and connect | Runs Nmap's scans | No | Yes, aimed at speed |
| UDP port scan | Yes | Runs Nmap's scans | No | Not its main job |
| Service version | Yes, -sV | Shows Nmap's version column | You read the payload yourself | No |
| OS detection | Yes, -O | Shows Nmap's OS notes | No | No |
| Scripting | 620 NSE scripts in 7.991 | Can pass NSE choices | No | No |
| Best fit | Inventory and authorized audits | Seeing the command and the topology | A host you already decided to inspect | Huge address lists, then a deeper tool |
Before you run the file
Check the installer, then decide
The Windows file is nmap-7.991-setup.exe, 36 MB, dated with the 6 August 2026 release. The project publishes SHA-256 and a detached signature for that file. Some antivirus engines flag ncat.exe because Ncat can open a remote shell. That pattern is a known false positive, not a reason to skip the hash.
Published catalog scores, not a rating collected on this site: Softonic lists 3.8 out of 5 from 190 reviews and still shows version 7.97. TrustRadius lists 8.7 out of 10 from 48 reviews. Use 7.991 as the current release.
SHA-256 · nmap-7.991-setup.exe
93BFD37B DB31A7AD FD932BEB 5DBCE060 25DA691D 01A0939E 806EA704 F7367657
If your copy does not match, do not run it. The download page also lists size and date for the macOS image and the source tarball.
Field notes
How people describe a normal week with it
Pause the row by hovering or focusing it. These lines are paraphrased from public review themes, not a star widget.
"I use the Quick scan profile when a new VLAN shows up. Zenmap prints nmap -T4 -F and the Ports / Hosts tab is enough to see what answered."
"Version detection is the part I keep. On a lab web server it named the httpd instead of just saying port 80 was open. I still keep the timing template at T3 on anything that is not a lab."
"The topology ring is handy when I have to show a subnet to someone who will not read a port table. The rest of Zenmap looks like a 2009 desktop program, which it basically is. I do the careful scans in the terminal."
"Windows 11 install went through Npcap. Defender complained about ncat.exe. I hashed nmap-7.991-setup.exe, it matched the published SHA-256, and I continued. I would not have continued on a mismatch."
"UDP is slow and I still run it when the inventory has to include DNS. TCP-only would have missed the name server on that last site survey."
Short answers
Questions people ask before they install
Is the Nmap download free?
Yes. Version 7.991 is a free download for Windows, macOS, and source. Redistribution follows the Nmap Public Source License shipped with the source tarball.
Does Nmap run on Windows 11?
Yes. Official Windows binaries support Windows 7 and newer, and Windows Server 2008 R2 and newer. That includes Windows 10 and Windows 11. The installer includes Npcap.
Why does antivirus flag the installer?
Engines often flag ncat.exe, because Ncat can open a remote shell. Compare the SHA-256 above before you allow the file. Steps are in the antivirus guide.
Is scanning legal?
Only on hosts you own or have permission to test. Unauthorized scanning can break computer-misuse law. The practice host in the screenshots is scanme.nmap.org.
Pick up the 7.991 packages
Windows setup is 36 MB. The macOS disk image is 34 MB. The bzip2 source tarball is 12 MB. Hashes and system requirements are on the download page.