Questions before you install

Nmap is a free network scanner, not a malware bundle. The risk people hit is an antivirus false positive on ncat.exe, plus the chance of installing a file that is not the published build. Compare the SHA-256 of nmap-7.991-setup.exe with 93BFD37B DB31A7AD FD932BEB 5DBCE060 25DA691D 01A0939E 806EA704 F7367657 before you run it. Softonic's catalog marks the build they scanned as clean, and that catalog still lists 7.97, so it is not a check of the 7.991 file.

Yes. The Windows installer, the macOS disk image, the Linux RPM, and the source tarball for 7.991 are free downloads. Use and redistribution follow the Nmap Public Source License included with the source. There is no paid tier inside the scanner.

Yes. Official Windows binaries support Windows 7 and newer, and Windows Server 2008 R2 and newer. Windows 10 and Windows 11 are included. Use nmap-7.991-setup.exe, 36 MB. The setup installs Npcap, which raw scans need.

Engines usually flag ncat.exe, because Ncat can open a remote shell. The Nmap project has described that as a false positive and noted that PowerShell is not flagged for the same class of behavior. On a public multi-engine report for the older 7.91 installer, only a small number of engines marked the file. Later, that installer picked up a Microsoft Trusted Source mark on the same report. Hash 7.991 anyway. The steps are in the antivirus guide.

Npcap is the Windows packet capture driver Nmap uses for raw scans. Without it, you generally cannot scan your own machine with raw packets. A TCP connect scan with ping skipped, nmap -sT -Pn, uses normal sockets and can run without Npcap. Nmap 7.99 bundled Npcap 1.87. Npcap 1.89 is the newer driver release listed beside 7.991, and the copy inside the Nmap installer is not always that new.

Yes. The macOS package is nmap-7.991.dmg, 34 MB, x86-64, tested on Mac OS X 10.9 and later. Linux can use nmap-7.991-1.x86_64.rpm, 8.2 MB, or the 12 MB source tarball. Zenmap for recent releases is also a Python 3 wheel, zenmap-7.991-py3-none-any.whl, 970 KB.

Zenmap is the official GUI. It has a target box, profiles such as Quick scan and Intense scan, and a command field that shows the real nmap line before you press Scan. Tabs include Nmap Output, Ports / Hosts, and Topology. It works, and a lot of people also say the window looks dated. Version 7.96 added a dark mode toggle under Profile.

No. Scan hosts you own or have permission to test. Unauthorized scanning can violate computer-misuse law. The host in the screenshots on this site, scanme.nmap.org, is the project's practice target. Permission from the owner is the rule everywhere else.

nmap-7.991-setup.exe installs the Nmap command, an option to register Nmap on the PATH, Npcap, Zenmap, Ncat, and Ndiff. Nping is part of the suite. An older setup screenshot on the features page still shows WinPcap. Current installers use Npcap.

Without Npcap, Windows usually blocks a raw scan of 127.0.0.1 and of the PC's own addresses. Install Npcap from the setup, or run nmap -sT -Pn 127.0.0.1. That second command is a local socket check. It does not show how the PC looks from another machine.