Skip to content
Glowing cyan eye mark used as the Nmap emblem Nmap
Download
Download 7.991

Windows and Zenmap

When the install or the scan misbehaves

These steps come from repeated Windows reports: antivirus flags on Ncat, Npcap driver trouble, scans of 127.0.0.1, and Zenmap closing when a profile is saved. They apply to the 7.991 installer unless a step names an older bug that the release already fixed.

Scan only hosts you are allowed to test. The practice host shown in the screenshots is scanme.nmap.org.

Antivirus flags ncat.exe

Nmap is not a virus pack. Ncat, which the Windows setup installs, can connect a program to a socket. That is why some engines alert. Hash the installer first.

  1. Download nmap-7.991-setup.exe and do not run it yet.
  2. Compute SHA-256 and compare it with 93BFD37B DB31A7AD FD932BEB 5DBCE060 25DA691D 01A0939E 806EA704 F7367657 on the download page.
  3. If the hash does not match, delete the file. Do not make an exception in the antivirus product.
  4. If the hash matches and the product still flags ncat.exe, that matches the known false-positive pattern. You can report the file to the antivirus vendor.
  5. After the hash matches, you can also check the signature. The project signs Windows installers and executables with an EV certificate for Insecure.Com LLC.
  6. Do not turn off real-time protection for the whole PC as the usual fix. Allow this installer only.

Npcap will not install or will not open a device

Raw scans on Windows need Npcap. The copy inside the Nmap installer can lag the standalone Npcap release. 7.99 bundled 1.87. The latest Npcap release noted next to Nmap 7.991 is 1.89.

  1. Run nmap-7.991-setup.exe and leave the Npcap option checked.
  2. If a scan says it cannot open a device, install Npcap again from that same setup.
  3. If the adapter is still missing, install Npcap 1.89, the newer driver release, and reboot.
  4. PPPoE links improved when 7.98 moved Npcap from 1.82 to 1.83. VPN TAP adapters improved in 7.99. If you are on an older Nmap, update to 7.991 instead of stacking workarounds.
  5. With no Npcap at all, a TCP connect scan can still run: nmap -sT -Pn against a host you may test. It uses normal sockets, not raw packets.

Related feature notes: TCP connect versus SYN.

Install on Windows 10 or 11

  1. Confirm the PC is Windows 7 or newer, or Windows Server 2008 R2 or newer. Windows 10 and 11 are in that range.
  2. Check the SHA-256 of nmap-7.991-setup.exe.
  3. Run the setup. Keep Nmap core files, Register Nmap Path, Npcap, Zenmap, Ncat, and Ndiff selected.
  4. Open Zenmap from the Start menu, or open a new Command Prompt and run nmap.
  5. If the prompt says nmap is not recognized, the PATH was not registered. Reinstall with that box checked, then open a new prompt. An old window keeps the old PATH.
  6. If Zenmap crashes as soon as a scan starts and the Windows locale uses a non-Latin character set, you are probably on a build older than 7.97. Install 7.991.

A scan of this PC returns nothing

Windows often cannot raw-scan 127.0.0.1, or the PC's own LAN address, unless Npcap is installed. That is a platform limit the Npcap driver works around.

  1. Install Npcap from the Nmap setup.
  2. Scan 127.0.0.1 again from Zenmap or the command line.
  3. If Npcap still will not load, run nmap -sT -Pn 127.0.0.1.
  4. Read the result as a local check only. It does not describe how the host looks from another machine.

Zenmap closes or will not save a profile

The Profile Editor has tabs for Profile, Scan, Ping, Scripting, Target, Source, Other, and Timing. The Other tab sets verbosity (-v). That window is on the features page. Several crash bugs in this editor were fixed in 7.98 and 7.991.

  1. Install 7.991. Saving a profile that contains a percent sign used to crash the editor. That case is fixed.
  2. If Zenmap dies when Nmap itself fails, 7.98 fixed "ValueError: I/O operation on closed file".
  3. A KeyError: 'vl_6_logo' crash and a DuplicateSectionError in the profile editor are also fixed in 7.991.
  4. Dark mode is Profile, then Toggle Dark Mode. It arrived in 7.96.
  5. Read the Command field before you press Scan. The profile only fills in an nmap command.

Screen tour: Zenmap on the features page.

Habits worth keeping

  • Write down who approved the scan before you start.
  • Start with -sn or a short port list (-F) on a lab host.
  • Stay on T2 or T3 on a production LAN. The Quick scan profile uses T4, which is faster and noisier.
  • Save XML with -oX if you will compare the run later in Ndiff.
  • Keep the installer hash next to the change record for that maintenance window.

Read the FAQ

AboutPrivacy PolicyTerms & Conditions