Install Nmap on Rocky Linux 8
If you’ve just spun up a fresh Rocky Linux 8 box or survived a messy repo upgrade that left your network tools in limbo, this guide will get Nmap back in action fast. You’ll see why updating the package list matters, how to pull the scanner from the default repos, and a couple of real‑world scan examples that actually help you spot rogue services.
Update the repository cache – don’t skip it
sudo dnf check-update
Running check-update forces DNF to refresh its metadata. I’ve watched people try to install Nmap straight away after a kernel patch, only to hit “Package not found” because the cache was still pointing at an old mirror. A quick refresh clears that up and makes sure you get the newest version the repo offers.
If your system is missing the dnf-utils package (it’s optional but handy for troubleshooting), grab it now:
sudo dnf install dnf-utils
Pull Nmap from Rocky’s base repository
Rocky ships Nmap in its standard repos, so you don’t need any third‑party sources. Installing it is as simple as:
sudo dnf install nmap
The dnf command resolves dependencies automatically; if anything conflicts, DNF will warn you before it proceeds. Once the installation finishes, verify that the binary landed where it should:
nmap --version
You should see something like “Nmap version 7.80” (or newer). If you get a “command not found,” double‑check that /usr/bin is still in your $PATH; I’ve seen this happen after a custom shell configuration went rogue.
Quick scan examples that actually tell you something
A common first step is to discover every host on your local subnet and ask Nmap to guess the service versions. The -sV flag does the heavy lifting:
nmap -sV 192.168.1.0/24
Why -sV? Without it you’d only get open ports, but no clue what’s listening behind them. In my home lab this command revealed an old FTP server still running on port 21 that I’d forgotten to decommission.
If you just need a list of live hosts, drop the version detection:
nmap -sn 192.168.1.0/24
The -sn (ping scan) is fast and won’t trigger IDS alarms as aggressively as a full port sweep.
Targeting a single machine? Here’s how to dump every open TCP port:
nmap 192.168.1.100
And if you’re hunting for a specific service, say a web server on port 80, narrow it down:
nmap -p 80 192.168.1.100
The -p option tells Nmap “don’t waste time on the rest of the ports.” It’s a neat trick when you’re troubleshooting a misbehaving website and need to confirm the port is actually listening.
A few gotchas worth mentioning
- SELinux – If you run into permission errors, make sure SELinux isn’t blocking Nmap from sending raw packets. setenforce 0 (temporarily) can help isolate the issue.
- Firewalls – Rocky’s default firewalld may drop your probes. Adding a rule like firewall-cmd --add-port=80/tcp --permanent && firewall-cmd --reload lets you see results without turning the whole wall off.
That’s it. Nmap is now installed, verified, and ready to sniff out anything odd on your network.
