Useful nmap commands: (Replace 192.168.25.0/24 with IP/netmask of subnet to scan) Info (open ports, OS, etc) about all ports on a subnet sudo nmap 192.168.25.0/24 -sS -O sudo nmap 192.168.25.0/24 -A -T4 # slower, more info Just look for open ssh ports (22) or web servers (80 or 443) nmap 192.168.25.0/24 -p 22 --open -sV