TUTORIAL · 8 min read

The Recon Toolkit: Practical Nmap, Nessus and Wireshark Tips

Nmap, Nessus and Wireshark show up on nearly every engagement. Used carelessly they are slow and trip every sensor; used well they are a tight discovery-to-evidence loop. The tips that matter:

Nmap: scan smarter, not louder

Default scans waste time and alert everything watching.

Stage it: `-sn` host sweep, then `-p- --min-rate 1000` SYN scan, then `-sV -sC` only against open ports
`-sV --version-intensity 5` and `-O --osscan-guess` for fingerprinting; `--script vuln` sparingly
`-T3` on production, `-T4` in labs; `--max-retries 2 --host-timeout 30m` to stop stalls
Always `-oA` — the .xml and .gnmap output feed Nessus, Metasploit and your notes
Use authenticated NSE scripts (`--script-args`) for SMB, SNMP and HTTP enumeration

Nessus: the policy is the scan

Template choice decides finding quality far more than the target list.

Provide credentials — an unauthenticated scan misses most real findings
Disable DoS plugins, enable 'thorough tests' for pentests, throttle concurrent hosts on fragile networks
Focus reporting on Exploitable plus CVSS >= 7; verify manually before it goes in the report
Diff scans over time to prove remediation; export .nessus for the record

Wireshark: capture less, see more

A 4 GB pcap is where evidence goes to hide.

Capture filters (BPF) narrow at capture time — `host 10.0.0.5 and (port 80 or 443)`; use display filters to explore afterwards
Open `Statistics > Protocol Hierarchy` and `Conversations` first — find the flow before reading packets
`Follow > TCP/HTTP Stream` to reconstruct sessions; `File > Export Objects` to pull transferred files
For volume, capture with `dumpcap` / `tcpdump` and a ring buffer (`-b`), then analyse offline
Load `SSLKEYLOGFILE` to decrypt your own test traffic

Chain them into one loop

Nmap XML imports straight into Nessus and Metasploit; Nessus findings tell you what to prove; Wireshark captures the proof — and the scan's own side effects (RST floods, ICMP unreachables) that reveal filtering. One discovery-to-evidence loop, not three disconnected tools.

Tools mentioned

NmapNessusWiresharkdumpcaptcpdumpMetasploit

⟩ takeaway

Staged Nmap scans, credentialed and tuned Nessus policies, and filtered Wireshark captures turn three heavy tools into a fast, low-noise discovery-to-evidence workflow.

⟩ keep reading

Mobile Malware in 2026: How It Gets In and How to Stay Safer

Spyware, banking trojans and sideloaded RATs — how modern mobile malware lands on a device, the tools that detect it, and the habits that keep you off the target list.

Phishing Defense That Actually Works

AiTM kits, QR 'quishing' and callback scams beat old training. What actually lowers real risk: phishing-resistant auth, a detonation layer on the inbox, and drills that mirror current tradecraft.

Splunk Detection Tips: From Noisy Alerts to Real-Time Signal

SPL patterns, accelerated data models and tstats tricks that turn a slow, noisy Splunk into a near-real-time detection engine — with snippets you can paste in today.