Find Oracle databases with Nmap

Find Oracle database instances on your network with Nmap, a free network scanning tool, including any that are not tracked in your asset register.

• A machine with Nmap installed (download here)
• Network access to the IP ranges you want to scan
• Administrator or root privileges on the scanning machine (required for the most effective scan type)
• The IP range(s) you want to scan, check with your network team if unsure

Oracle databases advertise themselves via a TNS Listener process. By default this runs on specific network ports. Your scan needs to check all of them:

TipDBAs sometimes configure listeners on non-standard ports to avoid conflicts or for security reasons. If you suspect this, run a broader scan on the port range 1500–1600 as a follow-up step.

Before scanning for Oracle ports, identify which hosts are actually online. This makes the subsequent scan significantly faster.

# Replace 10.0.0.0/24 with your network range
nmap -sn 10.0.0.0/24 -oN live_hosts.txt

This creates a file live_hosts.txt containing only the hosts that responded. You can feed this into the next step.

Run the core scan against all Oracle ports. This command checks all five Oracle ports, identifies the service version, and saves the results to a file.

# Scan a full subnet
nmap -sV -p 1521,1522,1526,2483,2484 --open -T4 -oN oracle_scan.txt 10.0.0.0/24

# Or use your live hosts file from step 1
nmap -sV -p 1521,1522,1526,2483,2484 --open -T4 -oN oracle_scan.txt -iL live_hosts.txt

Once you have a list of IPs with open Oracle ports, you can query each listener for its registered database service names and SIDs. Run this against each IP you found:

# Get Oracle version from the listener
nmap -sV -p 1521 --script oracle-tns-version 10.0.0.50

# Enumerate registered SIDs (database names)
nmap -p 1521 --script oracle-sid-brute 10.0.0.50

The oracle-tns-version script returns the Oracle version (e.g. 19c, 12.2). The oracle-sid-brute script attempts to identify the database SID, useful for confirming which database instance is running.

Review and reconcile results

Open your oracle_scan.txt output file. For each host with an open Oracle port, record:

• IP address and hostname (if resolvable)
• Port number the listener is using
• Oracle version (from -sV or the oracle-tns-version script)
• SID or service name (from oracle-sid-brute)

Compare this list against your known asset register to identify untracked instances.

Each host in the nmap output will show one of three port states:

Filtered portsA filtered result on port 1521 often means an Oracle listener exists but is protected by a host-based firewall. These hosts are worth following up with your DBA or network team.

If you suspect Oracle instances are running on non-standard ports, run a broader scan on the port range DBAs commonly use:

# Broader scan for non-standard Oracle ports
nmap -sV -p 1500-1600 --open -oN oracle_nonstandard.txt 10.0.0.0/24

Review any open ports in this range with your DBA team to confirm whether they relate to Oracle.