The law sits in the fine print, but the source code tells a bigger story. Nmap, the open-source network scanning tool, is released under a unique dual-licensing model that blends the GNU General Public License (GPL) with additional usage terms. This model is designed to protect Nmap’s integrity, prevent misuse in proprietary scanners, and ensure the tool remains free for security research, education, and legitimate operational use.
At its core, Nmap’s license is GPLv2. That means you can run, study, share, and modify it, provided that any distributed modifications are also open under the same terms. The GPL helps guarantee freedom for the code and its users. But Nmap’s authors add important clauses that go beyond stock GPL. These clauses restrict the integration of Nmap or its code into proprietary products without permission. The goal is to stop companies from embedding Nmap’s engine into commercial scanners or closed-source security products without sharing their own source code.
This approach creates a balance. Developers and organizations can use Nmap freely for testing, security audits, and operational monitoring. Commercial vendors can also use it—but must either comply with the GPL’s reciprocity or obtain a separate commercial license from the Nmap Project. The commercial license removes the copyleft requirement, enabling proprietary use for a fee, while funding ongoing development.