Nmap and Network Scanning

  1. Host Discovery
    1. Purpose of Host Discovery
      1. Identifying Live Hosts
        1. Network Reconnaissance
          1. Reducing Scan Scope
          2. Network Mapping
            1. Topology Discovery
              1. Host Enumeration
            2. Disabling Port Scans (-sn)
              1. Ping Scan Only
                1. When to Use Host Discovery Only
                  1. Large Network Surveys
                    1. Initial Reconnaissance
                  2. Host Discovery Techniques
                    1. ICMP Echo Request (-PE)
                      1. Traditional Ping
                        1. Firewall Considerations
                        2. ICMP Timestamp Request (-PP)
                          1. Alternative ICMP Method
                            1. Bypassing Echo Blocks
                            2. ICMP Address Mask Request (-PM)
                              1. Legacy ICMP Method
                                1. Limited Modern Use
                                2. TCP SYN Ping (-PS)
                                  1. TCP-Based Discovery
                                    1. Specifying Ports for SYN Ping
                                      1. Default Ports
                                        1. Custom Port Selection
                                        2. Firewall Evasion
                                        3. TCP ACK Ping (-PA)
                                          1. Stateful Firewall Bypass
                                            1. Specifying Ports for ACK Ping
                                              1. Common Open Ports
                                                1. Service-Specific Ports
                                              2. UDP Ping (-PU)
                                                1. UDP-Based Discovery
                                                  1. Specifying Ports for UDP Ping
                                                    1. Closed Port Strategy
                                                      1. Service Port Targeting
                                                    2. SCTP INIT Ping (-PY)
                                                      1. SCTP Protocol Discovery
                                                        1. Specialized Use Cases
                                                        2. ARP Ping (-PR)
                                                          1. Local Network Discovery
                                                            1. ARP vs IP-based Discovery
                                                              1. Layer 2 vs Layer 3
                                                                1. Local Subnet Efficiency
                                                              2. IPv6 Discovery
                                                                1. ICMPv6 Neighbor Discovery
                                                                  1. IPv6 Multicast Ping
                                                                2. Disabling Host Discovery (-Pn)
                                                                  1. Assume All Hosts Are Up
                                                                    1. Rationale for Skipping Discovery
                                                                      1. Heavily Filtered Networks
                                                                        1. Known Live Hosts
                                                                        2. Risks and Use Cases
                                                                          1. Increased Scan Time
                                                                            1. False Positive Reduction
                                                                          2. Custom Discovery Combinations
                                                                            1. Multiple Discovery Methods
                                                                              1. Discovery Method Selection
                                                                                1. Performance Optimization

                                                                              Previous

                                                                              3. Nmap Fundamentals

                                                                              Go to top

                                                                              Next

                                                                              5. Core Port Scanning Techniques