Host Discovery with NMAP

3 min readOct 4, 2019

Ping Sweep

To perform a scan of hosts on a network and do not port scan after host discovery you would do:

sam@asus:~% nmap -sn 192.168.0.1/24Starting Nmap 7.01 ( https://nmap.org ) at 2019-10-03 10:06 MDT
Nmap scan report for acme.com (192.168.0.1)
Host is up (0.013s latency).
Nmap scan report for 192.168.0.38
Host is up (0.0022s latency).
Nmap done: 256 IP addresses (2 hosts up) scanned in 2.66 seconds
sam@asus:~%

nmap only reports host that are alive.

No Ping Scan

To skip host discovery and not issue a ping scan you would issue the nmap command:

sam@asus:~% nmap -Pn 192.168.0.1/24Starting Nmap 7.01 ( https://nmap.org ) at 2019-10-03 10:07 MDT
Nmap scan report for 192.168.0.0
Host is up (0.000015s latency).
All 1000 scanned ports on 192.168.0.0 are filteredNmap scan report for acme.com (192.168.0.1)
Host is up (0.0083s latency).
Not shown: 995 closed ports
PORT      STATE    SERVICE
53/tcp    open     domain
80/tcp    open     http
8080/tcp  filtered http-proxy
49152/tcp open     unknown
49153/tcp open     unknownNmap scan report for 192.168.0.2
Host is up (2.8s latency).
All 1000 scanned ports on 192.168.0.2 are filtered
sam@asus:~%

As you can see nmap reported back with hosts up and ports open on the remote hosts. This is good is you have a list of targets that you already know is up and want to skip the host discovery phase of the nmap scan.

TCP SYN Packet

Nmap give you the ability to send an empty tcp SYN packet to the host to try an estbalish a connection on the specified port. Nmap will send the tcp syn packet to port 80 by default. The ‘-sn’ is used to do a ping sweep on the remote host.

sam@asus:~% nmap -sn -PS 48.21.33.124Starting Nmap 7.01 ( https://nmap.org ) at 2019-10-03 10:34 MDT
Nmap scan report for srv01.acme.com (48.21.33.124)
Host is up (0.00016s latency).
Nmap done: 1 IP address (1 host up) scanned in 0.00 seconds
sam@asus:~%

NMAP reported back that the host is indeed up.

TCP ACK Packet

The TCP ACK packet is just like the SYN except it sends an ACK packet. Nmap will send the tcp ACK packet to port 80 by default.

sam@asus:~% nmap -sn -PA 48.21.33.124Starting Nmap 7.01 ( https://nmap.org ) at 2019-10-03 10:38 MDT
Nmap scan report for srv01.acme.com (48.21.33.124)
Host is up (0.00016s latency).
Nmap done: 1 IP address (1 host up) scanned in 0.01 seconds
sam@asus:~%

Here nmap sends an empty ACK packet to the host trying to recive a RST packet acknowledging that the service is existent on the remote host.

UDP Packets

This will send a UDP packet to a given port. By default nmap uses udp port 40 and 125.

root@asus:~% nmap -sn -PU 48.21.33.124Starting Nmap 7.01 ( https://nmap.org ) at 2019-10-03 13:52 MDT
Nmap scan report for srv01.acme.com (48.21.33.124)
Host is up.
Nmap done: 1 IP address (1 host up) scanned in 0.00 seconds
root@asus:~%

Here we specify the ‘-sn’ option telling nmap we do not want to do a port scan and just query the ports specified.

ICMP Pings

Nmap can send ping probes just like the ping command line utility. The types of ICMP pings nmap can send are: Echo (type 8),Timestamp (13) and address mask (17).

ICMP Echo

root@asus:~% nmap -sn -PE 48.21.33.124Starting Nmap 7.01 ( https://nmap.org ) at 2019-10-03 14:51 MDT
Nmap scan report for srv01.acme.com (48.21.33.124)
Host is up.
Nmap done: 1 IP address (1 host up) scanned in 0.00 seconds
root@asus:~%

ICMP Timestamp

root@asus:~% nmap -sn -PP 48.21.33.124Starting Nmap 7.01 ( https://nmap.org ) at 2019-10-03 14:52 MDT
Nmap scan report for srv01.acme.com (48.21.33.124)
Host is up.
Nmap done: 1 IP address (1 host up) scanned in 0.00 seconds
root@asus:~%

ICMP Address Mask

root@asus:~% nmap -sn -PM 48.21.33.124Starting Nmap 7.01 ( https://nmap.org ) at 2019-10-03 14:52 MDT
Nmap scan report for srv01.acme.com (48.21.33.124)
Host is up.
Nmap done: 1 IP address (1 host up) scanned in 0.01 seconds
root@asus:~%

IP Protocol Ping

The IP Protocol Ping sends IP packets with the specified protocol number set in their IP header.

root@asus:~% nmap -sn -PO 48.21.33.124Starting Nmap 7.01 ( https://nmap.org ) at 2019-10-03 15:03 MDT
Nmap scan report for srv01.acme.com (48.21.33.124)
Host is up.
Nmap done: 1 IP address (1 host up) scanned in 0.01 seconds
root@asus:~%

https://cxyy4rle.blogspot.com/2019/10/host-discovery-with-nmap.html