Host Discovery

The Discovery Phase

Every scan runs in two phases: find which hosts are up, then scan ports on the survivors. Discovery exists to avoid wasting probes on dead addresses. Default probes as root are ICMP echo, TCP SYN to 443, TCP ACK to 80, and an ICMP timestamp request. As a normal user it is a TCP connect to 80 and 443.

sudo nmap -sn 10.0.0.0/24          # discovery only, no port scan
nmap -Pn 10.0.0.5                  # skip discovery, assume up
nmap -sL 10.0.0.0/24               # neither, just expand the target list
sudo nmap -sn -PE -PS443 -PA80 10.0.0.0/24   # explicit probe set

-Pn is the flag that matters in practice. Hosts behind a firewall that drops ICMP look down to discovery, so nmap never scans their ports. If a target you know exists reports "host seems down", add -Pn.

Probe Types

Each -P* option adds one probe. Combine several so one filtered protocol does not hide the host. Ports attach directly to the flag with no space.

sudo nmap -sn -PE -PP -PM 10.0.0.0/24            # all three ICMP types
sudo nmap -sn -PS22,80,443,3389 10.0.0.0/24      # SYN to common services
sudo nmap -sn -PU53,123,161 10.0.0.0/24          # UDP to DNS, NTP, SNMP
sudo nmap -sn -PO1,6,17 10.0.0.0/24              # ICMP, TCP, UDP protocol ping

ARP on the Local Network

On a directly connected subnet nmap ignores your -P* choices and uses ARP, because ARP cannot be firewalled by the host and a missing reply is definitive. This is why local sweeps finish in a second and remote sweeps do not.

sudo nmap -sn 192.168.1.0/24              # ARP sweep, sub-second
sudo nmap -sn --disable-arp-ping 192.168.1.0/24   # force ICMP and TCP instead
sudo nmap -sn -PR 192.168.1.0/24          # ARP explicitly

ARP discovery also fills in MAC addresses and vendor names from the OUI table, which is often the fastest way to identify what is on a network:

Nmap scan report for 192.168.1.14
Host is up (0.0031s latency).
MAC Address: B8:27:EB:1A:2B:3C (Raspberry Pi Foundation)

Traceroute and Topology

--traceroute runs after the scan and reuses the best port it already found, so it works where a plain traceroute to a closed port is blocked.

sudo nmap -sn --traceroute example.com
sudo nmap -Pn -p 443 --traceroute example.com
sudo nmap -sn --traceroute 10.0.0.0/24 -oX topo.xml

Traceroute here counts hops down from a high TTL rather than up from 1, which means fewer packets and it reads bottom-up in the output.

Practical Sweeps

Discovery output is most useful piped into the next tool. Grepable output makes a live-host list in one line.

# live hosts on a /24, one IP per line
sudo nmap -sn -n 10.0.0.0/24 -oG - | awk '/Up$/{print $2}' > live.txt

# then port scan only those
sudo nmap -sS -p- -iL live.txt -oA fullscan

# find hosts that answer nothing but still serve a web port
sudo nmap -Pn -p 80,443 --open 10.0.0.0/24

# discovery across two ranges, DNS off, high parallelism
sudo nmap -sn -n -T4 --min-hostgroup 256 10.0.0.0/16 172.16.0.0/16