Skip to main content

Host Discovery

Host discovery helps identify which hosts are live or reachable on a network. The key is to reduce scan scope and avoid wasting resources on dead hosts.

Disabling DNS Resolution

Useful in large-scale scans where DNS resolution would cause delay or where reverse DNS might alert network administrators - the -n flag disables DNS resolution, making the scan faster and less conspicuous by avoiding DNS lookups.

Grepping for a live IP list
nmap -sn 192.168.17.0/24 -oG - | grep "Status: Up" | awk '{print $2}'
192.168.17.1
192.168.17.10
192.168.17.20
192.168.17.100
192.168.17.101
192.168.17.103
192.168.17.104
192.168.17.105

Host Discovery Scan​

nmap -sn 192.168.1.0/24
  • Use Case: Useful for determining which hosts are online before performing more intensive scans. Varied scan traffic may bypass firewalls.
  • Why: -sn tells Nmap to only perform a host discovery, avoiding full port scans. Avoiding full port scans is ideal in large networks where you want to avoid overwhelming the network with detailed scanning traffic and reduce unnecessary data collection. Scan traffic includes ICMP echo requests, TCP packets to ports 80 and 443, and ARP requests.

ARP Discovery (Local Network)​

nmap -PR 192.168.1.0/24
  • Use Case: Best used within a local layer 2 network to accurately discover all live hosts in a subnet.
  • Why: ARP requests (-PR) are used at the Data Link layer, and are very reliable for discovering hosts on a local Ethernet network since ARP cannot be blocked by most firewalls on the same subnet.

ICMP Echo Request "Ping Sweep"​

nmap -PE 192.168.1.0/24
  • Use Case: The most basic host discovery scan using a simple ICMP echo request. May be blocked by firewalls.
  • Why: The -PE sends ICMP echo requests, similar to the ping command. This may look benign in some environments where pings are commonly expected.

IP to Hostname DNS Resolution​

nmap -sL --dns-servers 192.168.1.10 192.168.1.0/24 | grep "report for" | awk '{print $5 $6}'
  • Use Case: Useful when you know IP information about a network, but don't know associated hostnames.
  • Why: The -sL tells Nmap to only list the individual targets that it will scan without actually performing a scan - but by default Nmap will still try to resolve the IP to a hostname by attempting to retrieve the PTR record from the DNS server. --dns-servers lets us specify the DNS server we want to query.

TCP Syn Ping​

nmap -PS 80,443 192.168.1.0/24
  • Use Case: Useful in environments where ICMP is blocked but some common services are allowed.
  • Why: Sends a SYN packet to specified ports to see if hosts are responsive. This is often useful in enterprise environments where web services are accessible but ICMP echo requests are filtered.

UDP Ping​

nmap -PU 53,161 192.168.1.0/24
  • Use Case: Used when TCP discovery might be ineffective, especially when probing services commonly available over UDP, like DNS or SNMP.
  • Why: -PU sends UDP packets to discover hosts, often useful in discovering hosts that only respond to specific UDP services, e.g., DNS (port 53) or SNMP (port 161).