Host Discovery

Before scanning ports, you need to know which hosts are alive. Host discovery (also called ping scanning) identifies responsive systems on a network so you do not waste time scanning dead addresses.

Nmap is the industry-standard tool for this and for nearly all network scanning tasks.

The -sn flag performs a ping sweep: it checks which hosts respond without scanning any ports. It is fast and ideal for mapping a subnet first.

By default (with privileges) Nmap sends a mix of probes to local and remote hosts:

• ICMP echo request (a classic ping).
• TCP SYN to port 443.
• TCP ACK to port 80.
• ICMP timestamp request.

If any probe gets a response, the host is marked up. Using several probe types defeats many filters.

Nmap accepts flexible target syntax: single IPs, CIDR ranges, hyphenated ranges, hostnames, or a file list.

You can choose specific probe types when defaults are filtered:

• -PS TCP SYN to listed ports.
• -PA TCP ACK to listed ports.
• -PU UDP probe.
• -PE ICMP echo.

Tuning probes helps when firewalls block the defaults.

Many firewalls drop ICMP, making hosts look down. The -Pn flag tells Nmap to skip discovery and treat every target as up, scanning ports directly.

This is essential against hardened networks, though it is slower because Nmap scans hosts that may truly be offline.

On a local Ethernet segment, Nmap uses ARP requests for discovery, which is faster and more reliable than ICMP because hosts cannot easily ignore ARP.

Nmap does this automatically for local targets when run with privileges. The -PR flag forces ARP discovery explicitly.

The list scan -sL does no probing at all. It simply lists the targets Nmap would scan and performs reverse-DNS lookups.

It is the stealthiest option and a great way to sanity-check your target range and discover hostnames before sending any packets.

Discovery output reports each host as up or omits hosts that are down. With ARP or DNS, you may also see MAC addresses (and vendor) and hostnames.

This list becomes the input for the next phase: detailed port scanning of only the hosts that are actually alive.

Discovery generates traffic that monitoring tools can notice. To stay quieter you can:

• Use -sL for zero probes.
• Slow timing with -T1 or -T2.
• Limit probe types to what you need.

Always scan only systems you are authorized to test.

Nmap can resolve hostnames during discovery, which adds context but also generates DNS queries that may be logged.

• -n disables all DNS resolution (faster, quieter).
• -R forces resolution even for hosts marked down.
• --dns-servers specifies which resolver to use.

Disabling DNS with -n speeds up large sweeps significantly.

Choose the right flag for a firewalled target.

You learned host discovery with Nmap:

• -sn runs a ping sweep with no port scan.
• Nmap mixes ICMP, TCP SYN/ACK, and timestamp probes by default; ARP on local segments.
• Custom probes: -PS/-PA/-PU/-PE.
• -Pn skips discovery when ICMP is blocked; -sL lists targets with zero probes.
• Tune timing and probes for stealth, and only scan authorized systems.

Next: port scanning techniques.