Nmap Live Host Discovery | Nmap | Jr Penetration Tester

Recently, I completed the Nmap Live Host Discovery room, which is the first room in the Nmap module of the Jr Penetration Tester learning path. This room introduces Nmap and explains how to discover live hosts before proceeding to port scanning. Identifying live hosts first helps reduce unnecessary scans and makes the reconnaissance process more efficient.

Nmap generally follows nine stages during a scan:

Enumerate Targets
Discover Live Hosts
Reverse DNS Lookup
Scan Ports
Detect Service Versions
Detect Operating System
Traceroute
NSE Scripts
Write Output

In this room, we focused on the first three stages: Enumerating Targets, Discovering Live Hosts, and Reverse DNS Lookup.

Enumerating Targets

The first task introduced subnetting, subnet masks, and default gateways. Although it was only a basic introduction, it explained how subnetworks divide a larger network into smaller network segments.

You may have noticed IP addresses ending with prefixes such as /16 or /24. These represent the subnet mask. For example:

/16 corresponds to the subnet mask 255.255.0.0
/24 corresponds to the subnet mask 255.255.255.0

The bits represented by 255 identify the network portion of the IP address, while the bits represented by 0 identify the host portion. A /16 network can accommodate up to 65,534 usable hosts, whereas a /24 network can accommodate up to 254 usable hosts.

Before scanning a target, Nmap allows us to see which hosts or networks will be scanned using the following command:

nmap -sL TARGET

nmap -sL TARGET

The -sL option performs a list scan. It simply lists the targets without sending any packets to them.

Discovering Live Hosts

By default, Nmap performs host discovery before starting a port scan. If we only want to discover live hosts without scanning ports, we can use:

nmap -sn TARGET

nmap -sn TARGET

The -sn option disables port scanning and performs host discovery only.

The method Nmap uses depends on whether the scan is performed on a local network, a remote network, and whether the user has root (or sudo) privileges.

When a privileged user scans hosts on the local network, Nmap uses the ARP protocol because it is the fastest and most reliable method for local host discovery.

When a privileged user scans hosts outside the local network, Nmap may use several discovery techniques, including:

ICMP Echo Requests
ICMP Timestamp Requests
TCP SYN Ping
TCP ACK Ping

When an unprivileged user performs host discovery, Nmap typically attempts a TCP connect() probe by sending SYN packets to commonly used ports such as 80 (HTTP) and 443 (HTTPS).

Host Discovery using ARP

ARP (Address Resolution Protocol) is mainly used for discovering hosts on the local network.

The following command performs an ARP Ping scan:

nmap -PR -sn TARGET

nmap -PR -sn TARGET

The -PR option tells Nmap to use ARP requests, while -sn disables port scanning.

If the target host is online, it responds with an ARP Reply, allowing Nmap to identify it as a live host.

Host Discovery using ICMP

One of the most common methods of host discovery is ICMP Ping.

The following command sends an ICMP Echo Request (Type 8):

nmap -PE -sn TARGET

nmap -PE -sn TARGET

The -PE option specifies an ICMP Echo Request.

If the target is online, it responds with an ICMP Echo Reply (Type 0).

Many firewalls block ICMP Echo Requests, so Nmap supports other ICMP message types as well.

To send an ICMP Timestamp Request (Type 13), we can use:

nmap -PP -sn TARGET

nmap -PP -sn TARGET

If the host is online, it replies with an ICMP Timestamp Reply (Type 14).

Another option is an ICMP Address Mask Request (Type 17):

nmap -PM -sn TARGET

nmap -PM -sn TARGET

If supported, the target replies with an ICMP Address Mask Reply (Type 18). Although this method exists, modern operating systems rarely respond to Address Mask Requests, making it less useful today.

Host Discovery using TCP and UDP

Before understanding TCP SYN Ping and TCP ACK Ping, it is important to understand the TCP Three-Way Handshake.

The handshake begins when the client sends a SYN packet to the server. If the port is open, the server responds with a SYN-ACK packet. Finally, the client sends an ACK packet, completing the connection. If the port is closed, the server usually responds with an RST (Reset) packet instead.

TCP SYN Ping

To perform a TCP SYN Ping, we use:

nmap -PS -sn TARGET

nmap -PS -sn TARGET

We can also specify particular ports:

nmap -PS21,80,443 -sn TARGET

nmap -PS21,80,443 -sn TARGET

This command sends SYN probes only to ports 21, 80, and 443.

If an open port responds with a SYN-ACK or a closed port responds with an RST packet, Nmap knows that the host is alive. Unlike a normal TCP connection, Nmap does not complete the handshake because its goal is only to determine whether the host is reachable.

TCP ACK Ping

The following command performs a TCP ACK Ping:

nmap -PA -sn TARGET

nmap -PA -sn TARGET

If the target host is alive, it typically responds with an RST packet regardless of whether the destination port is open or closed. This allows Nmap to determine that the host is reachable.

UDP Ping

To perform a UDP Ping, we use:

nmap -PU -sn TARGET

nmap -PU -sn TARGET

Unlike TCP, sending a UDP packet to an open port usually does not generate a response. However, if the UDP packet reaches a closed port, the target returns an ICMP Port Unreachable message. Receiving this message tells Nmap that the host is alive.

Reverse DNS Lookup

Reverse DNS (rDNS) is the process of resolving an IP address to its corresponding hostname. Instead of asking, "What is the IP address of example.com?", Reverse DNS asks, "What hostname is associated with this IP address?"

Nmap can force Reverse DNS lookups for all discovered hosts using:

nmap -R TARGET

nmap -R TARGET

To disable Reverse DNS lookups completely, we can use:

nmap -n TARGET

nmap -n TARGET

Disabling Reverse DNS can make scans faster, while enabling it may provide additional information about discovered hosts.

Conclusion

Overall, this room introduced the first three stages of the Nmap scanning process: Enumerating Targets, Discovering Live Hosts, and Reverse DNS Lookup. I learned how Nmap uses different host discovery techniques, including ARP, ICMP, TCP, and UDP, depending on the network environment and user privileges. Understanding these techniques is important because identifying live hosts before performing a port scan reduces unnecessary traffic, improves scanning efficiency, and provides a strong foundation for the later stages of network reconnaissance.

Contents