Search results
Since this paper is about nmap and host discovery, we’ll talk specifically about how nmap does its discovery, and we’ll learn how to use nmap’s options to improve the discovery phase of a penetration test or vulnerability assessment. To start off, let’s dissect the following very basic nmap command: nmap –sS –O 172.26.1.0/29.
Fortunately, Nmap offers a wide variety of host discovery techniques beyond the standard ICMP echo request. They are described in the following sections. Note that if you specify any of the -P options discussed in this section, they replace the default discovery probes rather than adding to them.
Discover Live Hosts. There are various techniques that can be used to discover live hosts in a network with nmap. Depending on whether you are scanning from the same LAN subnet or outside of a firewall, different live host identifications can be used (we will discuss this later).
Host discovery: discover live hosts within the network. Identify open ports: Nmap conducts port scanning of target hosts. OS version detection: discover the operating system (OS) and version of a target system quickly. We’ve covered all of the commands you need to know, alongside their use cases below.
Because host discovery needs are so diverse, Nmap offers a wide variety of options for customizing the techniques used. Host discovery is sometimes called ping scan, but it goes well beyond the simple ICMP echo request packets associated with the ubiquitous ping tool.
Since this paper is about nmap and host discovery, we’ll talk specifically about how nmap does its discovery, and we’ll learn how to use nmap’s options to improve the discovery phase of a penetration test or vulnerability assessment.
One of the first steps during the network enumeration is to reduce a set of IPs into a list of active or interesting hosts. Depending on if you are inside the network or scanning remotely, how much noise you can make, and your discovery requirements, different tools, and options are available.
