> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/reconnaissance/active-reconnaissance-approach/nmap/host-discovery.md).

# Host Discovery

Host discovery is an essential phase in **network reconnaissance**, helping identify active systems before conducting further scans. Depending on the environment (internal or external), different **Nmap** techniques can be used, such as **ARP, ICMP, TCP SYN/ACK, and UDP scans**. Additionally, options like **DNS control, skipping host discovery, and traceroute analysis** enhance the flexibility of **Nmap** for penetration testing

## **Host Discovery Techniques**

**Internal Penetration Testing**

For internal assessments, the following **Nmap techniques** can be used to discover active hosts:

* **ARP Scan**: Sends **ARP** packets to identify hosts on the local network.
* **ICMP Scan**: Uses **ICMP (ping) packets** to detect active hosts.
* **TCP SYN/ACK Scan**: Sends **TCP SYN/ACK** packets to determine open ports.
* **UDP Scan**: Sends **UDP packets** to detect hosts accepting UDP traffic.

**External Penetration Testing**

For external assessments, **Nmap** provides the following host discovery techniques:

* **ICMP Scan**: Uses **ICMP echo requests** (pings) to identify active hosts.
* **TCP SYN/ACK Scan**: Detects live hosts by sending **SYN or ACK packets**.
* **UDP Scan**: Identifies hosts that respond to **UDP probes**.

## Nmap Host Discovery Options and Commands

Nmap provides several options for host discovery, each with a specific purpose. Below are commonly used techniques with example commands.

1. **List Scan (`-sL`)**

A **list scan** enumerates all IP addresses in a target range **without actively scanning them**. This is useful for generating a target list for future scans.

**Example:**

```bash
nmap -sL 192.168.0.0/24
```

2. **Ping Scan (`-sn`)**

The **ping scan** determines which hosts are online **without scanning for open ports**. On a **LAN**, it uses **ARP requests**; on an **external network**, it defaults to **ICMP pings** and **TCP SYN probes**.

**Example:**

```bash
nmap -sn 192.168.0.0/24
```

3. **Disable DNS Resolution (`-n`)**

By default, **Nmap** resolves hostnames via DNS. The **`-n`** option **disables** DNS resolution, speeding up scans.

**Examples:**

```bash
nmap -n 192.168.1.1
nmap -n 192.168.1.1/24
nmap -n example.com
```

4. **Skip Host Discovery (`-Pn`)**

The **`-Pn`** option treats all hosts as **online**, bypassing host discovery and directly scanning for open ports. This is useful when **firewalls block ICMP and SYN scans**.

**Examples:**

```bash
nmap -v -Pn 192.168.1.1/24
nmap -Pn 192.168.1.1
nmap -Pn example.com
```

5. **TCP SYN/ACK, UDP, or SCTP Discovery (`-PS`, `-PA`, `-PU`, `-PY`)**

These options specify the probe type for host discovery by sending packets to a given port.

**Examples:**

* **TCP SYN probe:**

  ```bash
  nmap -v -sn -PS 192.168.1.1/24
  ```
* **TCP ACK probe:**

  ```bash
  nmap -v -sn -PA 192.168.1.1/24
  ```
* **UDP probe:**

  ```bash
  nmap -sn -PU 192.168.1.1/24
  ```

6. **ICMP Discovery Probes (`-PE`, `-PP`, `-PM`)**

These options specify **ICMP-based** host discovery techniques:

* **ICMP Echo Request (`-PE`)**
* **ICMP Timestamp Request (`-PP`)**
* **ICMP Netmask Request (`-PM`)**

**Examples:**

```bash
nmap -v -sn -PE 192.168.1.1/24  # ICMP Echo
nmap -v -sn -PP 192.168.1.1/24  # ICMP Timestamp
nmap -sn -PM 192.168.1.1/24     # ICMP Netmask
```

7. **Custom DNS Servers (`--dns-servers`)**

This option allows specifying custom **DNS servers** for resolution.

**Example:**

```bash
nmap --dns-servers 8.8.8.8 192.168.1.1
```

8. **Use System DNS Resolver (`--system-dns`)**

This option instructs **Nmap** to use the **operating system's DNS resolver** instead of its own methods.

**Example:**

```bash
nmap --system-dns 192.168.1.1
```

9. **Perform Traceroute (`--traceroute`)**

This option conducts a **traceroute** to identify the path between the scanner and the target host.

**Example:**

```bash
nmap --traceroute 192.168.1.1
```