>> Welcome to the Nmap lesson on host discovery scanning.
As you work through this lesson,
please just remember that the main point
of host discovery is to scan
larger networks in such a way that you can narrow
down your search to interesting targets.
Once you identify those interesting targets,
is when you move on to do more in-depth port
scanning using different scanning techniques,
OS and version detection or
even vulnerability assessment and penetration testing.
This lesson, we'll show you quick ways to
identify interesting targets among a sea of hosts.
Let's get started. Here are
the learning objectives for this lesson.
First, we'll talk about what
host discovery is and about where I think you
should consider placing your host discovery options
in an Nmap scan statement.
Second, we'll discuss
the most popular and useful host discovery options.
Third, I'll briefly talk you
through some other host discovery options.
Finally, we'll go through a quick lab
so that I can demonstrate
the key points and show you why I
like several of the host discovery options a lot.
Also, throw in a couple of tips and
reminders that may help you in your scanning.
In this lesson, the lab is really
important because recent versions of Nmap don't
work exactly according to
the online documentation so
please run through them with me.
What is host discovery?
An Nmap map host discovery is intended to scan
entire network segments in order to find
out what devices or hosts are available.
In the previous lesson, we focused
on performing various scans on
selected targets and even though you could run
those scans against a range of hosts
>> or entire networks,
>> the goal was to perform
>> various port scanning techniques
>> against those targets to discover responding services.
Host discovery scans are optimized to narrow down
a large number of hosts to
a more manageable list of interesting targets.
Where should you place your host discovery options
in an Nmap statement?
Well, like I said before,
it's entirely up to you,
but I suggest placing
your host discovery options at
the beginning of the scan statement.
Place it where you would have placed
>> your scan technique.
>> In fact, since host discovery is
normally used for an entirely different purpose,
you should replace your scan technique option
with your host discovery option in most cases.
I'll show you a couple of good examples in the lab.
Do you have to use any host discovery options?
No, you don't and if you don't,
none will be run as a part of a default Nmap scan.
Although. I think you'll agree
that scanning an entire network
using some of the less common
>> host discovery options will
>> yield very similar results as
a standard Nmap scan that
doesn't have any host discovery options selected.
When do I use it?
>> In many ways, host discovery scans,
>> maybe one of the first scans a network administrator or
security professional may want to run
on a large range of network devices.
In fact, for the network administrator,
host discovery may be the only types of scans that
produced the information that he or she is looking for.
That is an inventory of live hosts.
I'll show you what I mean in the lab.
The last bullet point is simply a reference to
the host discovery reference page on the Nmap website.
Here are my favorite host discovery options
>> and what I'll call extra features or sub-options.
>> Nmap dash sL is a list scan.
It lists each host of a network specified
without ever sending any packets to the target host.
By the port Nmap,
we'll do a reverse DNS resolution
on each host to learn their names.
This is a great scan to run for reconnaissance against
public address spaces because it is
non-intrusive since it doesn't
send any packets to the host directly.
It is even less noticeable than a TCP SYN scan
>> because it basically is just doing
>> a reverse DNS lookup against name servers.
Then there's the Nmap dash sn,
which is called a no port scan.
This one is probably my favorite host discovery option.
It tells Nmap not to do a port scan
after host discovery and only prints available hosts.
This is also known as a ping scan or ping sweep.
The default host discovery done with dash
sn consists of an ICMP echo request,
TCP SYN to port 443,
TCP ACK to port 80,
and an ICMP timestamp requests by default.
This is very unobtrusive,
yet provides very valuable information.
You can combine this with a traceroute and NSE scripts.
The reason I love this scan so much is
that it basically only displays
a list of the hosts that are up and
running and it does it very quickly.
It'll resolve their names and
if they exist on your local subnet or
VLAN will provide you with
MAC addresses and the manufacturer
of the network adapter.
You can also combine it with the next scan,
which is the no ping scan.
Nmap dash Pn, or the no ping scan.
This option skips Nmap's discovery stage,
which is usually used by Nmap to
determine active devices when
and only those active devices are found,
>> Nmap will perform additional probes.
>> But the no ping scan will perform
requested scanning options against
all target specified even if it's not found active.
Additionally, ARP scanning is performed
unless the dash dash disable dash arp dash ping,
or dash dash syn dash IP is specified.
This scan is relatively slow
when additional options are not specified,
since it basically runs a default Nmap scan against
every single address identified in the scan,
whether it's up or not.
Generally, this should be combined with other options.
If you combine it with a dash sn,
it will not do a port scan.
The useful options you can combine with
any host discovery scan are also listed on this slide.
A dash n can speed up
some scans because it forces no DNS resolution.
The dash R forces resolution of all hostnames.
The dash dash traceroute will literally perform
a traceroute to every responding target
>> and the dash dash DNS dash servers feature
>> allows you to specify DNS servers
>> to use for name resolution.
>> By default, Nmap will either use
your system's name servers or will
use the target's name server sometimes.
You can look each of these up on your own if you wish,
using the link I provided earlier,
but I'll run through them quickly
since I generally explained how
flags are set in TCP headers
>> in several previous videos.
>> The dash PS performs a TCP SYN ping.
The dash PA does a TCP ACK ping.
The dash PU does a UDP ping.
The dash PY does SCTP init ping.
Then dash PO does an IP protocol ping.
In recent releases of Nmap,
I just haven't found these to be that great compared
to the other scan techniques
>> and host discovery options.
>> The dash PE, dash PP,
and the dash PM causes Nmap to send ICMP pings.
It does do much more than a standard ping
submitted from a command line
or terminal window because it
goes beyond a simple ICMP echo request
so you may find these useful in some cases.
Dash PR performs an arp ping.
It is intended to provide you with
the MAC addresses of your target.
Of course, it will only work if
those targets are in your broadcast domain,
aka on your local network.
I personally find the dash
sn much more helpful for this and way faster.
I suggest you test a difference for yourself.
Dash dash disabled dash arp
dash ping causes Nmap to disable
arp and IPv4 and neighbor discovery in IPV6.
This theoretically can make some scans run faster,
but I hardly ever use it because
of how valuable MAC addresses are.
Dash dash system dash DNS causes Nmap to use
your scanning stations name servers to perform
reverse name resolution instead of your targets.
I don't use it ever because it limits Nmap's ability to
perform requests in parallel
instead of just performing one at a time.
But it's available if you
figure out a time and place for it.