>> Now on to the lab.
In this lab, I'll walk you through
my favorite host discovery options.
I'll show you how, when,
and why I use them.
Then I'll show you something that I've found
wrong in the Nmap documentation
using Nmap 7.70 on both Windows,
a Mac, and Kali.
Finally, I'll remind you
of how to increase the output detail in
your scan and also how to get
a quick and easy running status of your scan.
Welcome to the lab on Nmap host discovery.
I'm just going to get started with an Nmap scan.
>> This is a list scan
>> of a public network space.
It's of Nmap's preferred scanning space actually.
Before I start, I wanted to mention
that adjusting the timing of this scan will
have little effect on the speed of
its results because it's
simply doing a reverse DNS
lookup of all identified targets.
In other words, if I put
a -T5 here to speed up the scan, it'll do nothing.
It makes it no faster.
This scan is great
against public networks for reconnaissance and
provides really good insight for
the next phase in a penetration test,
>> which is scanning.
>> I'll run it. This is
a /24 of a public network space
and you saw how fast that was, 7.54 seconds.
This is great information.
You're seeing IP addresses and reverse name lookups
of all of these responding hosts.
Now let's jump in and do my favorite scan.
This is nmap -sn.
This is a ping sweep of my
>> entire internal flat network.
>> This scan is awesome because it quickly identifies
all responding hosts and gives me
their name and MAC address.
It also sets you up for learning interesting targets.
It doesn't however do a port scan.
If you want to do a port scan and don't
mind waiting a little longer,
do the following host discovery scan.
I'll go ahead and run this one
>> and show you the results.
>> It scanned my entire internal network /24
>> and you can see some of the results here.
>> It did in 6.54 seconds and it gives me names,
fully qualified domain names internally,
IP address, MAC address,
and then it figures out based on the first half of
the bits of the MAC address,
what the manufacturer is.
That's a really cool scan,
especially on an internal network.
Let's move on to the no ping scan.
That is nmap -Pn.
What this does is it skips host discovery and
it runs a TCP-based scan of everything.
This scan takes awhile because it scans all
1,000 ports of every device on the identified network.
You can hit Enter to see the status of
the current stage and that's
a tip that I wanted to give you
and I'll show it to you in a second.
All of the scans that start with -P
>> and then a letter do this in my experience.
>> The Nmap documentation suggests that you can put
the TCP ports you want to
scan right after the second letter.
However, in version 7.70 on a PC,
Mac, and Kali box,
it doesn't do this for me.
Instead, you have to use the -P, then the port number.
Now, I'll show you a couple of
examples of what I'm talking about.
First, I want to go ahead and run this scan
>> and it takes a really long time
>> because it's scanning every single host on the network,
whether it finds it up or not.
That's why calls it a no ping because it
really doesn't do host discovery.
Now I'm going to show you what I was talking
about as far as gathering status information.
If you hit Enter,
I've hit it three times now,
you can see it's telling me about the percentage done
of the scan and it tells me about the time remaining.
Usually, it takes more time than that.
Really what it's telling you it's that percentage
done on the current stage,
which is right here,
SYN stealth scan timing.
I'm not going to wait that long.
It does provide good information,
but one of the things it does though,
is it's running 1,000 ports
scan so that's why it takes so long.
We hit Control C, clear the screen.
Now I want to show you a couple of
examples of what I'm talking
about and a little bit of
the inconsistency between what
works and what's in the documentation online.
I'll do Nmap, this is the same scan,
but of a single host.
I'm showing you supposedly just
Port 80 using a no ping scan. Hit Enter.
See it doesn't just scan Port 80.
It does get Port 80,
but it also gets a whole bunch of other stuff.
I'll do a TCP SYN ping,
which is another host discovery scan and that is.
This should just scan 3389.
Well, it did find 3389 because that
host does have 3389 open.
But again, it got all the other ports.
It does work if you do
traditional port scanning techniques, it worked fine.
I'm going to give you a couple more examples of that.
I'll do Nmap, if I could type right.
This is a no ping scan,
but I've done the regular port scanning technique
and that is to put a -P,
a space, and then the port number
or you can put a colon there too.
I'll hit Enter. This is a no ping scan of 1.10.
In there, you can see it only scanned Port 80.
I'll do another one,
that is clear the screen, Nmap -PS.
It's a TCP SYN ping of the same host.
It just scanned that one.
It's just a lot faster and I'm just trying to show you
the difference between what
works and what's in the documentation.
The Nmap documentation is really good.
It's just this is one place
where I've noticed that it either hasn't been
updated since their latest releases or whatever.
I'll leave that up to them to fix.
Let's do an original no ping scan against
the entire internal network using the strategy.
Before I did Nmap -Pn
192.168.1.10/24 and that was taking forever.
Let's do it with just a -p 80.
There we have the results,
25 hosts up, scanned in 7.41 seconds,
a lot faster and it did that
no ping scan lightening fast
and it did give us a lot more useful information.
It's much faster in my opinion.
The only way to do it without
scanning 1,000 ports in Nmap.
The whole point of host discovery is
to narrow down your targets.
Port scanning version detection and OS detection
is where you want to scan a bunch of ports,
not during host discovery.
I've already shown you
>> scan techniques and we'll get into
>> port scanning and OS and version detection later.
That's the end of this lab.
Thanks so much for watching
and I'll show you more stuff in the next lab.
In this lesson, we covered the following.
First, we talked about what host discovery
is and about where I
think you should consider placing
your host discovery options in Nmap scan statements.
Second, we discussed
the most popular and useful host discovery options.
Next, I briefly talked you
through some of the other host discovery options.
Finally, we went through a quick lab demonstrating
the key concepts and commands provided in this lesson.
Thanks so much for working through this lesson with
me and I'll talk to you again in the next one.