Nmap : Discovering the hosts

This option allows Nmap to perform host discovery using a TCP SYN probe. It works by sending an empty TCP packet with the SYN flag set. By default, the destination port is 80, but this can be changed by specifying one or more ports (for example, -PS22,80,443). Probe packets are then sent in parallel to each specified port.

The SYN flag makes the target believe that a TCP connection is being initiated. If the port is closed, the remote machine responds with an RST packet. If the port is open, it responds with a SYN/ACK, which corresponds to the second step of the TCP three-way handshake. In this case, the machine running Nmap intentionally terminates the connection by sending an RST packet instead of the final ACK. This RST is automatically generated by the operating system in response to the unexpected SYN/ACK.

For host discovery purposes, Nmap does not attempt to determine whether the port is open or closed. Receiving either an RST or a SYN/ACK simply indicates that the host is active and reachable.

nmap -PS <adress-ip>

TCP ACK Ping — -PA

TCP ACK ping works similarly to the TCP SYN probe, except that it uses the TCP ACK flag instead of SYN. An ACK packet is normally sent to acknowledge data within an already established TCP connection, which is not the case here. Since no connection actually exists, the remote host typically responds with an RST packet, confirming that the machine is active.

The -PA option uses port 80 by default, just like the SYN test, but it can also target a user-specified list of ports. When this option is used by a non-privileged user or against an IPv6 target, Nmap relies on the connect() method, which actually sends a SYN packet rather than an ACK, making the technique less faithful to the original ACK test principle.

Nmap provides both SYN (-PS) and ACK (-PA) probes to increase the chances of bypassing firewalls. Many firewalls are configured to block incoming SYN packets except for certain public services, while allowing outbound connections. In such cases, SYN packets sent to closed ports are often filtered, whereas ACK packets may pass through. This makes the ACK probe particularly useful against stateless filtering rules.

To maximize host detection regardless of the type of firewall encountered, it is recommended to combine both methods by using the -PS and -PA options simultaneously.

nmap -PS -PA <adress-ip>

UDP Ping — -PU

When a UDP packet reaches a closed port, the target machine typically responds with an ICMP “port unreachable” message, indicating that the host is active and reachable. On the other hand, other ICMP messages such as host unreachable, network unreachable, or TTL exceeded indicate that the host is inactive or inaccessible. A complete lack of response is interpreted in the same way.

If the packet reaches an open port, most UDP services do not respond, which is why an uncommon port is usually chosen for this type of test.

The main advantage of UDP ping is its ability to bypass firewalls and filtering devices that monitor only TCP traffic.

nmap -PU <adress-ip>

ICMP Pings — -PE, -PP, -PM

Nmap can perform host discovery using ICMP packets, similar to those used by the standard ping command. It mainly sends ICMP Echo Request packets (type 8) to target IP addresses and waits for an Echo Reply (type 0) to determine whether a host is active. However, this method is often blocked by firewalls, making it unreliable over the Internet, although it remains effective on local networks.

This method is practical and efficient for local networks and can be enabled with the -PE option.

To bypass such filtering, Nmap can also use other types of ICMP requests, such as timestamp and address mask requests, by using the -PP and -PM options. A response to these messages indicates that a host is active and reachable. These techniques are useful when Echo Requests are filtered but other ICMP message types are still allowed.

nmap -PE -PP -PM <adress-ip>

ARP Ping — -PR

ARP ping (-PR) is the most effective host discovery method on a local Ethernet network (LAN). On this type of network, many IP addresses are often unused, and traditional IP-based methods (ICMP, TCP, UDP) can be slower because the system must first resolve MAC addresses using ARP.

Nmap includes an optimized ARP scan that quickly identifies active hosts. When an ARP reply is received, Nmap immediately knows that the machine is present, without needing to send additional discovery probes. This makes ARP scanning faster and more reliable than IP-based scans on a local network.

For this reason, Nmap uses ARP by default whenever it detects that the targets are on the same local network as the scanning machine, even if other ping options are specified. If you want to disable ARP scanning, you must use the –send-ip option.

nmap -PR <adress-ip>

IP Protocol Ping — -PO

IP Protocol Ping is a host discovery method that consists of sending IP packets with specific protocol numbers set in the IP header. If no protocol is specified, Nmap sends ICMP (1), IGMP (2), and IP-in-IP (4) packets by default, although this list can be modified at compile time.

Nmap looks for a response using the same protocol as the request, or for an ICMP “Protocol Unreachable” message, which indicates that the protocol is not supported but that the host is up and reachable.

This method therefore makes it possible to detect hosts even when other types of ping probes are filtered.

nmap -PO <adress-ip>