When scanning networks or hosts with ICMP (ping) blocked and wanting to determine whether the host is alive or not, we can use various techniques for this. Often it is wise to first determine the live targets before starting a full-scale scan, and it is rarely worthwhile to spend time and resources scanning systems without certainty whether the host is even alive.

## TCP SYN Ping (-PS)

Option -PS sends an empty TCP packet with the SYN flag set. The default destination port is 80. The port can be specified (e.g. -PS22-25,80,113,1050,35000), in which case the packet is sent to each port simultaneously.

The SYN flag in a TCP packet tells the remote system that you are attempting to establish a connection. Normally, the destination port is closed, and an RST packet is sent back. If the port happens to be open, the host that received the packet responds with a SYN/ACK TCP packet, which is the second step in the three-way handshake of TCP. The device executing Nmap breaks the newly established connection by responding to this with an RST packet instead of sending an ACK packet, which would complete the handshake and establish a full connection.

The point is, that nmap does not care whether the port is open or closed. Either the previously mentioned RST or SYN/ACK response tells Nmap that the target is available and responding.

---

## TCP ACK Ping (-PA)

TCP ACK-ping and SYN-ping are quite similar. The difference is that the ACK flag is set in the TCP packet instead of the SYN flag. With the ACK flag, it is claimed to the target of the scan that a connection already exists, even though such a connection does not exist. Hosts always respond to this with a RST flag (TCP packet), thereby revealing their existence.

Option -PA uses the same default port as -PS (80) and can also accept a list of receiving ports in the same format.

Many administrators configure routers and other simple firewalls to block incoming SYN packets except for those intended for public services such as a company's website or email server. In such cases, the ACK flag may work by bypassing these rules directly.

Firewalls often also block unusual packets, such as ACK-TCP packets that do not have an existing connection. The packet is deemed incorrect for that particular situation and is dropped. SYN-TCP packets have much better chances of functioning in such cases.

This raises the question of what technique to use when the firewall rules of the target network are unknown or inconsistent. The correct answer is usually both. Nmap can send SYN and ACK packets to multiple ports simultaneously and simultaneously perform other host discovery techniques.

---

## UDP Ping (-PU)

Another option for finding the host is UDP-ping, which sends a UDP packet to the specified ports. The switch uses the same format as the previously discussed -PS and -PA options. If no ports are specified, ports 40,125 are used by default. By default, a very rare port is used because sending to open ports is usually undesirable in this type of scanning.

When encountering a closed port, the target machine should respond with an ICMP destination unreachable packet as a response to the UDP packet. This indicates to Nmap that the machine is available. Other errors indicate that the target is down or unreachable. A missing response is also interpreted in this way. If an open port is reached, most services simply ignore the empty packet and do not return any response. Therefore, the default port is 40,125, which is highly unlikely to be in use.

The advantage of this scanning type is that it bypasses firewalls and filters that only screen TCP connections.

---

## ARP Scan (-PR)

One of the most common use cases for Nmap is scanning an ethernet LAN network. For most LAN networks, the majority of IP addresses are unused for most of the time. When Nmap tries to send a raw IP packet, such as an ICMP packet, the operating system needs to determine the MAC address corresponding to the target IP address in order to send the packet. This requires sending ARP queries.

When the target host cannot be reached, the source host usually adds an incomplete entry for the corresponding destination IP to its own ARP table. The ARP table has a limited storage capacity, and some operating systems may not handle it well when the table becomes full.

ARP scanning solves this problem, as well as other issues, and is often faster than typical IP scanning. Nmap sends raw ARP queries and handles retransmissions and timeouts at its discretion.


Host discovery techniques

Nmap is one of the most well-known tools that you can use to perform versatile network scans. Every information security professional should know how to use this tool.

Nmap is one of the most well-known network scanning tools, often used by cybersecurity experts. In this course, we will learn how to use this tool and explore its capabilities. Additionally, we will examine the traffic generated by the tool and analyze the pros and cons of different scanning methods. It is beneficial to have an understanding of how networks operate in this course.

Warning! - Conducting network scans without permission may cause system malfunctions and/or crashes. Please refrain from attempting to scan any address/system without certainty that said system is in your possession or that you have permission to do so.

Host discovery techniques

Learn to hack — start here